لطفا منتظر باشید ...
Configuring ISA Server 2004 as a Caching Server
Although caching is not enabled by default, it is easy to configure ISA Server 2004 to perform forward and/or reverse caching. In this section, we will show you the step-by-step procedures for the following:
Enabling caching
Configuring the cache size and memory allocation for caching
Creating cache rules
Configuring content download jobs
Enabling and Configuring Caching
In this section, we'll look at how to enable, disable, and configure general properties of caching. The first step in using ISA Server 2004 as a caching server is to enable caching.
How to Enable Caching in Standard Edition
From the Configuration | Cache node of the ISA management console:
In the left pane of the ISA Server 2004 MMC, expand the server name, and then expand the Configuration node.
Right-click the Cache node in the left pane and select Define Cache Drives, or click the Cache Rules tab in the middle pane, and select Define Cache Drives (enable caching) from the right Tasks pane.
In the Define Cache Drives dialog box, select an NTFS drive and type the desired number into the Maximum cache size field, then click the Set button, as shown in Figure 11.4.
Figure 11.4: Setting Maximum Cache Size
Click Apply and then OK.
How to Disable Caching in Standard Edition
In ISA Server 2004 Standard Edition, you can disable caching by performing the following steps:
In the left pane of the ISA Server 2004 MMC, expand the server name, and then expand the Configuration node.
Right click the Cache node in the left pane and select Disable Caching, or click the Cache Rules tab in the middle pane and select Disable Caching in the right Tasks pane.
| Note | Another way to set the drives to zero is by using the Reset button on the Define Cache Drives dialog box. |
| Note | As long as at least one cache drive has a size greater than zero, caching is enabled. |
How to Configure Caching Properties
In this section, we look at how to configure general caching properties, including the following:
Configuring which content to cache
Configuring the maximum size of objects in the cache
Configuring negative caching
Configuring whether expired objects should be returned from cache
Allocating a percentage of memory to caching
Let's address each of these, one at a time.
Configuring Which Content to Cache
To configure which content should be cached, follow these steps:
In the left pane of the ISA Server 2004 MMC, expand the server name.
Click the Cache Rules tab in the middle pane.
Click the Tasks tab in the right pane.
Click Configure Cache Settings in the Related Tasks section.
Click the Advanced tab in the Cache Settings dialog box.
Here you can select whether to cache objects that have an unspecified last modification time and objects that do not have an HTTP status code of 200 by checking or unchecking the appropriate checkbox, as shown in Figure 11.5. Both boxes are checked (thus, caching of these objects is enabled) by default.
Figure 11.5: Configuring Which Content to Cache
| Note | HTTP status code 200 means 'OK,' or that the request sent by the client was successfully fulfilled. Caching objects that do not have a status code of 200 is referred to as 'negative caching.' |
Configuring the Maximum Size of Objects in the Cache
This setting is made in the same Cache Settings dialog box as the previous setting.
In the left pane of the ISA Server 2004 MMC, expand the server name.
Click the Cache Rules tab in the middle pane.
Click the Tasks tab in the right pane.
Click Configure Cache Settings in the Related Tasks section.
Click the Advanced tab in the Cache Settings dialog box.
In the field labeled Maximum size of URL cached in memory (bytes), enter the desired number of bytes. This will limit the size of objects that can be cached and save space on your cache drive.
Configuring Whether Expired Objects Should be Returned from Cache
This setting, too, is made in the Cache Settings dialog box.
In the left pane of the ISA Server 2004 MMC, expand the server name.
Click the Cache Rules tab in the middle pane.
Click the Tasks tab in the right pane.
Click Configure Cache Settings in the Related Tasks section.
Click the Advanced tab in the Cache Settings dialog box.
If you prefer that an expired object not be returned if the Web site cannot be reached, select Do not return the expired object. An error page will be returned.
Alternatively, you can select to return the expired object if the expiration was less than a specified percentage of the original TTL, but no more than a specified number of minutes since the object expired. If you select this option, enter the desired numbers in the appropriate fields.
By default, ISA Server 2004 is configured to return the expired object only if the expiration was less than 50 percent of the original TTL and no more than 60 minutes.
Allocating a Percentage of Memory to Caching
This setting is also configured in the Cache Settings dialog box.
