General discussion
-
Topic
-
Dr. Tom’s Microsoft Networking Blog
Lockedblog root
All Comments
-
-
Custom List: Core ISA Firewall and Tech Sites
Core ISA Firewall and Tech Sites
- ISAServer.org: The biggest and best ISA firewall site
- MS ISA Firewall site: The Official ISA Firewall Site
- ISATools.org: Jim Harrison’s unparalled ISA firewall automation site
- Amy Babinchak’s SBS ISA Firewall Site: Leading Site for ISA on SBS info
-
Photo Album: Home and Office Pix
Home and Office Pix
Untitled Photo
Untitled Photo
Untitled Photo
Untitled Photo
Untitled Photo
Untitled Photo
Untitled Photo
Untitled Photo
Untitled Photo
Untitled Photo
-
Photo Album: ISA Firewall Shots
-
ISA Firewall Blog test
This is the first ISA Firewall
Blog TestTom
http://www.isaserver.org/shinder
Tom and Deb Shinder’s Configuring
ISA Server 2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
ISAScripts.org Bolsters ISA Firewall Script Cache
Jim Harrison’s
http://www.isatools.org site is a godsend to ISA
firewall admins who need scripts to bolster the ISA firewall console’s
limitations. Jim’s site has been the mainstay and the only site on the Internet
to provide useful ISA firewall scripts. That is until now. Check out
Jason Fossen’s http://www.isascripts.org site for a collection of
scripts that allow you to do a number of management tasks that can’t be done in
the ISA firewall console.Here’s a list from Jason’s Web
site (http://www.isascripts.org):- ISA_Fill_Domain_Name_Set.vbs
Update a Domain Name Set
with domains obtained from a local file or from an HTTP URL, such as for the
blacklisted domains of spammers, advertisers, pornographers, hate groups,
etc.
- ISA_Fill_Computer_Set_Subnets.vbs
Update a Computer Set
object with subnets obtained from a local file or from an HTTP URL, such as for
bogon routes, unallocated routes, known attackers, unwanted countries,
etc.
- ISA_Copy_HTTP_Filter_Settings.vbs
Copies the HTTP
application-layer filter settings from one rule to another in the firewall
policy.
- ISA_Reset_Acknowledge_Alerts.vbs
Functions for viewing,
resetting and acknowledging triggered alerts.
- ISA_Add-Remove_Cached_File.vbs
Add/remove individual
files from Web Proxy cache.
- ISA_List_Alert_Definitions.vbs
List alert definitions and
their properties.
- ISA_Manage_SSL_Ports.vbs
View and
edit permitted outbound HTTPS/SSL tunnel ports (see KB283284).
- ISA_Manage_Domain_Name_Sets.vbs
Variety of functions for
viewing, creating, deleting and modifying Domain Name Set
objects.
- ISA_Manage_Subnets.vbs
Variety of
functions for viewing, creating, deleting and modifying Subnet
objects.
- ISA_Manage_URL_Sets.vbs
Variety of
functions for viewing, creating, deleting and modifying URL Set
objects.
- ISA_Server_Info.vbs
Variety of
functions for querying sessions, server name, cache drives, and other
stuff.
- ISA_Server_2004_Error_Codes.xls
Spreadsheet of names,
descriptions and hex numbers of ISA Server 2004 error, cache and response
codes.
- ISA_Server_Security_Template.inf
Security template for ISA
Server firewalls for use with SECEDIT.EXE or the Security Configuration &
Analysis snap-in. Disables unneeded services, so make sure to make a
backup of your box and test the template on a non-production server
first!HTH,Tom
http://www.isaserver.org/shinder
Tom and Deb Shinder’s Configuring
ISA Server 2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls
- ISA_Fill_Domain_Name_Set.vbs
-
Unparalleled VPN Security with ISA Firewall VPN Gateways
Heads up on the article series
I’ve put together on the exceptional level of security the ISA firewall’s VPN
remote access server and VPN gateway provides your network. This article series
focuses on the differences between the conventional hardware firewall/VPN server
and the ISA firewall’s unique VPN security model.Check out the series
at:Part 1: http://isaserver.org/tutorials/ISA-Firewall-Configure-Granular-Access-Controls-VPN-Part1.htmlPart 2: http://isaserver.org/tutorials/ISA-Firewall-Configure-Granular-Access-Controls-VPN-Part2.htmlBe sure to post on the
ISAServer.org forums at http://forums.isaserver.org with your
comments and questions.Thanks!Tom
http://www.isaserver.org/shinder
Tom and Deb Shinder’s Configuring
ISA Server 2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Connectivity Verifier
Connectivity Verifier Properties dialog box appears on the bottom of this page. These are useful for determining whether or not vital services for proper ISA firewall function are available. In this example, the ISA firewall is a member of the domain (which is an ISA firewall best practice) so its critical that the ISA firewall be able to connect to AD domain controllers. You can then configure the verifier to trigger an Alert, which can then subsequently send an email message to your cell phone, email account, or pager.
