لطفا منتظر باشید ...
Tom and Deb Shinder's Configuring ISA 2004 Network Layout
Throughout this book, we will give examples of how to configure the ISA firewall. Each of the exercises and configuration options will be within the context of the sample network we configured for this book. You can replicate this configuration on a lab network. Your lab network can consist of computers, or you can use operating system virtualization software to simulate the lab network configuration we use in this book. Microsoft Virtual PC and VMware Workstation are the two most popular operating system virtualization applications. We prefer, and have used, VMware extensively in our ISA firewall testing and modeling environment because of its advanced networking features. However, Microsoft Virtual PC or Virtual Server is adequate for most ISA firewall testing scenarios.
Figure 4.7 depicts the machines and some of the details of the machines in the lab network that forms that basis of the discussions in this book.
Figure 4.7: Lab Network Details
Tables 4.3 and 4.4 provide most of the salient details of the machines participating in the lab network setup.
Setting | EXCHANGE 2003BE | CLIENT | EXCHANGE 2003FE | ISALOCAL | EXTCLIENT |
|---|---|---|---|---|---|
IP Address | 10.0.0.2 | 10.0.0.3 | 172.16.0.2 | Int: 10.0.0.1 Ext: 192.168.1.70 Dmz: 172.16.0.1 | 192.168.1.90 |
Default Gateway | 10.0.0.1 A | 10.0.0.1 | 172.16.0.1 | 192.168.1.60 | N/ |
DNS | 10.0.0.2 | 10.0.0.2 | 10.0.0.2 | Int: 10.0.0.2 Ext: N/A Dmz: N/A | N/A |
WINS | 10.0.1.2 | 10.0.0.2 | 10.0.0.2 | Int: 10.0.0.2 Ext: N/A Dmz: N/A | N/A |
Operating System Services | Windows Server 2003 DC (msfirewall. org) 5 DNS WINS DHCP RADIUS Enterprise CA | Windows XP None | Windows Server 2003 Exchange 2003 | Windows Server 2003] ISA 2004 | Windows XP None |
RAM1 Allocation | 128MB | 128MB | 128MB | 128MB | 64MB |
VMNet2 | 2 | 2 | 4 | Int: 2 Ext: 0 Dmz: 4 | N/A |
Setting | DSL ROUTER | REMOTEISA | BRANCHWEB SERVER | REMOTE CLIENT | EXTERNAL WEB |
|---|---|---|---|---|---|
IP Address | Int: 192.168.1.60 Ext: Public | Int: 10.0.1.1 Ext: 192.168.1.71 | 172.16.1.2 | 10.0.1.2 | 192.168.1.243 |
Default Gateway | Public Gateway | 192.168.1.60 | 172.16.1.1 | 10.0.1.1 | N/A |
DNS | Public | Public4 | N/A | N/A | N/A |
WINS | N/A | N/A | N/A | N/A | N/A |
Operating System | N/A | Windows Server 2003 | Windows Server 2003 | Windows XP | Windows 2000 |
Services | N/A | ISA 2004 | SMTP W W W NNTP FTP | N/A | SMTP W W W NNTP FTP |
RAM Allocation | N/A | 128MB | 64MB | 128MB | 64MB |
VMNet | N/A | Int: 6 Ext: 0 Dmz: 5 | 5 | 6 | N/A |
5 The Active Directory domain name used on the internal network is msfirewall.org. We will simulate a split DNS configuration so that internal and external network hosts are able to connect to hosted resources using the same Active Directory domain name.
This lab network configuration forms the basis of all the exercises and examples provided in this book. If you plan to mirror this network on all physical machines, then you can ignore the memory allocations noted in the tables. Those memory allocations were used in our VMware network test lab so that we could run up to seven virtual machines simultaneously on the host operating system. Although the virtual machine performance was a bit sluggish when running more than four VMs on a Pentium 4 1.5GHz machine with 1 GB of memory, performance was good enough to allow for viable scenario testing
We place the lab hosts on different VMnets so that the networks are completely segmented. Each VMnet represents its own Ethernet broadcast domain. This allows us to simulate actual network communications as they would take place on any other wired network and simplifies log file and Network Monitor analysis. We highly recommend that you place each network ID on a different VMnet when testing your own ISA firewall configuration scenarios.