In the left pane of the ISA Server 2004 MMC, expand the server name.
Click the Cache Rules tab in the middle pane.
Click the Tasks tab in the right pane.
Click Configure Cache Settings in the Related Tasks section.
Click the Advanced tab in the Cache Settings dialog box.
In the field labeled Percentage of free memory to use for caching, enter the desired percentage.
The default amount of memory allocated for caching is 10 percent. When the percentage set here is exceeded, additional objects are cached only to disk (not to RAM).
Creating Cache Rules
In this section, we look at how to create and configure cache rules for various situations, how to modify an existing cache rule, and how to disable or delete a cache rule you have created, as well as how to change the order of rules. We also discuss how to copy, export, and import cache rules.
How to Create a Cache Rule
Creating a cache rule is made easy by the wizard that is built into ISA Server 2004. Just follow these steps:
In the left pane of the ISA Server 2004 MMC, expand the server name.
Click the Cache Rules tab in the middle pane.
Click the Tasks tab in the right pane.
In the Cache Rule Tasks section, click Create a Cache Rule. This will invoke the New Cache Rule Wizard, as shown in Figure 11.6.
Figure 11.6: Creating a New Cache Rule with the Wizard
Type in a name for your new cache rule, and then click Next.
On the next page, you'll be asked to select destination network entities. The rule will be applied to requests that are sent to these destinations. Click the Add button and select from the entities listed in the Add Network Entities dialog box, as shown in Figure 11.7.
Figure 11.7: Selecting Destinations to which the Cache Rule will Apply
Expand the top-level entities to see the specific entities beneath them. Highlight the entity you want to add, and then click Add. You can add multiple entities.
When you're finished adding entities, click Close.
Back on the Cache Rule Destination page of the wizard, click Next.
On the Content Retrieval page, you can control how cached objects will be retrieved when they are requested. Select from one of three choices for retrieving the object from cache:
Only if a valid version of the object exists in the cache (if no valid object exists, the request will be routed to the Web server where the original object is stored)
If any version of the object exists in the cache (if an invalid version exists in cache, it will be returned from cache. If no version exists in cache, the request will be routed to the Web server)
If any version of the object exists in cache (if no version exists in cache, the request will be dropped and the request will not be routed to the Web server)
Make your selection and click Next.
On the Cache Content page, you can control whether particular types of content that are retrieved are to be cached. By default, an object is not stored in cache unless the source and destination headers instruct that it be cached. However, you can change that behavior here by making one of two selections: Never, (no objects will ever be cached); If source and request headers indicate to cache (the default setting). If you select to cache objects, you can also control which of the following should be cached:
dynamic content
content for offline browsing
content requiring user authentication for retrieval.
By default, none of these is cached. You can select any number of these choices, as shown in Figure 11.8.
Figure 11.8: Configuring When to Store Content in Cache
After you have made your selections, click Next.
On the Cache Advanced Configuration page, you can set a limit on the size of objects to be cached by checking the Do not cache objects larger than: checkbox and setting a size in kilobytes, megabytes or gigabytes, as shown in Figure 11.9.
Figure 11.9: Limiting the Size of Objects to be Cached and Caching SSL Responses
| Note | By default, there is no limit set on the size of objects to be cached. |
On this page, you can also select whether to cache SSL responses. By default, SSL responses are cached, but you might want to disable this for security purposes since SSL content may be sensitive, and you might not want copies of it sitting on the cache server.
After making your selections, click Next.
On the HTTP Caching page, you can enable or disable HTTP caching (it is enabled by default) and set the TTL of objects as a percentage of the content's age, based on when it was created or last modified. You can also set the TTL time boundaries, and select to apply the TTL boundaries to sources that specify expiration, as shown in Figure 11.10. By default, the TTL of objects is set at 20 percent of content age, and TTL time boundaries are set to no less than 15 minutes and no more than one day.
Figure 11.10: Enabling HTTP Caching and Setting TTL Configuration
| Note | The 'created' and 'last modified' dates are contained in the HTTP headers that are returned by the Web server. |
When you have made your selections, click Next.
