Chapter 1: Evolution of a Firewall: From Proxy 1.0 to ISA 2004 - Dr. Tom Shinderamp;#039;s Configuring ISA Server 1002004 [Electronic resources] نسخه متنی

Chapter 1: Evolution of a Firewall: From Proxy 1.0 to ISA 2004

The Book: What it Covers and Who It's For

Our first ISA Server book, Configuring ISA Server 2000: Building Firewalls for Windows 2000 (Syngress Publishing), addressed Microsoft's first attempt at producing an enterprise-level network firewall product. As with most first attempts, ISA 2000 was in many ways a learning experience-both for Microsoft and for those of us who used and managed it.

With ISA 2000, Microsoft provided full-fledged, multilayered firewall functionality that went far beyond the traditional packet filtering firewall, with 'extras' such as intrusion detection and prevention (IDS/IDP) and Web caching - features that many other firewall vendors either don't include at all or offer as add-on modules or separate products at extra cost.

Inevitably, ISA was compared with other popular firewall products such as CheckPoint's Firewall-1/VPN-1 and Cisco's PIX, along with the plethora of low-cost security 'appliances' from vendors such as NetScreen, Watchguard, SonicWall, Symantec, and many others that have flooded the market over the last few years. Although it proved to be a strong competitor, ISA administrators quickly started compiling 'wish lists' of features and functionalities that could make ISA even better.

As with any software product, there were quirks to be ironed out. And as the security landscape became even more complex and brand new threats appeared, new technologies were needed and old ones needed to be improved. Microsoft set about creating a new incarnation of ISA Server, one that would incorporate many of the features users asked for and that would improve ease of use as well as security.

Some of the changes in ISA 2004 are profound - so profound that Microsoft seriously considered changing the product name completely before deciding to stick with 'Internet Security and Acceleration Server' to better build on the existing user base and avoid market confusion. As we worked with ISA 2004 from the alpha stage through private and public betas, we saw it evolve into a hard-core comprehensive security product that can serve many purposes in a variety of network scenarios.

It's in the Book: What We Cover

Writing the ISA 2000 book, like working with the software itself, was yet another learning experience. As we continued to work with ISA after it was finished, we discovered new questions (and new answers) that we wished we'd included. Readers provided us with valuable feedback about what they wanted to see addressed. We took all of that into consideration as we laid out the game plan for this book on ISA Server 2004.

Two Parts for Two Purposes

In working with ISA 2000 users locally and around the world through www.isaserver.org, www.windowsecurity.com, and other Internet forums, we found that many network administrators' questions about ISA began even before their organizations committed to deploying it. They wanted hard information on ISA's features, how those features work 'under the hood,' and how ISA compares to other popular firewall solutions in the same price categories. Some users, new to the security aspects of networking, expressed a wish for more background information - how firewalls and VPNs work, and even some basic TCP/IP concepts that are essential to understanding firewall functionality.

Thus, we've divided this book into two distinct sections:

Part One: ISA Server 2004 Concepts. This section (consisting of 3) is meant to be an 'appetizer.' It provides a background understanding of computer security in general, firewalls in particular, and ISA Server specifically. We follow the development of ISA from its humble origins in MS Proxy Server. We answer the often-asked question 'Why should I trust Microsoft when it comes to security?' We explain the different firewall models and architectures and describe the ISA 2004 feature set (including 'under the hood' information about how the features work). We even include an entire chapter on comparing ISA 2004 with other popular firewall solutions in the same price category.

Part Two: ISA Server 2004 How-Tos. This longer section (consisting of chapters 4 through 11) provides the 'main course'-step-by-step instructions in how to install and manage ISA Server 2004 in common networking scenarios, taking into account different network configurations, business models, and ISA Server roles. Here you'll find all the details about how to create and use firewall access policies, how to publish network services to the Internet, how to use ISA Server to protect remote access and VPN connections, how ISA Server works in conjunction with Exchange Server, how to make best use of ISA Server's Web caching, and other 'bonus' functionalities that distinguish ISA Server from its competitors.

You'll also find, at the end of the book, an appendix covering some TCP/IP and network security basics. This additional material is for those who need a refresher in TCP/IP security vulnerabilities. Some of this material is taken from Configuring ISA Server 2000 and is most useful for readers who are not familiar with that book. Like dessert, it's optional.