Note that not all machines are required for all scenarios. For any given scenario discussed in this book, only a subset of the machines described in the figure and table above are required. You also do not need to create a virtual machine for each host listed in the tables. For example, the Windows XP machine can act as the CLIENT, EXTERNALCLIENT and REMOTECLIENT. The only thing you need to do is change the machine name, the IP addressing information, and the VMnet on the virtual machine.
One major advantage of using virtual machines over physical devices is that you can create snapshots of the baseline configuration for each host in your virtual ISA firewall lab. You can save a snapshot of each virtual machine right after you have created its baseline configuration. You can then return to this snapshot when you're done testing a particular scenario.
Detailed instructions on how to configure the individual machines on the lab network are beyond the scope of this book. However, we will go over the detailed procedure on how to create the virtual machine for the ISALOCAL computer using VMware Workstation 4.0. After going through this example, you will have a good enough understanding on how to use VMware to create the rest of the virtual machines for our sample ISA firewall virtual network.
Creating the ISALOCAL Virtual Machine
The first step is to obtain the VMware Workstation software. You can download a trial version and test VMware before purchasing it. Go to http://www.vmware.com/download/ to find the download link. Make sure to review the system requirements before installing the VMware software. You can find these at http://www.vmware.com/support/ws45/doc/
Run the VMware Workstation executable after downloading the file. You will need to restart the host operating system after installation is complete.
The ISALOCAL virtual machine runs the ISA firewall software on Windows Server 2003. You can install the Windows Server 2003 operating system from a CD-ROM drive connected to your host operating system, or you can use a CD image file ('.iso image'). These .iso images are used extensively on the MSDN download site. If you only have a CD-ROM copy of Windows Server 2003, you should consider creating an .iso file from the CD. This will make creating virtual machines using VMware Workstation much easier, as you can mount the .iso file as a CD-ROM drive and boot to the .iso CD-ROM drive to install Windows Server 2003.
You can also create your own .iso files. This can be of great help when working with Virtual machines, as you can mount the .iso files as virtual CD-ROM drives. For example, you might want to create an .iso file for your ISA 2004 CD. There are a number of software applications that allow you to do this. One that we've had success with is WinISO, which you can find at www.winiso.com/
| Tip | You can download an evaluation version of the Windows Server 2003 Enterprise Edition software at https://microsoft.order-5.com/windowsserver2003evaldl/ This trial software is provided as an .iso file that you can mount as a virtual CD-ROM Drive. |
In this example, we'll use an .iso file. After placing the .iso file on the local hard disk of your host operating system, perform the following steps to create the ISALOCAL virtual machine:
Open the VMware application. In the VMware Workstation window (Figure 4.8), click the New Virtual Machine icon.
Figure 4.8: VMware Workstation Window
Click Next on the Welcome to the New Virtual Machine Wizard page.
On the Select the Appropriate Configuration page, select the Custom option. Click Next.
On the Select a Guest Operating System page (as shown in Figure 4.9), select the Microsoft Windows option. Select Windows Server 2003 Enterprise Edition from the Version list. Click Next.
Figure 4.9: Guest Operating System Page
On the Name the Virtual Machine page (Figure 4.10), enter a Virtual machine name in the text box. In this example, name the machine ISALOCAL. Enter a path for the virtual machine in the Location text box. Click Next.
Figure 4.10: Name the Virtual Machine Page
On the Memory for the Virtual Machine page (Figure 4.11), assign the amount of host system memory you want to allocate to this virtual machine. In our ISA firewall virtual firewall network, the ISALOCAL machine has 128MB of memory allocated to it. Enter 128 in the memory text box. Click Next.