-
Blocking MSN Messenger File Transfers
I’ve seen a good number of requests for blocking MSN file transfers without needing to whack all access to MSN Messenger. No problem!You can use the HTTP Security Filter to kill off those nasty file transfers while allowing them to continue chatting their hearts away. All you need to do is configure the HTTP Security Filter with a signature to block the following Host Header:/x-msnmsgrp2p
Just another reason why the ISA firewall rocks, and Bluecoat SuX0rs.Tom
http://www.isaserver.org/shinder
Tom and Deb Shinder’s Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Amy Babinchak Authors ISA 2004 Chapters in Upcoming SBS2003 SP1 Book
Heard some great news today
about an upcoming book titled Microsoft Small Business Server 2003
Unleased (http://www.amazon.com/exec/obidos/ASIN/0672328054/)
What’s the news? Its that Amy Babinchak has authored two ISA
2004 chapters in this book!Amy is the leading authority on
ISA firewall implementation on SBS 2003 SP1 deployments and she’s authored
serveral articles on ISA firewalls on SBS over at http://www.isaserver.org. Her contributions to this
book will make it a great read and I’m looking forward to getting my copy when
the book is released.Amy also runs the world’s
leading site on ISA in SBS. Check out out at: http://isainsbs.blogspot.com/HTH,Tom
http://www.isaserver.org/shinder
Tom and Deb Shinder’s Configuring
ISA Server 2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
FYI: Network Engines’ Issues Prescriptive Security Alert and Recommendation Re: Zotob, Seven New Threats Uncovered
From: USEast News Service [mailto:USEastNewsService@USEast.Net]
Sent: Thursday, August 18, 2005 12:05 PM
To: USEast News Service
Subject: Network Engines’ Issues Prescriptive Security Alert and Recommendation Re: Zotob, Seven New Threats UncoveredPress Release Source: Network Engines Network Engines’ Issues Prescriptive Security Alert and Recommendation Re: Zotob, Seven New Threats Uncovered
Thursday August 18, 12:25 pm ETCANTON, Mass.–(BUSINESS WIRE)–Aug. 18, 2005–Network Engines, a leading OEM appliance partner for Microsoft security solutions, in partnership with its NICE technology partners, has identified two more versions of Zotob. We are now tracking seven (7) Zotob permutations that are exploiting the PnP vulnerability. The worms are all based on versatile attack programs, known as bot software, which have added the ability to spread via a flaw in Microsoft’s Windows Plug-and-Play functionality. Several bot programs had incorporated the code to exploit the flaw late last week, and starting with the Zotob worm, began adding the ability to automatically find and infect systems by last weekend. As of yesterday morning, at least 12 versions of bot software were using the exploit to spread. It is also important to note that not all PnP exploits are characterized as Zotob, and some may escape AV detection all together. Several new bots, including two based on IRCBot, three on Botzori, two variants of Esbot, a version of Bobax, and a version of Spybot may escape AV detection.- Zotob.A
- Executable size: 22,528 bytes
- Executable Name: botzor.exe
- Ports: TCP – 445,8080,33333
- Aliases: Zotob.A (F-Secure), W32/Zotob.worm (McAfee), W32/Zotob-A
(Sophos), WORM_ZOTOB.A (Trend)
Other details – Opens FTP server on port 33333, copies 2pac.txt and haha.exe to the system directory, adds itself to the run and run services in the registry. Modifies the hosts file to prevent updating of antivirus and security programs from updating.
- Zotob.B
- Executable size: 27,648 bytes
- Executable Name: csm.exe
- Ports: TCP – 445,8080,33333
- Aliases: Zotob.B (F-Secure) W32/Zotob.worm.b (McAfee) W32/Zotob-B
(Sophos) WORM_ZOTOB.B (Trend Micro)
Other details – Opens FTP server on port 33333, copies 2pac.txt and haha.exe to the system directory, adds itself to the run and run services in the registry. Modifies the hosts file to prevent updating of antivirus and security programs from updating.