We believe this structure will make the book easier to use and will also make it more valuable to a wider audience.

If you're looking for specific scenarios that address your own situation or answers to troubleshooting problems that occur in your ISA deployment, we have tried to make it easy for you to find and flip to the section of this book that you need. We have put in numerous tips and tricks for dealing with ISA in the real world and provided references to give you more information about related topics that you could come across as you work with ISA. Following the adage that a picture can be worth a thousand words, we've also provided many diagrams and screenshots to illustrate exactly what we're talking about in the text.

Chapter-by-Chapter Game Card

We've laid out the book in such a way that it can be used as a reference, with individual 'how to' sections that are not dependent upon one another. We've also provided a logical order for those who are working through the book progressively, so that you can learn the terminology and concepts first and then proceed to the walk-throughs.

Chapter One: Evolution of a Firewall: Proxy Server to ISA 2004

This first chapter begins with a section entitled Security: The New Star of the Show, an overview of the new, high-profile role of security in the new millennium. In Security: What's Microsoft Got to Do with It? we discuss Microsoft's new commitment to security as a number one priority with their Trustworthy Computing Initiative. We address the ever-changing nature of the security landscape in Security: A Moving Target. Then we look at the best practices for securing your valuables, whether physical or electronic, in Security: A Multilayered Approach, where we examine the popular 'defense-in-depth' concept.

In the Firewalls: The Guardians at the Gateway. We examine the history and philosophy behind today's firewalls and discuss the differences between different firewall models (host vs. network-based, hardware vs. software-based). Next, we look at the features and functionality offered by modern firewall products and how firewalls have evolved from simple packet filtering proxies to comprehensive 'security solutions.'

The last part of the chapter, ISA Server: From Proxy Server to Full-Featured Firewall, zooms in on the focus of the rest of the book: ISA Server. We follow Microsoft's venture into the security market from the time when ISA Server was just a glint in MS Proxy Server's eye to the release of ISA Server 2004. We discuss what it can do for you and your company, how it gives you two products for the price of one, and how caching fits in. We also speculate on what the future holds for ISA Server and Microsoft's increasing integration of security features into their software.

Chapter Two: Examining the ISA Server 2004 Feature Set

This chapter provides an in-depth look at each of ISA 2004's main features: the old (those that were ported over from ISA 2000), the new (and improved), and the missing in action (features included in ISA 2000 that were dropped in the new version).

In the first section, Old Features Get New Functionality, we focus closely on ISA 2000 features that have been enhanced or expanded, such as VPN administration, user authentication, firewall rules, user- and group-based access policies, Outlook Web Access (OWA) publishing and secure Web publishing, FTP support, caching rules, the SMTP message screener, improvements to logging and reporting, and the updated graphical interface.

We also examine, in detail, the many new features built into ISA 2004, including its multinetworking capabilities, VPN quarantine and other new VPN features, firewall user groups, customizable protocol definitions and support for complex protocols, delegation of basic authentication, SecurID authentication support for Web proxy clients, firewall-generated forms for forms-base authentication, PPTP server publishing, SSL VPN for accessing terminal services, forced encryption for secure Exchange RPC connections, new HTTP filtering features, link translation, and new management features.

In the next section, we go Under the Hood to discuss how some of ISA 2004's most important features work, covering the underlying technologies of Application Layer Filtering (ALF), VPN quarantine, and SSL Bridging.

Finally, for those who still aren't satisfied with everything that ISA 2004 can do out of the box, we discuss Adding Features and Functionality with Third Party Products.

Chapter Three: Stalking the Competition: How ISA 2004 Stacks Up

In response to many reader inquiries, we devote an entire chapter to a discussion of the 2004 firewall market and how ISA Server 2004 stacks up against the competition. In this chapter, we discuss the current firewall and caching server market(s) and look at the various points of comparison, including:

Licensing structures, initial costs, and Total Cost of Operations (administrative overhead, support contracts, add-ons, and upgrades).

Specifications

Firewall and IDS/IDP features

VPN features

Web caching features

Certification

We look at how various firewall products implement application-layer filtering, platform support and system requirements, VPN features, capacity and client licensing issues, interoperability and integration with other network components, such as Exchange, SharePoint, Active Directory, and non-Microsoft operating systems and the interface and ease of use.