Figure 4.11: Memory for the Virtual Machine Page
On the Network Type page (Figure 4.12), select the Use bridged networking option. This option allows the first network interface card in the virtual machine to connect to the live network to which the host operating system is connected. You can assign a valid IP address on this interface in the virtual machine and communicate with all machines on the live network and connect to the Internet via the live network's gateway. This is the interface that will act as the external interface of the ISALOCAL ISA firewall virtual machine. The ISALOCAL VM will use this interface to connect to the live network's Internet gateway (which is a DSL router on our network). We will later add two more network interface cards to this virtual machine that will be used to connect the ISALOCAL virtual machine to VMnet2 (the Internal network) and VMNet4 (the DMZ network). Click Next.
Figure 4.12: Network Type Page
On the Select I/O Adapter Types page, use the default settings, and click Next.
On the Select a Disk page, select the Create a New Virtual Disk option. This will create a virtual hard disk file on the host operating system's drive. This virtual machine will see this file as a hard disk. Click Next.
On the Select a Disk Type page, select the IDE (Recommended) option, and click Next.
On the Specify Disk Capacity page (Figure 4.13), use the default value, 4.0 for the Disk size (GB) entry. Although the Windows Server 2003 and ISA firewall software will not require this amount of disk space, you do not need to worry about the virtual disk file using up this amount of space on your host system's physical disk. The value you enter on this page represents the maximum size the virtual machines disk will grow. While the virtual machine will always see its hard disk size as the size you enter on this page, the actual virtual disk file on the host operating system grows dynamically to accommodate the amount of space required by the data placed on the virtual machine's hard disk. Click Next.
Figure 4.13: Specify Disk Capacity Page
Accept the default name for the disk file on the Specify Disk File page, and click Finish.
In the ISALOCAL window, click the VM menu, and then click Settings.
In the Virtual Machine Control Panel dialog box, click the Hardware tab. On the Hardware tab, click Add.
Click Next on the Welcome to the Add Hardware Wizard page.
On the Hardware Type page (Figure 4.14), select the Ethernet Adapter option and click Next.
Figure 4.14: Hardware Type Page
On the Network Type page, select the Custom option. Select VMNet2 from the drop-down list. This network interface will be the interface connected to the Internal network. Click Finish.
The second network interface card shows up as NIC 2 in the Device list.
In the Virtual Machine Control Panel dialog box, click the Hardware tab. On the Hardware tab, click Add.
Click Next on the Welcome to the Add Hardware Wizard page.
On the Hardware Type page (Figure 4.15), select the Ethernet Adapter option, and click Next.
Figure 4.15: The Hardware Type page
On the Network Type page, select the Custom option. Select VMNet4 from the drop-down list. This network interface will be the interface connected to the DMZ network. Click Finish.
The second network interface card shows up as NIC 3 in the Device list.
Click on the CD-ROM 1 (IDE 1:0) entry in the Device list.
On the right side of the dialog box (Figure 4.16), select the Use ISO image option and use the Browse button to locate the Windows Server 2003 .iso file.
Figure 4.16: Selecting an .iso image
Click on the USB Controller entry in the Device list. Click Remove.
Click OK in the Virtual Machine Control Panel dialog box.
Now that the virtual machine hardware settings are configured, we can begin installing Windows Server 2003. Perform the following steps to complete the Windows Server 2003 operating system installation:
Click the Start this virtual machine link on the left side of the ISALOCAL - VMware Workstation window (Figure 4.17). The machine will boot the CD-ROM disk represented by the .iso file.
Figure 4.17: Starting the Virtual Machine
Press ENTER when you see the Setup Notification page.
Press ENTER on the Welcome to Setup page.
Press F8 on the Windows Licensing Agreement page.
Press ENTER on the Partition Setup page.
