Automating ISA 2004 Client Provisioning - Dr. Tom Shinderamp;#039;s Configuring ISA Server 1002004 [Electronic resources] نسخه متنی

Automating ISA 2004 Client Provisioning

There are several methods available for automating the Web Proxy and Firewall client installation and configuration. These include:

Configuring DHCP Servers to Support Web Proxy and Firewall Client Autodiscovery

Configuring DNS Servers to Support Web Proxy and Firewall Client Autodiscovery

Automating Web Proxy Client Configuration with Group Policy

Automating Web Proxy Client Configuration with Internet Explorer Administration Kit (IEAK)

The following sections discuss how to automate the configuration of Web Proxy and Firewall clients using the Web Proxy AutoDiscovery (WPAD) protocol and Active Directory Group Policy. We will not go into the details of how to use the Internet Explorer Administration Kit (IEAK) to automate Web proxy client configuration.

Note that there are two methods for supporting Autodiscovery for Web Proxy and Firewall clients: DNS and DHCP. Table 5.12 provides information that will help you decide which method best fits your needs.

Configuring DHCP Servers to Support Web Proxy and Firewall Client Autodiscovery

DHCP clients can obtain autoconfiguration information from the ISA 2004 firewall computer by using DHCPINFORM messages. The Firewall client and Web browser software can issue DHCPINFORM messages to query a DHCP server for the address of a machine containing the autoconfiguration information. The DHCP server returns the address of the machine containing the autoconfiguration information, and the Firewall client or Web browser software requests autoconfiguration information from the address returned by the DHCP server.

The DHCP server uses a special DHCP option to provide this information. In this section on configuring Web Proxy and Firewall clients to use DHCP to obtain autoconfiguration information via WPAD, we will discuss the following steps:

Installing the DHCP server

Creating the DHCP scope

Creating the DHCP 252 scope option

Configuring the client as a DHCP client

Configuring the client browser to use autodiscovery

Configuring the ISA 2004 firewall to publish autodiscovery information

Making the connection

Install the DHCP Server

The first step is to install the DHCP server. We went through the procedures for installing a DHCP server in Chapter 4.

Create the DHCP scope

A DHCP scope is a collection of IP addresses the DHCP server uses to assign to DHCP clients on the network. In addition, a DHCP scope can include additional TCP/IP settings to be assigned to clients, which are referred to as DHCP options. DHCP options can assign various TCP/IP settings such as a DNS server address, WINS server address, and primary domain name to DHCP clients.

Do the following on the DHCP server to enable the DHCP server and create the DHCP scope:

Click Start, and then select Administrative Tools. Click DHCP.

In the DHCP console, right click on your server name in the left pane of the console. Click on the Authorize command (see Figure 5.26).

Figure 5.26: Locating the Authorize Command

Click Refresh in the button bar of the console. You will notice that the icon to the left of the server name changes from a red, down-pointing arrow to a green, up-pointing arrow.

Right-click the server name in the left pane of the console again, and click the New Scope command.

Click Next on the Welcome to the New Scope Wizard page.

Enter a name for the scope on the Scope Name page. This name is descriptive only and does not affect the functionality of the scope. You can also enter a Description in the description box, if you wish. Click Next.

Enter a range of IP addresses that can be assigned to DHCP clients on the IP Address Range page. Enter the first address in the range into the Start IP address range text box and the last IP address in the range in the End IP address text box. Enter the subnet mask for your IP address range in the Subnet mask text box.

In the example in Figure 5.27, the Internal network is on network ID 10.0.2/24. We do not want to assign all the IP addresses on the network ID to the DHCP scope, just a selection of them. So in this example, we enter 10.0.2.100 as the Start IP address and 10.0.2.150 as the end IP address and use a 24-bit subnet mask. Note that on production networks, it is often better to assign the entire network ID to the IP address range used in the scope. You can then create exceptions for hosts on the network that have statically-assigned IP addresses that are contained in the scope. This allows you to centrally manage IP address assignment and configuration using DHCP. Click Next.

Figure 5.27: Configuring the DHCP Scope IP Address Range

Do not enter any exclusions in the Add Exclusions dialog box. Click Next.

Accept the default settings on the Lease Duration page (8 days, 0 hours and 0 minutes), and click Next.

On the Configure DHCP Options page, select Yes, I want to configure these options now, and click Next.

Do not enter anything on the Router (Default Gateway) page. Note that if we were using SecureNAT clients on the network, we would enter the IP address of the Internal interface for the ISA 2004 firewall on this page.