Specifically, we look at how ISA Server 2004 stacks up against the following popular firewall and/or caching products:

CheckPoint NG software and Nokia appliances (which run CheckPoint)

Cisco PIX firewall/VPN appliances

NetScreen/Juniper Networks firewall/VPN appliances

SonicWall firewall/VPN appliances

Symantec firewall/VPN software and appliances

Watchguard firewall/VPN appliances

Linux-based open source firewall software

BlueCoat firewall/VPN/caching appliances

Novell Volera caching products

Squid open source caching software

We look at the strengths and weaknesses of each competing product in comparison to ISA Server 2004, and we also discuss how ISA 2004 can be effectively used in conjunction with third-party firewall products to provide multilayered security for both inner and outer network perimeters.

Chapter Four: Preparing the Network Infrastructure for ISA 2004

One of the most common problems we've encountered in troubleshooting ISA Server 2000 installations was the lack of an appropriate supporting infrastructure. We anticipate similar problems for ISA Server 2004 installations that do not have the appropriate supporting network infrastructures before installing the ISA Server 2004 firewall.

There are a number of key network infrastructure issues that we discuss in this chapter:

Understanding the ISA Server 2004 networking model

Configuring the routing table on the ISA Server 2004 firewall

DHCP support for the ISA Server 2004 firewall and ISA Server 2004 clients

WINS support for the ISA Server 2004 firewall and ISA Server 2004 clients

DNS support for the ISA Server 2004 firewall and the ISA Server 2004 clients

RADIUS (Internet Authentication Server IAS) support for the ISA Server 2004 firewall and ISA Server 2004 clients

Certificate Services support for the ISA Server 2004 firewall and ISA Server 2004 clients

In Chapter Four, we go over each of the critical network services that must be in place to support your ISA Server 2004 firewall and hosts that connect through the ISA Server 2004 firewall. In addition, we discuss the ISA Server 2004 concepts of Networks, Network Sets, Network Relationships, and access control across networks. We also include a discussion of the 'network within a network configuration' and how to solve the problem it poses using ISA Server 2004 and the internal network router configuration.

Chapter Five: Configuring ISA 2004 Clients and Automating Client Provisioning

This chapter looks at the three ISA 2004 network client types:

The SecureNAT client

The Firewall client

The Web proxy client

Each of these client types works differently to allow the client computer access to the Internet or other outside network through the ISA server. We give detailed explanations of how each client type works 'under the hood.' Each has advantages and disadvantages, and the 'best' client choice depends on a number of factors, including the client operating system, which protocols the client machine needs to access, and whether you want to (or policy or circumstances permit you to) install extra software on the client machines. We provide you with the info you need to make the right decisions concerning which client type(s) should be deployed in a given situation.

After gaining an understanding of the client options, we provide step-by-step instructions that illustrate how to configure each client type, with special considerations to keep in mind for each. We deal with common problems posed by different client types, such as name resolution issues and how to solve the problem of 'loopback' through the ISA server by deploying a split DNS infrastructure.

Because manually installing or configuring a large number of clients in an enterprise environment can be a daunting task, we also provide instructions on how to automate the client provisioning process to reduce administrative overhead. In this section, we cover various ways to automate the configurations of the Web proxy and firewall clients, including:

Configuring DHCP servers to support Web proxy and firewall client autodiscovery

Configuring DNS servers to support Web proxy and firewall client autodiscovery

Automating Web proxy client configuration with group policy

Automating Web proxy client configuration with Internet Explorer Administration Kit (IEAK)

You'll learn how to automate the installation process for the firewall client software, either by using group policy-based software installation and management or by creating and using a silent installation script. We also discuss the use of System Management Server (SMS) to deploy the firewall client software.

Chapter Six: Installing and Configuring the ISA Server 2004 Software

This chapter begins with separate step-by-step instructions on how to install ISA Server in each of two possible configurations:

Installing ISA 2004 on a multihomed server. If the ISA Server is to act as a firewall, either dedicated solely to firewall functions or as a combination firewall and caching server, it must be installed on a machine that has multiple network interfaces.

