لطفا منتظر باشید ...
Performing a Clean Installation on a Multihomed Machine
The following steps demonstrate how to install the ISA Server 2004 software on a dual-homed (two Ethernet cards) Windows Server 2003 machine. This is a 'clean machine' that has only the Windows Server 2003 software installed and the IP addressing information configured on each of the machine's interfaces. The routing table has also been properly configured on this machine.
Perform the following steps to install the ISA firewall software on the multihomed machine:
Insert the ISA Server 2004 installation CD into the CD-ROM drive or connect to a network share point hosting the ISA Server 2004 installation files. If the installation routine does not start automatically, double-click the isaautorun.exe file in the root of the installation files folder tree.
On the Microsoft Internet Security and Acceleration Server 2004 page, click the link for Review Release Notes and read the release notes. The release notes contain very important and topical information regarding changes in basic firewall software functionality. This information may not be included in the Help file or elsewhere, so we highly recommend that you read this information. After reviewing the release notes, click the Read Setup and Feature Guide link. You may want to read the guide now, just review the major topics covered in the guide, or print it out. Click the Install ISA Server 2004 link.
Click Next on the Welcome to the Installation Wizard for Microsoft ISA Server 2004 page.
Select I accept the terms in the license agreement option on the License Agreement page. Click Next.
On the Customer Information page, enter your name and the name of your organization in the User Name and Organization text boxes. Enter your serial number in the Product Serial Number text box. If you installed an evaluation copy of the ISA firewall software and now are installing a licensed version, then backup your configuration using the ISA firewall's integrated backup tool and uninstall the evaluation version. Restart the installation of the licensed version of the software. Click Next.
On the Setup Type page (Figure 6.4), select Custom. If you do not want to install the ISA Server 2004 software on the C: drive, click Change to change the location of the program files on the hard disk. The Typical option does not install the Firewall client share or the SMTP Message Screener. The Complete option installs the ISA firewall software, Microsoft Internet Security and Acceleration Server 2004 management console, SMTP Message Screener, and the Firewall Client share. Click Next.
Figure 6.4: The Setup Type Page
On the Custom Setup page (Figure 6.5), choose which components to install. By default, when you select Custom, the Firewall Services, ISA Server Management, and Advanced Logging features are installed. The Advanced Logging feature is MSDE logging, which provides superior log search and filtering features. The Message Screener, which is used to control spam and e-mail with certain file attachments from entering and leaving the network, is not installed by default. You must install the IIS 6.0 or IIS 5.0 SMTP service on the ISA firewall computer before you install the Message Screener. If you try to install the SMTP Message Screener on the ISA firewall before installing the IIS SMTP service, an error message is generated, and you will need to restart the installation of the ISA firewall. Use the default settings, and click Next.
Figure 6.5: The Custom Setup Page
On the Internal Network page in Figure 6.6, click Add. The Internal Network is different from the internal network that was implied by the Local Address Table (LAT) was used by ISA Server 2000. In the case of ISA Server 2004, the Internal Network contains trusted network services with which the ISA firewall must communicate. Examples of such services include Active Directory domain controllers, DNS servers, DHCP servers, terminal servers, and management workstations. The firewall System Policy uses the Internal Network for a number of System Policy rules. We will look at the System Policy later in this chapter.
Figure 6.6: The Internal Network Address Page
Define the addresses included on the default Internal Network on the Internal Network setup page. You can manually enter the addresses to be included in the Internal Network by entering the first and last addresses in the Internal Network range in the From and To text boxes and then clicking the Add button. A better way to configure the default Internal Network is to use Select Network Adapter. This allows the ISA firewall setup routine to use the routing table to determine addresses used for the default Internal Network. This is one reason why it is important to make sure that you have correctly configured your routing table entries before installing ISA. Click Select Network Adapter. (See Figure 6.6.)
In the Configure Internal Network dialog box, remove the checkmark from the Add the following private ranges… checkbox. We prefer to uncheck this option because many organizations will use subnets of the private address network IDs throughout the organization on different ISA firewall-defined Networks. Leave the checkmark in the Add address ranges based on the Windows Routing Table checkbox, as shown in Figure 6.7. Put a checkmark in the box next to the Network Adapter representing the default Internal Network. In this example, we have renamed the network interfaces so that the interface name reflects its location. Click OK.
Figure 6.7: The Select Network Adapter Page
Click OK in the dialog box (Figure 6.8, Setup Message) informing you that The Internal network was defined, based on the Windows routing table.
Figure 6.8: Warning Dialog Box Reminding You that the Routing Table must be Properly Configured
Click OK on the Internal network address ranges dialog box, as shown in Figure 6.9.
Figure 6.9: Internal Network Address Ranges
Click Next on the Internal Network page.
Put a checkmark by Allow computers running earlier versions of Firewall Client software to connect (Figure 6.10) if you want to support Firewall clients running previous versions of the Winsock Proxy (Proxy Server 2.0) or the ISA Server 2000 Firewall client software. This will allow you to continue using the ISA Server 2000 Firewall client software as you migrate to ISA Server 2004. When you migrate your Firewall clients to the ISA 2004 version of the Firewall client, the channel between the Firewall clients and the ISA firewall will be encrypted. The ISA 2004 Firewall client software encrypts the user credentials that are transparently sent from the Firewall client machine to the ISA firewall. Click Next.
Figure 6.10: The Firewall Client Connection Settings Page
On the Services page, note that the SNMP and IIS Admin Service will be stopped during installation. If the Internet Connection Firewall (ICF) / Internet Connection Sharing (ICF), and/or IP Network Address Translation (RRAS NAT service) services are installed on the ISA firewall machine, they will be disabled, as they conflict with the ISA firewall software.
Click Install on the Ready to Install the Program page.
On the Installation Wizard Completed page, click Finish.
Click Yes on the Microsoft ISA Server dialog box informing that you must restart the server (see Figure 6.11). Note that you will not need to restart the machine if you have installed the ISA firewall software on this machine before. The reason for the restart is that the TCP/IP stack is changed so that the dynamic port range of the TCP/IP driver is extended to 65535. If the installation routine recognizes that this range has already been extended, then the restart will not be required.
Figure 6.11: Warning Dialog Box regarding a Potential System Restart
Log on as an Administrator after the machine restarts.
Click Start, and point to All Programs. Point to Microsoft ISA Server, and click ISA Server Management. The Microsoft Internet Security and Acceleration Server 2004 management console opens and displays the Welcome to Microsoft Internet Security and Acceleration Server 2004 page.
| Tip | You can install the ISA Management console on any Windows XP or Windows Server 2003 machine. System Policy will need to be configured so that the machine on which you install the Remote Management MMC is added to the Remote Management Computers Computer Set. |
Three setup logs are created on the ISA firewall machine. These are:
ISAWRAP_
* .log Provides information about installation success and failure and MSDE log files setup
ISAMSDE_
* .log Provides detailed information about MSDE setup, if the Advanced Logging feature was selected
ISAFWSV_
* .log Provides detailed information about the entire ISA firewall installation process
If you choose to not install certain components, such as the Firewall client share or Advanced Logging (MSDE logging), you can use the Control Panel's Add/Remove Programs applet to re-run the installation routine and install these additional components at a later time.
| Warning | If the Microsoft Internet Authentication Service (IAS) was running on the machine during installation, you will need to restart the IAS service after installation completes. In addition, co-located IAS/ISA firewall installations are not supported on Windows 2000. |
