لطفا منتظر باشید ...
Solutions Fast Track
Overview of Web Publishing and Server Publishing
Web Publishing Rules provide proxied access to published servers; this is more secure than reverse NAT'ing connections.
Web and Server Publishing Rules expose connections to deep application-layer inspection depending on which protocols are published.
The HTTP Security Filter exposes the HTTP and SSL connection to very deep inspection and allows you to control access based on virtually any aspect of the HTTP communications.
Web Publishing allows you to perform path redirection.
Web Publishing allows you to pre-authenticate users.
Web Publishing allows you to cache content on the published Web sites.
Web Publishing allows you to publish multiple Web sites with a single IP address bound to the external interface of the ISA firewall.
For both Web and Server Publishing Rules, you can replace the client source address with the ISA firewall's address, or you can preserve the client IP address.
Web publishing supports RADIUS authentication.
Both Web and Server publishing support port redirection. Web Publishing supports protocol redirection.
Server Publishing supports publishing all TCP and UDP protocols, including complex protocols.
You can apply schedules that limit when published sites are available for both Web and Server Publishing Rules.
Creating and Configuring Non-SSL Web Publishing Rules
You can create non-SSL Web Publishing Rules using the Web Publishing Rule Wizard.
Use Forward the original host header instead of the actual one (special above) when you want the ISA firewall to forward the host name that the client on the Internet sent to the ISA firewall.
Always use a specific public name for all Web Publishing Rules. Do not use the option to accept requests for Any domain name.
Use the path option to control what paths on the published Web server remote users can access when connecting via the Web Publishing Rule.
The authentication options configured on the Web listener determine what authentication protocols are supported when the ISA firewall pre-authenticates connections to the published Web site.
Use delegation of basic authentication when publishing Web sites to prevent users from being exposed to multiple log-on dialog boxes.
Configure Web listeners to listen on a specific IP address. Do not configure Web listeners to listen on all IP addresses unless you are using a dial-up connection to the Internet.
Avoid socket contention and compromising the security of the ISA firewall by not installing any IIS service on the ISA firewall except for the IIS SMTP service.
Enable Require all users to authenticate if all Web Publishing Rules using a particular Web listener will require pre-authentication by the ISA firewall.
Configure separate Web listeners for HTTP and SSL connections, even when the listeners listen on the same IP address.
Creating and Configuring SSL Web Publishing Rules
The ISA firewall supports both SSL bridging and SSL tunneling. SSL bridging is the more secure option.
SSL-to-SSL bridging is the most secure method of SSL bridging and is the preferred SSL publishing method.
The public name must be the same as the common name on the certificate bound to the Web listener.
The name on the To tab on the Web Publishing Rule must be the same as the name bound to the Web site certificate on the published Web site.
If there is a name mismatch, the user will see a 500 Internal Server Error.
The most common reason for the Web site certificate not appearing in the list of certificates available to bind to the Web listener is that the private key was not included with the certificate.
Creating Server Publishing Rules
Server Publishing Rules provide reverse NAT for published servers.
Server Publishing Rules are exposed to stateful application-layer inspection depending on the protocol published.
You can configure port redirection for any protocol used in a Server Publishing Rule.
You can control the source ports allowed for any protocol Server Publishing Rule.
You can configure Server Publishing Rules to retain the source IP address of the remote client or replace the source IP address with the IP address of the ISA firewall.
Creating Mail Server Publishing Rules
The ISA firewall's Mail Server Publishing Wizard allows you to publish common mail server protocols.
You can use the Mail Server Publishing Wizard to publish OWA, OMA and ActiveSync Web sites.
The Mail Server Publishing Wizard can create SMTP, NNTP, POP3(S), and IMAP4(S) Server Publishing Rules.
Additional configuration may be required on the published Web mail server to completely support the publishing configuration.