- Zotob.C
- Executable size: 41,984 bytes
- Executable Name: per.exe
- Ports: TCP – 445,8080,33333
- Other details – Mass-mailing worm uses a predefined list of
recipient names appending the domain names that it gathers from an infected computer. Contains its own SMTP engine to email to the addresses that it finds. Opens FTP server on port 33333, adds itself to the run and run services in the registry. Modifies the hosts file to prevent updating of antivirus and security programs from updating.
- Zotob.D
- Executable size: 51,326 bytes
- Executable name: windrg32.exe
- Ports: TCP – 6667,1117,445
- Other details – Opens FTP server on port 11173, attempts to end a
variety of processes, Modifies the registry and deletes a variety of registry entries, and deletes a variety of files from the system and program files directories, adds itself to the run and run services in the registry. Modifies the hosts file to prevent updating of antivirus and security programs from updating.
- Zotob.E
- Executable size: 10,366 bytes
- Executable Name: wintbp.exe
- Ports: TCP – 8594,8080,445, UDP – 69
- Aliases: WORM_RBOT.CBQ (Trend Micro)
- Other details – Opens TFTP server on port UDP 69, Connects to IRC
server at 72.20.27.115 on TCP port 8080 to listen for update instructions, adds itself to the run in the registry.
- Zotob.F
- Executable size: 10,878 bytes
- Executable name: wintbpx.exe
- Ports: TCP – 445
- Other details – Opens multiple TCP ports. Connects to IRC server
at 72.20.41.139 to listen for update instructions, adds itself to the run in the registry, creates a file named %Temp%\(NUMBER) which if successful contains TFTP scripts to download additional files.
- Zotob.G
- Executable size: 73,728 bytes
- Executable name: windrg32.exe
- Ports: TCP – 445,6667,1171
- Aliases: W32.Drudebot.A
- Other details – Attempts to connect IRC servers on port 6667,
Opens a TFTP server on port 1171, attempts to end a variety of processes. Modifies the registry and deletes a variety of registry entries, and deletes a variety of files from the system and program files directories, adds itself to the run and run services in the registry, creates a file named %Temp%\(NUMBER) which if successful contains TFTP scripts to download additional files. Modifies the hosts file to prevent updating of antivirus and security programs from updating.
Zytob exploits MS05-039 by generate random IP addresses to which they try to connect through port 445, searching for vulnerable computers. When a computer is found, they will send instructions to download a copy of the worm by TFTP. Once installed on a system, the worm modifies a registry key to ensure its execution on every system startup, and initializes a backdoor component made available through IRC, and awaiting orders in a specified channel. The intent is to allow a remote attacker to take control of the system. It only spreads to systems having operating systems Windows 2000, XP and Windows Server 2003
RECOMMENDATION:
1. Disable TCP/IP Port 445 – Among the new ports introduced in Windows 2000, Windows XP and Windows Server 2003, is port 445. TCP Port 445 is often exposed to the Internet because the Microsoft-DS Service uses port 445 for resource sharing on Windows 2000, XP, 2003, and other samba based connections. It is difficult to describe the usage of Port 445 in simple terms. Essentially it is used by the Server Message Block (SMB) protocol for file sharing. It is also used for NetBIOS Services over TCPIP, described as NBT. When file sharing is required and NBT is enabled, a connection to the remote computer is tried simultaneously on both port 139 and 445. If there is a response from port 445, it continues its SMB session on port 445 only. If there is no response from port 445, it will continue its SMB session on port 139 if that responded. If there is no response from either of the ports, the session will fail.
Many viruses have targeted port 445 and it is not commonly used. For this reason we recommend you secure it by blocking inbound TCP port 445 scans at the NS Series security appliance. On a small percentage of networks disabling port 445 may block access to some network devices. If this occurs it is possible to Rollback or Unsecure this setting.
Block Inbound 445 Traffic – Inbound scans are typically systems which are trying to connect to file shares that might be available on your system and hence these should be blocked. While most of this traffic is the result of worms or viruses that can use open file shares to propagate, port 445 traffic can also be the result of malicious users attempt to connect to your computer. Once connected they can download, upload or even delete or edit files on the connected file share. If you use open file shares (including sharing of printers, etc) on your local network (LAN), then you should configure the NS Series security appliance such that your local file shares are not accessible from the Internet. Connecting to open file shares is likely the easiest and most common hack on the Internet and yet one of the most effective for malicious activities like identity theft or installing RATs (Remote Access Trojans) to take control of systems remotely for example.