Accept the default selection Format the partition using the NTFS file system option on the formatting page and press ENTER. The partition is quickly formatted.
The file copy phase proceeds to copy the Windows Server 2003 files from the .iso image to the virtual disk. The virtual machine will automatically reboot after the files are copied.
The installation routine enters graphical interface mode after the reboot.
Click Next on the Regional and Language Options settings page.
Enter your Name and Organization on the Personalize Your Software page. Click Next.
Enter your product key in the Your Product Key dialog box. Click Next.
On the Licensing Modes page, enter the value 500 in the Per server. Number of concurrent connections text box. Click Next.
On the Computer Name and Administrator Password page, enter ISALOCAL in the Computer name text box. Enter password in the Administrator password and confirm password text boxes. Click Next.
Click Yes in the Windows Setup dialog box indicating that the password you entered is not secure.
Enter the correct date, time, and time zone settings in the Date and Time Settings dialog box. Click Next.
On the Networking Settings page, select Typical settings, and click Next.
Accept the default option on the Workgroup or Computer Domain page. After you have installed the EXCHANGE2003BE machine on the Internal network (VMNet2), you should join the ISALOCAL machine to the msfirewall.org domain. Click Next.
The installation continues, and then the virtual machine restarts.
Log on to the ISALOCAL machine using the Administrator account and the password you created.
Now that the Windows Server 2003 software is installed, we can configure the network interface cards in the virtual machine with the proper IP addressing information. Perform the following steps to configure the ISALOCAL virtual machine's network interface cards and configure other operating system options:
After logging on to the ISALOCAL virtual machine, click the VM menu, and click the Install VMware Tools command.
Click Install in the ISALOCAL dialog box.
Click Next on the Welcome to the installation wizard for VMware Tools page.
On the Setup Type page, select Complete, and click Next.
Click Install on the Ready to Install the Program page.
For each of the Hardware Installation dialog boxes, click the Continue Anyway button.
Click Yes on the VMware Tools Installation dialog box, informing you that hardware acceleration is not enabled on the virtual machine.
If the installation page for Windows Server 2003 appears, close it.
Minimize the notepad window that has the HWAccel.txt file opened.
On the Settings tab of the Display Properties dialog box, click Advanced.
In the Default Monitor and Standard VGA Graphics Adapter Properties dialog box, click the Troubleshoot tab.
On the Troubleshoot tab, drag the slider bar all the way over to the Full setting. Click Apply, and then click OK.
Click OK in the Display Properties dialog box.
Click Finish on the Installation Wizard Completed page.
Click Yes on the VMware Tools dialog box. This will restart the Windows Server 2003 ISALOCAL virtual machine.
Log on as Administrator.
The next step is to configure the network interface cards in the virtual machine. Perform the following steps to configure the network interface cards:
Right-click on an empty area on the desktop, and click Properties.
In the Display Properties dialog box, click the Desktop tab.
On the Desktop tab, click Customize Desktop.
In the Desktop Items dialog box, click the General tab. On the General tab, put checkmarks in the My Documents, My Computer, My Network Places, and Internet Explorer checkboxes. Click OK.
Click Apply, and then click OK in the Display Properties dialog box.
Right-click the My Network Places icon on the desktop, and click Properties.
Right-click the Local Area Connection icon in the Network Connections window, and click Rename. Name the connection WAN.
Right-click on Local Area Connection 2, and click Rename. Name this connection LAN.
Right-click on Local Area Connection 3, and click Rename. Name this connection DMZ.
Now we can assign IP addressing information to each of the interfaces. We'll begin with the external interface of the ISA firewall virtual machine.
Right-click on the WAN interface, and click Properties.
In the WAN Properties dialog box, click the Internet Protocol (TCP/IP) entry, and click Properties.
On the General tab of the Internet Protocol (TCP/IP) Properties dialog box (Figure 4.18), enter the IP addressing information as seen in the following figure.