On the FTP Caching page, you can enable or disable FTP caching (it is enabled by default). You can also set a TTL for FTP objects, as shown in Figure 11.11. The default TTL is one day.
Figure 11.11: Enabling FTP Caching and Setting the TTL Configuration
After making your selections, click Next.
The last page of the wizard summarizes all the choices you have made. If you need to make changes, you can click the Back button to return to the appropriate page and modify your selections. Otherwise, click Finish to create the rule.
How to Modify an Existing Cache Rule
If you want to make changes to a cache rule that you've already created, highlight it in the Cache Rules tab in the middle pane of the ISA Server 2004 MMC, and click Edit Selected Rule in the right Task pane, or right-click the rule you want to modify and select Properties. Either method will open the <Rule name> Properties box, as shown in Figure 11.12.
Figure 11.12: Modifying an Existing Cache Rule
On the General tab, you can change the name of the cache rule or insert an optional description to describe the rule.
On the To tab, you can change, add, edit, or remove destination network entities. On this page, you can also configure exceptions, as shown in Figure 11.13. In our example, the cache rule will apply to all content requested from external entities, except those from shinder.net.
Figure 11.13: Configuring Exceptions to the Destination Network Entities
On the Cache Store and Retrieval tab, you can change the selections you made in the wizard regarding when to retrieve content from cache and when to store content in cache.
On the HTTP tab, you can enable or disable HTTP caching and modify your TTL configurations. You can also restore the defaults with the click of a button.
On the FTP tab, you can enable or disable FTP caching, change the TTL settings, or restore the defaults.
On the Advanced tab, you can set or change the size limit for objects to be cached and change your settings for caching SSL responses.
How to Disable or Delete a Cache Rule
If you want to disable a cache rule that you've created (but want to keep it because you might want to enable it again sometime in the future), you can do so by following these steps:
Highlight the rule you want to disable in the middle pane of the ISA Server 2004 MMC and click Edit Selected Rule in the right task pane, or right-click the rule and select Properties.
On the General tab, uncheck the checkbox labeled Enable.
Click the Apply button, and then click OK.
The rule will still show up in the Cache Rules list, but with a red down arrow icon to indicate that it is disabled. You can re-enable it by simply checking the box.
If you want to do away with a rule completely (you will not want to use it again), you can delete it. Simply highlight the rule you want to delete in the middle pane, and click Delete Selected Rules in the right Tasks pane. You can highlight multiple rules and delete them all at once. Alternatively, you can right-click the rule(s) you want to delete and select Delete from the context menu. You will be asked if you are sure you want to delete the rule(s). Click Yes to do so.
How to Change the Order of Cache Rules
Remember that the cache rules are processed in order from first to last (top to bottom in the list on the Cache Rules tab in the middle pane), with the Default rule always processed last.
You can change the order of the rules by highlighting a higher rule in the middle pane and selecting Move Selected Rules Down in the right Tasks pane, or by right-clicking the rule you want to move and selecting Move Down from the context menu.
How to Copy a Cache Rule
You can also copy and paste the cache rules you've created. Why would you want to do that? Well, if you've created a rule and now you want to create another rule with only one or two properties that are different, rather than go through the whole wizard process, you can take the easy way out and just right-click the first rule, and select Copy from the context menu.
Next, right-click on the rule again (not in an empty area of the Cache Rules list as you might intuitively expect), and select Paste from the context menu. Now you can open the copy's Properties box, change its name and make whatever other changes you want to make to it.
| Tip | Note that copying and pasting are tasks that don't appear in the right Tasks pane. Unlike with most tasks, you will have to do these from the right context menu. |
How to Export and Import Cache Rules
You can export your cache rules to an XML file, which can then be used to import the data to another ISA Server 2004 computer or back to the current machine. Here's how to export your cache rules:
In the left pane of the ISA Server 2004 MMC, expand the server name.
Click the Cache Rules tab in the middle pane.
Click the Tasks tab in the right pane.
In the Related Tasks section, click Export Cache Rules. This invokes the Export wizard. Click Next on the first page of the wizard.
On the Export Preferences page, you can choose to export optional confidential information (which includes user passwords, RADIUS shared secrets, and other confidential information), along with the rules themselves. By default, confidential data is not exported. If you choose to export it by checking the checkbox, you will be asked to enter and confirm a password. This password will be used to encrypt the confidential data. Click Next.