However, with the current scenario, we want to test only the Web Proxy and Firewall client configurations. Click Next.

On the Domain Name and DNS Servers page, enter the primary domain name you want to assign to DHCP clients, and the DNS server address you want the DHCP clients to use.

The primary domain name is a critical setting for your Firewall and Web Proxy clients. In order for autodiscovery to work correctly for Firewall and Web Proxy clients, these clients must be able to correctly fully qualify the unqualified name WPAD. We will discuss this issue in more detail later. In this example, enter msfirewall.org in the Parent domain text box (see Figure 5.28). This will assign the DHCP clients the primary domain name msfirewall.org, which will be appended to unqualified names. Enter the IP address of the DNS server in the IP address text box. In this example, the IP address of the DNS server is 10.0.2.2. Click Add after entering the IP address. Click Next.

Figure 5.28: Configuring the Default Domain Name for DHCP Clients

Do not enter a WINS server address on the WINS Servers page. In this example, we do not use a WINS server. However, WINS servers are very useful in VPN server environments if you wish your VPN clients to be able to browse the campus network using My Network Places or Network Neighborhood application. Click Next.

On the Activate Scope page, select Yes, I want to activate this scope now, and click Next.

Click Finish on the Completing the New Scope Wizard page.

In the right pane of the DHCP console, you see the two DHCP options you created in the Wizard, as seen in Figure 5.29.

Figure 5.29: Viewing the Scope Options

The next step is to create a custom DHCP option that will allow DHCP clients to autodiscover Web Proxy and Firewall client settings.

Create the DHCP 252 Scope Option and Add It to the Scope

The DHCP scope option number 252 is used to automatically configure Web Proxy and Firewall clients. The Web Proxy or Firewall client must be configured as a DHCP client, and the logged-on user must be a member of the local administrators group or Power users group (for Windows 2000). On Windows XP systems, the Network Configuration Operators group also has permission to issue DHCP queries (DHCPINFORM messages).

Do the following at the DHCP server to create the custom DHCP option:

Open the DHCP console from the Administrative Tools menu and right-click your server name in the left pane of the console. Click the Set Predefined Options command, shown in Figure 5.30.

Figure 5.30: Selecting the Set Predefined Options Command

In the Predefined Options and Values dialog box (Figure 5.31), click Add.

Figure 5.31: The Predefined Options and ValuesDialog Box

In the Option Type dialog box (Figure 5.32), enter the following information:

Name: wpad

Data type: String

Code: 252

Description: wpad entry

Click OK.

Figure 5.32: The Option Type Dialog Box

In the Value frame, enter the URL to the ISA 2004 firewall in the String text box. The format for this value is:

http://ISAServername:Autodiscovery Port Number/wpad.dat

The default autodiscovery port number is TCP 80. You can customize this value in the ISA Management console. If you do change the autodiscovery port number, then you will need to change the port number in the WPAD entry as well. We will cover this subject in more detail later.

As shown in Figure 5.33, enter the following into the String text box:

Figure 5.33: Predefined Options and Values Dialog Box

http://isa2.msfirewall.org:80/wpad.dat

Make sure to enter wpad.dat in all lower case letters. For more information on this problem, please refer to KB article 'Automatically Detect Settings' Does Not Work if You Configure DHCP Option 252 at http://support.microsoft.com/default.aspx?scid=kb;en-us;307502

Click OK.

Right click the Scope Options node in the left pane of the console, and click the Configure Options command.

In the Scope Options dialog box (Figure 5.34), scroll through the list of Available Options and put a checkmark in the 252 wpad check box. Click Apply and OK.

Figure 5.34: The Scope Options Dialog Box

The 252 wpad entry now appears in the right pane of the console under the list of Scope Options.

Close the DHCP console.

The next step is to configure the client computer as a DHCP client.

Configure the Client as a DHCP Client

In order to use DHCP to obtain autodiscovery information for Web Proxy and Firewall clients, the client computer must be configured as a DHCP client.

Do the following on the client machine to configure it as a DHCP client:

Right click My Network Places on the desktop, and click the Properties command.

Right click the Local Area Connection entry in the Network and Dial-up Connections window and click the Properties command.

In the Local Area Connection Properties dialog box, click the Internet Protocol (TCP/IP) entry and click Properties.

In the Internet Protocol (TCP/IP) Properties dialog box, select Obtain an IP address automatically and Obtain DNS server address automatically. Click OK.

Click OK in the Local Area Connection Properties dialog box.

