لطفا منتظر باشید ...
Solutions Fast Track
Understanding the ISA 2004 SecureNAT Client
The SecureNAT client does not require software installation. The only requirement is that the client operating system be configured with a default gateway address that can route Internet bound communications through the ISA 2004 firewall.
The SecureNAT client supports all protocols not requiring secondary connections. Protocols requiring secondary connections (such as FTP) require an application filter on the ISA 2004 firewall.
The SecureNAT client only supports protocols that are included in the Protocol list on the ISA 2004 firewall. If there is no protocol definition for the protocol, then the SecureNAT client will not be able to access the protocol, even if there is an Access Rule allowing the SecureNAT client machine access to all protocols.
All operating systems can be configured as SecureNAT clients.
The SecureNAT client is not a client/server relationship. There is no software on the SecureNAT client that directly communicates with the ISA 2004 firewall.
The SecureNAT client does not send user or application information to the ISA 2004 firewall. The firewall records the source IP address of the connection and places only that information in the log files.
The SecureNAT client is the only client that can access non-TCP/UDP protocols, such as ICMP (which is used by ping and tracert) and PPTP (which requires GRE, which does not use TCP or UDP as a transport).
You cannot implement secure user/group-based authentication with non-TCP/UDP protocols because the SecureNAT client does not support sending user information to the ISA 2004 firewall.
The SecureNAT client is designed for non-Microsoft operating systems. All Microsoft operating systems that support the Firewall client should have the Firewall client installed. The exception to this is published servers and network infrastructure servers, such as domain controllers, DHCP servers, DNS servers, and IAS servers.
In general, all published servers should be configured as SecureNAT clients. The exception to this is when the Web or Server Publishing Rule is configured to replace the original client IP address with the ISA 2004 firewall's IP address
The SecureNAT client can take advantage of the ISA 2004 firewall's Web Proxy cache if the SecureNAT client accesses the Internet via a rule that has the Web Proxy filter enabled.
The SecureNAT client is highly dependent on the current routing infrastructure; all routers along the path between the SecureNAT client and the Internet must be aware that all Internet-bound requests must leave via the Internal IP address of the ISA 2004 firewall.
Understanding the ISA 2004 Web Proxy Client
All applications designed for Web Proxy support can be configured as Web Proxy clients.
The Web Proxy client configuration does not require software installation; the only requirement is that the application that supports Web Proxy connections is configured to use the ISA 2004 firewall as its Web Proxy server.
The Web Proxy client can send user credentials to the firewall; this enables strong user/group-based access control for Web Proxy clients.
The Web Proxy client only supports HTTP, HTTPS (SSL/TLS), and FTP-tunneled download connections.
You cannot perform FTP uploads via the Web Proxy client.
The Web Proxy client automatically takes advantage of the Web Proxy cache on the ISA 2004 firewall.
The Web Proxy client communicates directly with the ISA 2004 firewall, which makes it independent of the routing infrastructure. The only requirement is that the Web Proxy client machine knows the route to the Internal interface of the ISA 2004 firewall.
The Web Proxy client can be automatically configured to connect to the Internet via the ISA 2004 firewall by using WPAD and the Web Proxy client autodiscovery. This allows all Web browsers on the network to automatically know what IP address to use for their Web Proxy client configuration without requiring the administrator to configure each client individually.
The Web Proxy client may not be able to connect to some Web sites, such as those that use Java and embed private addresses in their communications or otherwise violate RFC Web Proxy behavior. You can configure Direct Access for sites that do not conform to RFC Web Proxy behavior.
The Web Proxy client can be configured to use an autoconfiguration script; the autoconfiguration script provides the Web Proxy client information regarding the name of the ISA 2004 firewall and sites that the Web Proxy client should bypass via the Direct Access mechanism.
Outbound Web Proxy client connections tunnel SSL through the firewall. Unlike Web Publishing scenarios where the published Web server is accessed via SSL-to-SSL bridging, the ISA 2004 firewall can not evaluate the content within an SSL tunnel made through the firewall.
Understanding the ISA 2004 Firewall Client
The Firewall client can send user and application information to the ISA 2004 firewall and have this information stored in the log files.
The Firewall client supports secondary connections without the aid of an application filter.
The Firewall client does not require a protocol definition to access a protocol. If you configure an Access Rule that allows access to all protocols, the Firewall client will be able to access all TCP and UDP protocols, even if there is no Protocol Definition for a particular protocol.
The Firewall client intercepts all TCP and UDP communications from Winsock applications and 'remotes' them (sends them directly) to the ISA 2004 firewall. This makes the Firewall client relatively independent of the current routing infrastructure. The only requirement is that the Firewall client machine know the route to the Internal interface of the ISA 2004 firewall.
The Firewall client can automatically find the ISA 2004 firewall through the use of WPAD entries in DHCP or DNS.
The Firewall client can be deployed via Active Directory Group Policy, via SMS, or via a silent installation script.
If you are not using SMS, the logged on user must be a member of the local administrators group to install the Firewall client software.
You can automatically configure the Web browser as a Web Proxy client at the same time the Firewall client software is installed.
The Firewall client requires software installation; the software is supported by all 32-bit Windows operating systems with the exception of Windows 95.
The Firewall client is compatible with all ISA 2004 client types. However, a single machine cannot act as both a SecureNAT and Firewall client for Winsock applications that communicate using UDP or TCP.
Automating ISA 2004 Client Provisioning
SecureNAT clients can be automatically configured using DHCP to assign the appropriate default gateway address.
The Web Proxy client can be automatically configured to use the ISA 2004 firewall via WPAD entries in DNS and/or DHCP.
The Web Proxy client can be automatically configured when the Firewall client is installed.
The Web Proxy client does not require software installation; only applications that support Web Proxy connections can be configured as Web Proxy clients of the ISA 2004 firewall.
Automating Firewall Client Installation
The Firewall client software can be installed using SMS, Active Directory Group Policy, or via a silent installation script.
The Firewall client can automatically find the ISA 2004 firewall via WPAD entries in DNS and/or DHCP.
The Firewall client can be manually configured to connect to a specific ISA 2004 firewall.