Benefit When Secure: Disabling port 445 gives greater protection against virus attack.
Important: Disabling Port 445 may block access to other computers, printers or devices on a network.
2. Block TCP/445 egress whenever possible to detect infected systems leaving your network.
3. Ensure all systems have NULL session disabled to block the current threats – Null sessions are un-authenticated connections (not using a username or password.) to an NT or 2000 system. Windows NT and 2000 systems are vulnerable to syntax exploits that can expose hidden interprocess communications shares to the Internet. For example: C:\>net use \\192.168.###.###\IPC$ "" /u:"" The preceding syntax connects to the hidden interprocess communications "share’ (IPC$) at IP address 192.168.###.### as the built-in anonymous user (/u:"") with a null ("") password. If successful, the intruder now has an open channel over which to attempt various techniques which allow him/her to gather as much information as possible from the target i.e. network information, shares, users, groups, registry keys, and so on. Null session connections, or anonymous logons, can be the single most devastating network foothold sought by intruders.
Null sessions require access to TCP 139 (and/or 445 on Win 2000). The most prudent way to eliminate them is to filter TCP and UDP ports 139 and 445 at all perimeter NS Series security appliances.
(Note: Some server roles require NULL functionality, including Exchange and SQL servers).
4. If Null Sessions are required – Organizations that require the use of NULL sessions should keep those servers properly patched or block port 139 at the NS Series security appliance.
5. Do not rely on TCP/33333 FTP service detection – Configuring intrusion detection systems to monitor for outbound TCP 3333 service establishment is effective for detecting compromised systems infected with Zytob variants A-C. However replying of port 3333 service detection will not identify all potential compromised systems as port 3333 is not used consistently in the latest bot variants. It is necessary to configure service detection policies for all phone home permutations (see worm profiles described above).
6. Ensure AV signatures are up-to-date – The most likely scenario is that the bot would use the Plug and Play vulnerability to compromise a remote user’s laptop. Once inside the perimeter, that infected device will scan for unpatched systems, which the bot could then attack using other exploits. It is imperative that AV signatures are up-to-date to mitigate as much of this risk as possible.
7. Patch! – Zotob can be virulent, and while the bot variants make use of the Plug and Play vulnerability, it also includes code for exploiting other Windows’ bugs, including 2004’s LSASS vulnerability, the one that Sasser exploited. That means some of the new bots can infect not only Windows 2000 PCs, but other unpatched Windows machines. Therefore it is necessary to patch all systems to current levels in order to prevent future variants that exploit other MS vulnerabilities.
About Network Engines
Network Engines is a leading developer and manufacturer of security and storage appliances. The Company works with its software partners to develop storage and security networking appliances for mission critical applications. Network Engines is headquartered in Canton, Massachusetts and trades on the NASDAQ exchange under the symbol NENG. For more information about the company’s products and services, visit http://www.networkengines.com.
Contact:Network Engines, Inc. Media contact: Joni Moore, 508-308-7900 joni.moore@networkengines.com or Technical contact: Kyle Quest, Kyle.Quest@networkengines.com Lead Security Systems Architect CISSP, GCIA (Certified Intrusion Analyst)
-
Bevy of ISA Firewall Tools Released
A ton of cool tools were released July 20th that you might want to know about. Here they are:CacheDir Tool for ISA Server 2004
View real-time cache contents, save cache content to a file, and mark obsolete items that should not be served from the cache. NOTE: Be careful with this one if you’re running the ISA perfmon counters while running the this tools. I will make your counters zero out and give you the impression that your Web cache is empty. Just restart the firewall service and all will be normal again.
Released July 20, 2005ISACertTool for ISAServer 2004 Enterprise Edition
Deploy certificates required to authenticate communications between ISA Server array members and the Configuration Storage server in a number of ISA Server deployment scenarios. NOTE: This tool is helpful when trying to attempt the egregious process of deploying ISA 2004 EE in a workgroup scenario. My advice is to bag the workgroup scenario and join the ISA firewalls to the domain. You actually improve your overall level of security when the ISA firewalls are domain members.
Released July 20, 2005MSDEToText Tool for ISA Server 2004
Display the contents of your Microsoft Data Engine (MSDE) Firewall and Web Proxy logs on-screen, or write log contents to a text file. TOM: We’ve been waiting for this since ISA 2004 SE released in May of 2004. Better late than never!