Installing ISA 2004 on a single-NIC server. Unlike ISA 2000, ISA 2004 no longer has a caching-only installation mode, but by installing the software on a server that has only a single network interface, you accomplish the same thing since the single-adapter server cannot be used as a firewall.

ISA Server 2004 can run on either a Windows 2000 Server or a Windows Server 2003 machine. We discuss some of the differences in functionality based on which operating system you use and point out some of the things you need to watch for during installation, to avoid problems later.

The old Local Address Table (LAT) from ISA Server 2000 is gone, so you can install multiple network interfaces to create multiple internal networks (taking advantage of one of ISA 2004's great new features: multinetworking), in addition to multiple public or private address DMZs. We discuss how to do that in this chapter.

ISA Server 2004 includes a number of network templates that are positioned to help the new ISA Server 2004 firewall administrators get up and running as quickly as possible. We examine the front-end firewall, edge firewall, back-end firewall, trihomed DMZ, and unihomed firewall templates, and see how they can be used to assist the ISA Server 2004 firewall administrator get up and running with simple and complex networking setups. We also explore the new graphical user interface and how to navigate through it to perform the common administrative tasks.

We explore upgrade issues: specifically, we show you how to upgrade an ISA Server 2000 computer to ISA Server 2004, as well as the upgrade procedure for a Microsoft Proxy Server 2.0 machine, which requires first upgrading to ISA Server 2000 and then to ISA Server 2004.

Finally, The chapter includes a 'Quick Start' section that provides the basics on how to get ISA 2004 up and running as quickly as possible, and instructions on how to create a temporary 'all open' outbound access policy to allow you to verify that your ISA server is working after you install it.

Chapter Seven: Creating and Using ISA 2004 Firewall Access Rules

ISA Server 2004 Access Rules set the new ISA Server 2004 firewall apart from its predecessor, ISA Server 2000. Unlike ISA Server 2000, the ISA Server 2004 firewall uses a unified rule base wherein Access Rules and Publishing Rules are processed from the top down. You no longer need to try to figure out which rule will be active at what time as you did with ISA Server 2000. Now you know that the first rule on the list that matches the connection request parameters will handle the request.

ISA Server 2004 Access Rules control traffic based on a number of parameters, with the core parameters being the following: source, destination, protocol, and user. However, you can fine-tune each rule so that it is applied at a certain time of day, to a specific user set, and/or to a specific server. You can use Access Rules to block sites, files, pop-ups and peer-to-peer applications. ISA Server 2004 Access Rules give you total control over what connections are allowed (and not allowed) through the ISA firewall.

One of the major improvements in ISA Server 2004 is the ability to create virtually any rule element within the Access Rule wizard. The inability to create policy elements 'on the fly' with ISA Server 2000 was a major point of contention. It was a common occurrence that the ISA Server 2000 firewall administrator would begin to create a Protocol Rule and forget that the required Protocol Definition had not yet been created. ISA Server 2004 allows you to create each policy element from within the wizard.

In this chapter, we discuss how ISA Server 2004 Access Rules work and how to configure them to control access through the firewall. In addition, we discuss the procedures required to create your policy elements in advance, and we show you how to use the Access Rule toolset to simplify creation of Access Rules. Specific examples are provided, showing how to allow and deny Instant Messaging (IM) and Peer-to-Peer (P2P) applications, how to allow access to remote Exchange Servers, and much more.

Chapter Eight: Publishing Network Services to the Internet with ISA 2004

Publishing network services allows you to make servers and services on your corporate network accessible to users across the Internet and from other untrusted remote locations. Publishing services on the corporate network is fraught with danger because it exposes valuable network resources to the Internet. The challenge is to provide remote access to your network servers and services without compromising security. This is where the ISA Server 2004 firewall shines. As a sophisticated and stateful application-layer filtering firewall, the ISA Server 2004 firewall can make short work out of attackers who try to compromise your servers.

In this chapter, we discuss Web and Server Publishing rules. Web Publishing Rules allow you to securely publish Web sites and services to the Internet so that Internet users can access these servers. Web Publishing Rules provide the highest level of security available to published Web services because of their unique ability to perform SSL-to-SSL bridging and delegation of basic authentication. In addition, the HTTP Security filter allows you to control virtually any aspect of the HTTP communications moving through the firewall; the filter drops suspicious and dangerous connections before they ever reach the published Web site.