Close the Network and Dial-up Connections window.

Now you're ready to configure the browser to use autodiscovery for automatically discovering its Web Proxy client settings.

Configure the Client Browser to Use DCHP for Autodiscovery

The browser must be configured to use autodiscovery before it can use the DHCP server option 252 to automatically configure itself. This is the default setting for Internet Explorer 6.0, but the default setting may have been changed at some time during the life of the browser on a particular machine. In the following example, we manually configure the browser to use autodiscovery to autoconfigure itself. We will discuss methods you can use to automatically set this option later.

Do the following on the Web Proxy client computer:

Right click on the Internet Explorer icon on the desktop and click Properties.

In the Internet Properties dialog box, click the Connections tab. Click the LAN Settings button.

In the Local Area Network (LAN) Settings dialog box, put a checkmark in the Automatically detect settings check box. Click OK.

Click OK in the Internet Properties dialog box.

ISA 2004 firewall must be configured to publish autodiscovery information before the Web Proxy client can obtain configuration information. That's the next step.

Configure the ISA 2004 Firewall to Publish Autodiscovery Information

All the settings required for the Web browser to configure itself are contained on the ISA 2004 firewall computer. By default, this option is disabled. You can enable publishing of autodiscovery information on the ISA 2004 firewall computer so that the Web Proxy client can obtain autoconfiguration settings.

Do the following on the ISA 2004 firewall computer to enable it to provide autoconfiguration information to Web Proxy and Firewall autodiscovery clients:

At the ISA 2004 firewall, open the Microsoft Internet Security and Acceleration Server 2004 management console. Expand the server name in the left pane of the console, and then expand the Configuration node. Click the Networks node.

On the Networks node, click the Networks tab in the Details pane.

Right-click the Internal network on the Networks tab, and click Properties (see Figure 5.35).

Figure 5.35: Accessing the Internal Network Properties Dialog Box

In the Internal Properties dialog box, put a checkmark in the Publish automatic discovery information check box. In the Use this port for automatic discovery request text box, leave the default port 80 as it is.

Click Apply and OK.

Click Apply to save the changes and update the firewall policy.

Click OK in the Apply New Configuration dialog box.

Making the Connection

All the components are now in place for the Web browser to automatically connect to the ISA 2004 firewall's Web Proxy service using autodiscovery.

Do the following on the Web Proxy client computer:

Open Internet Explorer and enter the URL for the Microsoft ISA Server site at www.microsoft.com/isaserver

A Network Monitor trace shows the DHCPINFORM messages sent by the Web Proxy client. The Web Proxy client uses the DHCPINFORM messages, such as the one shown in Figure 5.36 to obtain the autodiscovery address contained in the DHCP option 252 entry.

Figure 5.36: Viewing the DHCPINFORM Request

In Figure 5.37, you can see the ACK response to the Web Proxy client's DHCPINFORM message. In the bottom pane of the Network Monitor console, you can see that the DHCP server has returned the address you configured in the DHCP option 252 entry.

Figure 5.37: Viewing the contents of the DHCPINFORM request

After the Web Proxy client receives the address of the ISA 2004 firewall containing the autodiscovery settings, the next step is for it to resolve the name of the ISA 2004 firewall to its Internal IP address. Name resolution is critical for multiple aspects of ISA firewall 2004 function, and this is another example of this fact. You can see in the Network Monitor (Figure 5.38) that the Web Proxy client has issued a query for isa2.msfirewall.org, which was the URL contained in the DHCP 252 option.

Figure 5.38: Viewing the WPAD DNS Query

Configuring DNS Servers to Support Web Proxy and Firewall Client Autodiscovery

Another method you can use in deliver autodiscovery information to Web Proxy and Firewall clients is DNS. You can create a wpad alias entry in DNS and allow browser clients to use this information to automatically configure themselves. This is in contrast to the situation we saw with the DHCP method, where the logged-on user needed to be a member of a specific group in the Windows operating system.

Name resolution is a pivotal component in making this method of Web Proxy and Firewall client autodiscovery work . In this case, the client operating system must be able to correctly fully qualify the name wpad. The reason for this is that the Web Proxy and Firewall client only knows that it needs to resolve the name wpad; it does not know what specific domain name it should append to the query to resolve the name wpad. We will cover this issue in detail later.