On the Export File Location page, type in or browse to the path of the file to which you want to save the exported data. The file must be an XML file. If you have not already created a file, you can do so by typing in the desired path and filename (for example, c:\files\cacherules.xml).
| Tip | Although you can create a new file by typing in the path and file name on the Export File Location page, you must specify an existing path (that is, you cannot create a new folder in this way; if you try to do so, you will get an error message stating that the path does not exist). |
The last page of the wizard summarizes the selections you have made. If you want to change anything, use the Back button to return to the appropriate page and make your changes. If not, click Finish to export the data to the specified file. A dialog box will inform you when the configuration has been successfully exported, as shown in Figure 11.14.
Figure 11.14: Successfully exporting cache rules to an XML file
Now, to import cache rules that have been saved to XML files, simply follow these steps:
In the left pane of the ISA Server 2004 MMC, expand the server name.
Click the Cache Rules tab in the middle pane.
Click the Tasks tab in the right pane.
In the Related Tasks section, click Import Cache Rules. This invokes the Import wizard. Click Next on the first page of the wizard.
| Tip | If you have made changes to the configuration that have not yet been applied, you will see a warning message advising you that if an error occurs during the import process, these changes might be discarded. You are asked if you want to import anyway. You can click Yes to proceed, or No to stop the import process so that you can go back and apply your changes. To apply your changes, click the Apply button at the top of the middle pane. |
On the Select Imported File page, you will be asked to type in the path or browse for the XML file from which you want to import cache rules, as shown in Figure 11.15. Enter this information and click Next.
Figure 11.15: Selecting an Import File
On the Import Preferences page, you can select to import server-specific information (such as cache drives and SSL certificates) by checking a checkbox. By default, server specific information is not imported. You should import server-specific information if you are importing information back to the same machine from which it was exported. If you import server-specific information to a different machine, you may find that the firewall service will not start because the machine does not have the same certificates.
The last page of the wizard summarizes the information you have entered. If you want to change anything, use the Back button and return to the appropriate page to make the changes. If not, click Finish to complete the import process. A dialog box will inform you when the cache rules have been successfully imported.
The process just described exports or imports all of your cache rules. You can also export or import just selected rules. To do so, highlight the rule you want to export or import and right-click it, then select Export Selected or Import to Selected from the right context menu.
Configuring Content Downloads
Content download jobs are handy tools for administrators as they allow you to automate the process of updating cached content. In this section, we'll show you how to do the following:
Ensure a content download job can run
Create and configure a scheduled content download job
Make changes to an existing content download job
Disable or delete a content download job
Export or import content download job configurations
Run a content download job immediately
Let's look at each of these in the following subsections.
How to Ensure a Content Download Job Can Run
Several requirements must be met before a content download job will run. Specifically:
You must configure the Local Host network to listen for Web Proxy client requests.
You must enable the system policy rules to allow content download.
You must ensure that the Job Scheduler service is running.
There are two ways to meet these requirements. The first automates the process and is easiest. If you try to create a content download job before making the configuration changes, you will receive a message advising you that these changes must be made and asking if you want the settings configured, as shown in Figure 11.16.
Figure 11.16: Making Configuration Changes Automatically
Click Yes to make the changes automatically (You will still need to click Apply at the top of the middle pane for the changes to take effect).
The second way is to make the configuration changes manually. In the following subsections, we show you how to make each of the changes.
Configuring the Local Host Network
To configure the Local Host Network to listen for Web Proxy client requests, perform the following steps:
In the left pane of the ISA Server 2004 MMC, expand the server name, then expand the Configuration node.
Click the Networks node.
In the middle pane, click the Networks tab.
Double click Local Host in the list of Networks, or right-click it and select Properties. This will open the Local Host properties dialog box.
Click the Web Proxy tab.
Check the box labeled Enable Web Proxy clients (it is unchecked by default), as shown in Figure 11.17.
Figure 11.17: Enabling Web Proxy Clients
By default, when you enable Web Proxy clients, HTTP will be enabled, and SSL will not. You can enable SSL, if desired, by checking its box, and you can set different HTTP and SSL ports from the defaults (8080 and 8443), if needed.