Released July 20, 2005Remote Access Quarantine Tool for ISA Server 2004
Use this tool to prepare ISA Server installed on a computer running Windows Server 2003 as an RQS listener component for VPN quarantine control. TOM: Useful if you’re not running Windows Server 2003 Service Pack 1
Released July 20, 2005RemoveAllNLBSettings Tool for ISA Server 2004 Enterprise Edition
Save time removing Network Load Balancing (NLB) settings with this tool. TOM: Saving time is an understatement 🙂 Get this tool if you’re running ISA 2004 EE firewall arrays and using NLB.
Released July 20, 2005HTH,Tom
http://www.isaserver.org/shinder
Tom and Deb Shinder’s Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Jim Harrison’s ISATools.org Site Down for ISP Change
Heads up
folks!Jim Harrison’s ISATools.org (http://www.isatools.org) site will be down for a few
days as Jim changes ISP.I’ll post when it comes back
online.Thanks!Tom
http://www.isaserver.org/shinder
Tom and Deb Shinder’s Configuring
ISA Server 2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
How Microsoft Can Make More Money on ISA Firewalls
One thing that will never cease to amaze me are the number of enterprise admins who think the ISA firewall is "Proxy X.X".Why do they do this?They’ve duped their hapless CIOs into spending hundreds of thousands of dollars on overhyped packet filtering devices with a FIREWALL sticker slapped on them and there’s no way these guys are going to bring in an ISA firewall and deploy the lower cost ISA firewall solution because they’ll have a lot of ‘splaining to do when asked why they spent $15,000 for a box that does much less and is likely less secure than a $5,000 ISA firewall.Since no one wants to be in that uncomfortable position, these enterprise admins bring in the ISA firewall and call it a Proxy Server. Yea, OK, sure, that’s right. Its a Proxy Server, and we all know that Proxy Servers don’t cost as much as firewalls. This ploy works and the guys who got their clocks cleaned by packet filter firewall vendors can save face, and their jobs.So here is my advice to Microsoft on how they can make more money by providing less:- Create a Web proxy only version of the ISA firewall. Market it as ISA Web Proxy Server Edition
- Create a Firewall and VPN Server/Gateway version. Market it as ISA Firewall Edition
- Create a Firewall, VPN Server and Web Proxy version (like today’s version of ISA). Market it as ISA Enhanced Firewall Edition
Now here’s how Microsoft can cash in. Since the enterprise guys seem to have more dollars than sense, charge four times as much for the Web Proxy Server Edition. This will work because a lot of information challanged companies are using simple Web proxy devices like Bluecoat and paying an insane premium for them. The ISA firewall’s Web proxy filter capabilities are far and above superior to those provided by Bluecoat, so Microsoft would have no problem with upping the ante on the Web Proxy Server Edition, even though there is less product than the full version of ISA being offered.The ISA Firewall Edition could go for about half the price its going for now, and the ISA Enhanced Fireall Edition would go for the current price.The final breakdown, based on today’s pricing would work out something like this:ISA Web Proxy Server Edition = $5995.00ISA Firewall Edition = $795.00ISA Enhanced Firewall Edition = $1495.00I think this will work. You’re selling into a market that refers to outbound access as egress filtering — so they’re prime P.T. Barnum candidates:"This way to the egress……….."That’s all for now!Tom
http://www.isaserver.org/shinder
Tom and Deb Shinder’s Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Get Rid of “Unidentified IP Traffic” in your Logs
Do you get
irritated by seeing entries for Unidentified IP Traffic in your
log files and reports? Me too.Its easy to reduce
the amount of traffic seen by the ISA firewall as unidentified. All you need to
do is create Protocol Definitions for the protocols that aren’t included in the
default list of Protocol Definitions.For example,
create a Protocol Definition for TCP Outbound 8080 and name it
Web Proxy Client. Now all the traffic from the Web Proxy client
to the Web Proxy filter on the ISA firewall will be seen as Web Proxy
Client traffic. Create another Protocol Definition for TCP
Outbound 1745 and name it Firewall Client Control. Now
all the Firewall Client Control Protocol traffic will appear as Firewall
Client Control.Do the same thing
for other common protocols that you identify in the ISA firewall’s log files.