We will detail the following steps to enable DNS to provide autodiscovery information to Web Proxy and Firewall clients:

Creating the wpad entry in DNS

Configuring the client to use the fully-qualified wpad alias

Configuring the client browser to use autodiscovery

Making the connection

Creating the wpad Entry in DNS

The first step is to create a wpad alias entry in DNS. This alias points to a Host (A) record for the ISA 2004 firewall, which resolves the name of the ISA 2004 firewall to the Internal IP address of the firewall. This Host (A) record must be created before you create the CNAME alias entry. If you enable automatic registration in DNS, the ISA 2004 firewall's entry will already be entered into DNS. If you have not enabled automatic registration, you will need to create the Host (A) record for the ISA 2004 firewall manually. In the following example, the ISA 2004 firewall has automatically registered itself with DNS.

Do the following on the DNS server of the domain controller on the Internal network:

Click Start and select Administrative Tools. Click the DNS entry. In the DNS management console shown in Figure 5.39, right-click on the forward lookup zone for your domain, and click the New Alias (CNAME) command.

Figure 5.39: Selecting the New Alias (CNAME) Command

In the New Resource Record dialog box (Figure 5.40), enter wpad in the Alias name (uses parent domain if left blank) text box. Click the Browse button.

Figure 5.40: The New Resource Record Dialog Box

In the Browse dialog box, double-click on your server name in the Records list.

In the Browse dialog box, double-click on the Forward Lookup Zone entry in the Records frame.

In the Browse dialog box, double-click on the name of your forward lookup zone in the Records frame.

In the Browse dialog box, select the name of the ISA 2004 firewall in the Records frame. Click OK.

Click OK in the New Resource Record dialog box.

The CNAME (alias) entry appears in the right pane of the DNS management console.

Close the DNS Management console.

Figure 5.41: New Resource Dialog Box

Figure 5.42: Viewing the DNS WPAD Alias

Configure the Client to Use the Fully-Qualified wpad Alias

Web Proxy and Firewall clients need to be able to correctly resolve the name wpad. The Web Proxy and Firewall client configurations are not aware of the domain containing the wpad alias. The Web Proxy and Firewall client operating system must be able to provide this information to the Web Proxy and Firewall client software.

DNS queries must be fully qualified before the query is sent to the DNS server. A fully-qualified request contains a host name and a domain name. The Web Proxy and Firewall clients only know the host name portion, which in this case is Wpad. Web Proxy and Firewall client operating system must be able to provide the correct domain name, which it appends to the wpad host name, before it can send a DNS query to the DNS server.

There are a number of methods you can use to provide a domain name that is appended to the wpad name before the query is sent to the client's DNS server. Two popular methods for doing this are:

Using DHCP to assign a primary domain name

Configuring a primary domain name in the client operating system's network identification dialog box.

We will detail these two methods in the following steps:

Right-click My Computer on the desktop, and click the Properties command.

In the System Properties dialog box, click the Network Identification tab. Click the Properties button.

In the Identification Changes dialog box (see Figure 5.43), click More.

Figure 5.43: The Identification Changes Dialog Box

In the DNS Suffix and NetBIOS Computer Name dialog box shown in Figure 5.44, enter the domain name that contains your wpad entry in the Primary DNS suffix of this computer text box. This is the domain name that the operating system will append to the wpad name before sending the DNS query to the DNS server. By default, the primary domain name is the same as the domain name to which the machine belongs. If the machine is not a member of a domain, this text box will be empty. Note Change primary DNS suffix when domain membership changes is enabled by default. In the current example, the machine is not a member of a domain. Cancel out of each of the dialog boxes so that you do not configure a primary domain name at this time.

Figure 5.44: The DNS Suffix and NetBIOS Computer Name Dialog Box

Another way to assign a machine a primary domain name is to use DHCP. A DHCP server can be configured to supply DHCP clients a primary domain name by configuring a DHCP scope option. We did this earlier when we created a scope on the DHCP server using the DHCP scope wizard. In the current example, the DNS Domain Name scope option was set to deliver the domain name msfirewall.org to DHCP clients. This option (shown in Figure 5.45) has the same effect as manually setting the primary domain name. DHCP clients will append this name to unqualified DNS queries (such as those for wpad) before sending the DNS query to a DNS server.

Figure 5.45: Viewing Scope Options

Go to the DHCP client system and open a command prompt. At the command prompt, enter ipconfig /all and press ENTER. Notice that the machine has been assigned a Connection-specific DNS Suffix of msfirewall.org.