If you enable SSL, you will need to select a server certificate by clicking the Server Certificates button, highlighting the server name and clicking Select to select from among the certificates installed on the server.
You can also configure authentication methods from among the following:
Digest
Integrated (the default)
Basic
SSL certificate
RADIUS
To do so, click the Authentication button and check the box(es) of the authentication method(s) you want to use. You can also check a box here to require all users to authenticate.
You can select a default domain for authentication, select RADIUS servers, and configure OWA forms-based authentication.
| Note | For more detailed information about configuring ISA Server to listen for Web Proxy clients and to configure authentication for Web Proxy clients, see Chapter 4, Preparing the Network Infrastructure for ISA 2004. |
Enabling the System Policy Rules
To enable the system policy rule to allow content download, perform the following steps after you have configured the Local Host Network to listen for Web Proxy clients:
In the left pane of the ISA Server 2004 MMC, expand the server name.
Click the Firewall Policy node.
In the right Tasks pane, click Show System Policy Rules.
In the middle pane, scroll down to the rule Allow HTTP from ISA Server computers for Content Download Jobs. You will see a red down arrow on the icon that indicates that the rule is disabled.
To enable the rule, do the following: in the right Tasks pane, in the System Policy Tasks section, click Edit System Policy, or right-click the rule and select Edit System Policy from the context menu.
Under Configuration Groups, scroll down to the folder labeled Various and select Scheduled Download.
On the General tab, check the box labeled Enable, as shown in Figure 11.18.
Figure 11.18: Enabling the System Policy Configuration Group
Click OK.
Click Apply at the top of the middle pane.
Running the Job Scheduler Service
To stop or start the Microsoft ISA Server Job Scheduler service from within the ISA 2004 MMC, perform the following steps:
In the left pane of the ISA Server 2004 MMC, expand the server name.
Click the Monitoring node.
In the middle pane, under the Services tab, if the Job Scheduler status is shown as Stopped, right-click it and select Start from the context menu, or highlight it and click Start Selected Service in the right Tasks pane under Services Tasks, as shown in Figure 11.19.
Figure 11.19: Starting or Stopping the Job Scheduler Service from the ISA Console
You can also start and stop the service from the Services node in the Windows 2000/Server 2003 Computer Management Console as you do with other Windows services. Click the Start menu and right-click My Computer (or right-click My Computer on the desktop) and click Manage, then expand the Services and Applications node in the left pane and click Services, as shown in Figure 11.20.
Figure 11.20: Starting or Stopping the Job Scheduler Service from the Computer Management Console
How to Create and Configure Scheduled Content Download Jobs
To create a scheduled content download job, perform the following steps:
In the left pane of the ISA Server 2004 MMC, expand the server name, then expand the Configuration node.
Click the Cache node.
In the middle pane, click the Content Download Jobs tab.
In the right Tasks pane, in the Content Download Tasks section, click Schedule a Content Download Job. This invokes the New Content Download Job Wizard.
On the first page of the wizard, give the content download job a name, and then click Next.
On the Download Frequency page, select how often to run the job. You can select from among the following choices: One time only, on completion of the wizard; one time only, scheduled; daily; weekly. Make your selection and click Next.
On the Content Download page, enter the URL of the page on the Internet server from which you want to download content. You can also set job limits, as shown in Figure 11.21. You can select not to follow links outside the URL's domain name, set a maximum depth of links per page, set a maximum number of objects to be retrieved, and set a maximum number of concurrent TCP connections to create for the job. By default, Do not follow link outside the specified URL domain name is disabled, so outside links will be followed. There is no maximum link depth set by default. The default limit on number of objects to be retrieved is 60,000, and the default maximum number of concurrent TCP connections is 4. After making your selections, click Next.
Figure 11.21: Specifying Content Download Details
On the Content Caching page, you can control which content is to be cached and how long objects will stay in the cache before they expire (the TTL). First, select whether to cache all content, cache content if source and request headers indicate to cache or if content is dynamic, or cache if source and request headers indicate to cache (this is the default).