Figure 4.18: Entering IP Addressing Information
Click the Advanced button.
In the Advanced TCP/IP Settings dialog box, click the DNS tab. On the DNS tab, remove the checkmark from the Register this connection's addresses in DNS checkbox. Click OK.
Click OK in the Internet Protocol (TCP/IP) Properties dialog box.
Click Close in the WAN Properties dialog box.
Perform the following steps to configure the LAN interface's IP addressing information:
Right click on the LAN interface, and click Properties.
In the LAN Properties dialog box, click the Internet Protocol (TCP/IP) entry, and click Properties.
On the General tab of the Internet Protocol (TCP/IP) Properties dialog box (Figure 4.19), enter the IP addressing information as seen in the following figure.
Figure 4.19: Entering IP Addressing Information
Click the Advanced button.
In the Advanced TCP/IP Settings dialog box, click the DNS tab. On the DNS tab, remove the checkmark from the Register this connection's addresses in DNS checkbox.
Click the WINS tab (Figure 4.20). On the WINS tab, click Add. In the TCP/IP WINS Server dialog box, enter the IP address of the WINS server. On our ISA firewall virtual network, the domain controller will also act as a WINS server. Enter 10.0.0.2 into this dialog box. Click Add.
Figure 4.20: Entering a WINS Server Address
Click OK in the Advanced TCP/IP Settings dialog box.
Click OK in the Internet Protocol (TCP/IP) Properties dialog box.
Click OK in the LAN Properties dialog box.
We'll finish up by configuring the IP addressing information for the DMZ interface on the ISA firewall machine. Perform the following steps to configure the DMZ interface:
Right-click on the DMZ interface, and click Properties.
In the DMZ Properties dialog box, click Internet Protocol (TCP/IP), and click Properties.
On the General tab of the Internet Protocol (TCP/IP) Properties dialog box (Figure 4.21), enter the IP addressing information as seen in the following figure.
Figure 4.21: Entering IP Addressing Information
Click the Advanced button.
In the Advanced TCP/IP Settings dialog box, click the DNS tab. On the DNS tab, remove the checkmark from the Register this connection's addresses in DNS checkbox. Click OK.
Click OK in the Internet Protocol (TCP/IP) Properties dialog box.
Click Close in the DMZ Properties dialog box.
The Windows Server 2003 operating system is now ready for the ISA firewall software. At this point, you should save a snapshot of the configuration. Click the Snapshot menu in the ISALOCAL - VMware Workstation window, and click Save Snapshot. This allows you to get back to the base operating system configuration in the event that you want to start from a clean environment again. When we get to installing the ISA firewall software in Chapter 6, we'll describe how to save another snapshot of the configuration after installing the ISA firewall software.
The procedures used to install and configure the ISALOCAL virtual machine can be used to install the other virtual machines in the ISA firewall virtual network. Pay close attention to the IP addressing information for each virtual machine and make sure that you assign each virtual machine to the correct VMnet. You can test whether machines are connected to the correct VMnet by having the ISALOCAL or REMOTEISA machines ping hosts on their respective networks. For example, after creating the EXCHANGE2003BE machine, ping 10.0.0.2 from the ISALOCAL machine. If you do not get a ping reply back, the most likely reason for the failure is that you either misconfigured the IP addressing information on one of the machines, or the machines are not on the same VMnet.
If you are interested in the most simple setup that will allow you to test the majority of scenarios in this book, you can use the following virtual machines:
ISALOCAL
ISAREMOTE
CLIENT
EXCHANGE2003BE
REMOTECLIENT
Note that you do not need to go through the entire configuration again for the REMOTECLIENT machine. You can copy the directory for the CLIENT machine to another location, and then reconfigure the name, IP addressing information, and VMnet in the copy. That will allow you to have a REMOTECLIENT that you can communicate with when we do the site-to-site VPN exercises in Chapter 9.