Server Publishing Rules can be used to publish virtually any service. You can use Server Publishing Rules to allow inbound access to HTTP (if you don't want to use a Web Publishing Rule, you can use a Server Publishing Rule), HTTPS, FTP, NNTP, SMTP, POP3, IMAP4. VNC, pcAnywhere, Terminal Services, and more. In addition, you can publish PPTP and L2TP/IPSec VPN servers behind an ISA Server 2004 firewall. You can publish virtually any TCP/UDP based protocol.

In this chapter, we go over the concepts and the step-by-step procedures required to publish virtually any network service using Web and Server Publishing Rules. We provide specific instructions showing you how to publish all the popular Internet protocols, as well as how to publish some more obscure services using customized configurations and using the firewall client on the published server.

Chapter Nine: Creating Remote Access and Site-to-Site VPNs with ISA Firewalls

Probably the most exciting and powerful new feature included with the ISA Server 2004 firewall is its significantly improved VPN server and gateway functionality. ISA Server 2000 could be configured to allow the ISA Server 2000 firewall to be a VPN server and VPN gateway, but the ISA Server 2000 firewall did not expose the VPN connections to firewall policy. In contrast, with ISA Server 2004, VPN remote access and gateway-to-gateway connections are all exposed to firewall policy in the same way as any other connection made through the ISA Server 2004 firewall.

The ISA Server 2004 firewall's VPN features allow you to control what resources VPN clients can connect to on a user/group basis. For example, if you want a group of users to only be able to connect to the Exchange Server using the secure Exchange RPC protocol via the Outlook 2002 client when connected over a VPN, you can create a firewall policy that limits this group to the Exchange Server only, and only when using the protocols required to connect using the full Outlook MAPI client.

The ISA Server 2004 firewall can now create gateway-to-gateway VPN connections using IPSec tunnel mode. This allows you to connect the ISA Server 2004 firewall to other VPN gateways made by third-party vendors using IPSec tunnel mode. Now you can bring the ISA Server 2004 firewall into a branch office and easily connect it to the non-Microsoft VPN server or concentrator at the main office. However, if you choose to use ISA Server 2004 firewalls as VPN gateways at both the main and branch offices, you can benefit from the higher security derived from using L2TP/IPSec as your site-to-site VPN protocol.

In this chapter, we cover the concepts and step-by-step procedures required to make the ISA Server 2004 firewall both a VPN Remote Access Server (RAS) and a VPN gateway (used for site-to-site VPN connections). This includes connecting to third-party VPN gateways and also addresses the special cases of publishing PPTP and L2TP/IPSec VPN servers behind the ISA Server 2004 firewall. Another issue that is addressed is providing outbound access for VPN clients that use PPTP, L2TP/IPSec NAT-T and third-party IPSec NAT-T solutions.

Chapter Ten: Stateful Inspection and Application Layer Filtering

One of the most compelling features of ISA 2004 is its "deep" application layer filtering (ALF) capabilities. With ALF, you can protect against application layer attacks, prevent users from visiting dangerous or offensive Web sites, and even provide first-line defense against spam at the firewall level. With ALF, you can perform protocol-specific tasks and control access to and from your network based on application (FTP, H.323, SOCKS4, etc.).

In this chapter, we discuss the benefits of ALF and how it fits into your network security plan, and provide step-by-step instructions in how to configure the application filters and Web filters that come with ISA 2004, as well as how to use add-in filters to further expand ISA 2004's application layer filtering functionality. Here you will learn how to use the DNS filter, the POP intrusion detection filter, the RPC, PPTP and SMTP filters, the Web Proxy filter, and many more. We'll also discuss filters that enable OWA forms-based authentication, SecurID authentication, and RADIUS authentication, and you'll learn all about link translation and enforcing configurable HTTP policy with the appropriate filters.

Chapter Eleven: Accelerating Web Performance with ISA 2004 Caching Capabilities

One of ISA Server 2004's biggest competitive advantages is that it is not only a firewall and VPN server and gateway; it is also a Web-caching server. The Web-caching component allows you to speed up Web access for your corporate network users and potentially reduce overall bandwidth usage on all your Internet links.