As shown in Figure 11.22, you can set the TTL according to one of three options: expire content according to the cache rule, set the TTL if it's not defined in the reponse, or override the object's TTL. By default, the content expires according to the cache rule. If you select to override the object's TTL, you can set a new TTL (in minutes) with which downloaded objects will be marked. The default is 60 minutes. After you have made your selections, click Next.
Figure 11.22: Configuring Content Caching
On the last page of the wizard, you'll see a summary of the selections you have made. If you want to make any changes, use the Back button to return to the appropriate page. Otherwise, click Finish to create the new content download job.
The new job you have created will now be listed in the middle pane on the Content Download Jobs tab of the Cache node, as shown in Figure 11.23.
Figure 11.23: The New Job Appears in the Content Download Jobs List
How to Make Changes to an Existing Content Download Job
If you want to modify a content download job that you previously created, highlight it in the middle pane, and click Edit the selected job in the right Tasks pane, or right-click the job, and select Properties from the context menu.
On the General tab, you can change the job's name and add an optional description.
On the Schedule tab, you can specify a date and time to start the download, and you can change the download frequency (once, daily, or weekly on a specified day of the week). You can also configure the daily frequency if you selected to run the job daily. As shown in Figure 11.24, you can have the job run once per day, or you can configure it to be repeated at specified intervals (either hours or minutes). You can also set a time after which a new run of the job should not be started.
Figure 11.24: Modifying the Job Schedule
On the Content tab, you can change the URL from which the content is to be downloaded, and you can modify the job limits that you set when you created the job with the wizard.
On the Cache tab, you can change the options for which content to cache and the TTL options that you set when you created the job with the wizard.
How to Disable or Delete Content Download Jobs
If you do not want a job to run as scheduled but you will want to start running it on the same schedule again in the future, you can disable the job. To do so, highlight the job in the middle pane and click Disable the Selected Jobs in the right Tasks pane. You can highlight multiple jobs and disable them all at once. Alternatively, you can right-click the job and select Disable from the context menu.
If you want to do away with a job altogether because you will not be using it again in the future, you can delete it by highlighting it in the middle pane and clicking Delete the Selected Jobs in the right Tasks pane. You can highlight multiple jobs and delete them all at once. Alternatively, you can right-click the job and select Delete from the context menu.
How to Export and Import Content Download Job Configurations
You can export a content download job configuration by saving it to an XML file, just as you have exported other ISA Server 2004 configuration settings. To do so, highlight the job in the middle pane and click Export Content Download Job Configuration in the Related Tasks section of the right Tasks pane. Alternatively, you can right click the selected job and select Export Selected from the context menu. This invokes the Export Wizard.
Click Next on the first page of the wizard. On the Export Preferences page, specify whether to export confidential information. If you choose to do so, you need to enter and confirm a password with which the confidential information will be encrypted. Click Next.
Type in or browse to the path where you want to save the XML file. You can create a file by typing its path and name here, but you cannot create a folder.
On the last page of the wizard, your selections will be summarized. If you want to change anything, use the Back button to return to the appropriate page. Otherwise, click Finish to complete the Export process. A dialog box will inform you when the configuration has been successfully exported.
You can import a content download job that you saved from this or another ISA Server 2004 computer in much the same way. Click Import Content Download Job Configuration in the Related Tasks section of the right Tasks pane. This invokes the Import Wizard. Click Next on the first page.
Type in or browse to the path where the XML file you want to import is located, and click Next. Select whether to import server-specific information (such as cache drives and certificates). By default, server-specific information is not imported. You should import server-specific information if you are importing the configuration back to the same computer from which you exported it. If you are importing it to a different computer and select to import server-specific information, the firewall service might not start if the new computer does not have the same certificates installed. After you make your selection, click Next.
On the last page of the wizard, your selections will be summarized. If you want to change anything, use the Back button to return to the appropriate page. Otherwise, click Finish to complete the Import process. A dialog box will inform you when the configuration has been successfully imported.
How to Run a Content Download Job Immediately
In addition to running the content download jobs on the schedule you have configured, you can run any existing content download job manually at any time. To do so, highlight the job in the middle pane, and click Start Selected Jobs Now in the Content Download Tasks section of the right Tasks pane. You can highlight multiple jobs and run them all with a single click.
Alternatively, you can right-click the job you want to run, and select Start from the context menu.