DHCP is the most efficient way to assign a primary DNS suffix to clients on your network, as seen in Figure 5.46. This feature allows you to automatically configure a DNS suffix on DHCP clients that connect to your network, which are not members of your Active Directory domain. These clients can still correctly resolve the wpad name based on your current DNS infrastructure without requiring them to join the domain or manually configuring them.

Figure 5.46: DHCP client configuration

Note that if you have multiple domains and clients on your Internal network that belong to multiple domains, you will need to create wpad CNAME alias entries for each of the domains. In addition, DNS support for WPAD entries can be a bit problematic when you have a single Internal network domain that spans WAN links. You can only enter a single WPAD entry per domain, and all hosts that fully qualify the WPAD entry with that domain name will receive the same server address. This can lead to Branch office hosts attempting to access the Internet via an ISA 2004 located at the Main office. The best solution to this problem is to create subdomains in the DNS that support Branch office clients.

Configure the client browser to use autodiscovery

The next step is to configure the browser to use autodiscovery. If you have not already done so, configure the Web browser to use autodiscovery to automatically configure itself to use the ISA 2004 firewall's Web Proxy:

Right-click on the Internet Explorer icon on the desktop, and click Properties.

In the Internet Properties dialog box, click the Connections tab. Click the LAN Settings button.

In the Local Area Network (LAN) Settings dialog box, put a checkmark in the Automatically detect settings check box. Click OK.

Click Apply, and then click OK in the Internet Properties dialog box.

The next step is to configure the ISA 2004 firewall Publish Autodiscovery Information for autodiscovery Web Proxy and Firewall clients.

Special Considerations for VPN Clients

VPN clients can also be configured as Web Proxy clients of the network to which they connect via the VPN link. However, the Web Proxy client configuration is done on a per-connection basis. In order for the Web Proxy client to use the Web Proxy server on the destination network (the network the client is connected to via the VPN link), you must configure the VPN client to use the Web Proxy server for that specific VPN connection.

Perform the following steps to configure the VPN client to use a Web Proxy server on the remote network:

Right click on the Internet Explorer icon on the desktop and click Properties.

On the Connections tab, you'll see a list of your VPN connections in the Dial-up and Virtual Private Network Settings list. Select the VPN connectoid from the list and click Settings.

In the Settings dialog box for the VPN connectoid, select the appropriate Web Proxy settings. Depending on the Web Proxy support provided by the remote network, you can use the Automatically detect settings, Use automatic configuration script or Use a proxy server for this connection option.

Click OK, and then click OK again in the Internet Properties dialog box.

Allowing the VPN client to connect via the Web proxy allows the VPN client to be a Web Proxy client in addition to a SecureNAT client when connected to the ISA firewall/VPN server. This has the potential to significant enhance Web browsing performance and provides much better security than allowing split tunneling for the VPN client.

Configure the ISA 2004 Firewall to Publish Autodiscovery Information

Do the following on the ISA 2004 firewall to enable it to provide autoconfiguration information to Web Proxy and Firewall autodiscovery clients:

At the ISA 2004 firewall, open the Microsoft Internet Security and Acceleration Server 2004 management console. Expand the server name in the left pane of the console, and then expand the Configuration node. Click the Networks node.

On the Networks node, click the Networks tab in the Details pane.

Right click the Internal network on the Networks tab, and click Properties (see Figure 5.47).

Figure 5.47: Accessing the Internal Network Properties Dialog Box

In the Internal Properties dialog box, put a checkmark in the Publish automatic discovery information check box. In the Use this port for automatic discovery request text box, leave the default port 80, as it is.

Click Apply and OK.

Click Apply to save the changes and update the firewall policy.

Click OK in the Apply New Configuration dialog box.

Making the Connection Using DNS for Autodiscovery

All the parts are now in place to allow the Web Proxy and Firewall client machine to use DNS to obtain autoconfiguration information. Perform the following steps on the Web Proxy client computer:

Open Internet Explorer and go to the www.microsoft.com/isaserver/ home page.

A Network Monitor trace shows the Web Proxy client makes a DNS query for wpad.msfirewall.org. The DNS server responds to the query with the IP address (shown in Figure 5.48) of the ISA 2004 firewall computers.

Figure 5.48: Viewing DNS wpad Query Requests

After it obtains the IP address of the ISA 2004 firewall computer and the port from which it can obtain autoconfiguration information, the Web Proxy client sends a request (see Figure 5.49) for wpad autoconfiguration information. You can see this request in the bottom pane of the Network Monitor Window, GET /wpad.dat HTTP/1.1.

Figure 5.49: Viewing the Details of a DNS wpad Query Request