In this chapter, we go over the concepts and step-by-step procedures required to configure the ISA Server 2004 firewall as a Web-caching server. You'll learn about the settings required to optimize Web-caching performance and how to configure Web proxy chaining to improve Web performance for your branch office users and reduce overall bandwidth usage on branch office links to the Main office.

Chapter Twelve: Using ISA 2004: Monitoring, Reports and Logging

The Monitoring node in the ISA Server 2004 management console is a huge improvement over the same feature in ISA Server 2000, providing a handy "Dashboard" view that lets you see the "big picture" of what's happening in various monitoring areas, along with performance information.

An intuitive tabbed interface makes it easy to quickly delve into more details about specific monitoring areas, and we will provide step-by-step instructions on how to configure alerts, how to use session and services information, how to configure logging and generate reports, and how to use the connectivity verification feature.

Appendix: Network Security Basics

In order to understand what a firewall does and how various firewall features work, it is essential that you have an understanding of the TCP/IP protocol stack and how common intrusions and attacks exploit characteristics of the protocols at different layers of the Open Systems Interconnect (OSI) and Department of Defense (DOD) networking models to do their dirty work.

Readers who do not have previous networking experience or who need a quick review of basic TCP/IP concepts and exploits should check out Appendix A before proceeding through the rest of the book.

This Book's For You: Our Target Audience

This book is for anyone who wants to know what ISA Server 2004 is all about, how it differs from ISA 2000 and from third party firewall and caching products, and how to get the most out of it to protect your network and improve Web content performance for your internal and external users.

This book is not designed as an exam prep or study guide. Although it contains useful conceptual information and step-by-step exercises that will provide readers with a better understanding of ISA Server 2004, and can serve as a background supplement to training kits and courses designed to prepare candidates for the MCSA/MCSE exam, the purpose of this book is to address real-world installation, configuration, management, and troubleshooting issues encountered on the job. Its structure and content are not based on exam objectives, and exam candidates should not consider it a primary source of preparation.

At the time of the writing of this book, Microsoft Certification Exam 70-350, Installing, Configuring and Administering Microsoft Internet Security and Acceleration (ISA) Server 2004, has not been written and objectives are not yet available. Check the Microsoft Learning Web site at www.microsoft.com/learning/mcpexams/default.asp for information about the exam.

For those who want to get a head start on studying for the ISA Server 2004 exam, a good starting place is the exam preparation guide for Exam 70-227, Installing, Configuring and Administering Microsoft Internet Security and Acceleration (ISA) Server 2000, Enterprise Edition. At the time of this writing, Exam 70-227 not only counts as an elective for the Microsoft Certified Systems Administrator (MCSA) and Microsoft Certified Systems Engineer (MCSE) certification paths, but is also a core security exam for the MCSA and MCSE security specialty certification paths. It is expected that Exam 70-350 will similarly count toward the security specialist certifications.

As with all current Microsoft certification exams, the most important preparation will be hands-on work with the product in a variety of networking situations. Deploying ISA Server 2004, either on a home network, on a business network, or in a virtual network environment, and working with it on a daily basis is the best way to gain the intimate familiarity with the interface, concepts, and administrative tasks that are necessary to understand to successfully answer the exam questions.

This book is based in large part on our own trials and tribulations (as well as the occasional 'Eureka!' moment) that we've experienced working with ISA Server 2004. In this book, we are talking to people much like ourselves - experienced Windows network administrators who want to secure their networks and speed up Web access for their users without having to make a full-time vocation of it, learn programming, recompile kernels, or struggle with a brand new command syntax. We're talking to people who want a security solution that is built to interoperate with their Windows domain controllers and Microsoft servers such as Exchange and SharePoint. We're talking to experienced ISA 2000 administrators, those who are brand new to the world of firewalls, and those who are migrating from third-party firewall products.

A book is, by its very nature, a one-way conversation that flows from author to reader. However, we have built each of our books on questions and comments from our readers, and we don't consider the subject closed when the book is finally printed and on the shelves. Rather, that's just the beginning of a dialog, and the input we get from you will help us in writing the next book, article or courseware project. You can reach us through the www.syngress.com Web site and you can find a wealth of additional and updated information about ISA Server 2004 at www.isaserver.org and on our Web site at www.msfirewall.org.