Now you’ll see a lot less Unidentified IP Traffic in your
logs.HTH,Tom
http://www.isaserver.org/shinder
Tom and Deb Shinder’s Configuring
ISA Server 2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
User Agent Strings Project
Author Topic: Link to User Agent Strings RobJohn
Senior Member
Member # 327
posted August 20, 2005 06:10 PM 
FYi to all,I ran across a project that is identifying and publishing User Agent Strings.
http://www.bleedingsnort.com/article.php?story=20050303190103553
——————–
Rob John
MCSE, CCNA
Posts: 47 | From: Montgomery, Al | Registered: Feb 2001 | IP: LoggedYou can use these User Agent Strings in the ISA firewall’s HTTP Security Filter.
HTH,
Tom
http://www.isaserver.org/shinder
Tom and Deb Shinder’s Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Troubleshooting SSL Web Publishing Rules
The ISA firewall’s Web Publishing Wizards make it very easy to publish secure Web sites to the Internet. While the Wizards do most of the heavy lifting, one thing they don’t do very well is setting up the Certificate Infrastructure and explaining the proper naming conventions for the certificates and how the certificate naming infrastructure relates to the settings on your Web Publishing Rules.If you’re trying to publish a secure Web site but getting hung up on the certificates, then check out this excellent article on the http://www.microsoft.com/isaserver site:Troubleshooting SSL Certificates in ISA Server 2004 PublishingTom
http://www.isaserver.org/shinder
Tom and Deb Shinder’s Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
ISATools.org Back Online!
Quick note
to let you all know that Jim Harrison is up and running again and http://www.isatools.org is once again online.The Management
greatly appreciates your patience 🙂Tom
http://www.isaserver.org
Tom and Deb Shinder’s
Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
ISA Pet Peeve #3698745
When you ask a
question regarding ISA client types, you need to understand that there are three
types of ISA clients:SecureNAT
ClientWeb Proxy
ClientFirewall
ClientThe
SecureNAT client does not require client software installation
or configuration.The Web
Proxy client requires that the Web browser be configured to use the ISA
firewall as its Web proxy device. You do not need to install any client
softwareThe
Firewall client is a Winsock Proxy client (similar to a SOCKS
client but infinitely better) that provides transparent
application proxy services to the ISA firewall’s Firewall Service. The Firewall
client software must be installed and configured.MORAL OF THE
STORY:Do not
refer to "ISA Client Software". Be specific regarding the client type you’re
using.HTH,Tom
http://www.isaserver.org
Tom and Deb Shinder’s
Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Jim Harrison of ISATools.org Shares His Baby Picture
Jim Harrison has
finally relented to numerous requests for a online photograph. While he wasn’t
willing to share a current photo, he did send us a baby
picture:Tom
http://www.isaserver.org
Tom and Deb Shinder’s
Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Solving the ReturnDeniedIfAuthenticated Problem in ISA 2004 Firewalls
When a URL Set or Domain Name Set is configured, the client receives an HTTP 407 error for each domain that is restricted. As a result, the client browser is prompted for authentication. If the destination that is set is restricted to a domain that contains multiple links to other domains, an authentication dialog box appears for each unauthorized link. This is a real PITA. While the fix for this was a no-brainer in ISA Server 2000, for some reason we need to be scripting gurus to figure out how to do the same thing with the 2004 ISA firewall.Well, I’m no scirpting guru and fortunately I don’t have to be! Tristan Kington (affectionately known as Tristank) has a solution for us! Just check out the vb script below. All you need to do is replace the ISA firewall Network names in bold with the ISA firewall Network name for which you want to configure the ReturnDeniedIfAuthenticated setting for Web proxy clients. Just copy and paste the stuff between the double lines to a text file, name it something.vbs and run it from the command line as cscript something.vbs.Check out Tristan’s original description of the problem over at http://blogs.technet.com/tristank/archive/2004/11/01/250312.aspx=================================‘ Standard Disclaimer:
‘ This script is purely for example purposes
‘ and should not be used by anyone, ever.
‘ It’s designed for use with CSCRIPT, not WSCRIPT. So don’t just double-click it unless you
‘ really enjoy being bombarded with dialog boxen.
‘ TristanK
‘ We want to reset the internal network listenerTheOnlyOneOfInterest = "Internal"‘ True = Enabled, False = Disabled (default)setting = True
found = 0
set root = CreateObject("FPC.Root")
set firewall = root.GetContainingArray
set networks = firewall.NetworkConfiguration.Networks
for each network in networks‘Wscript.echo network.nameif TheOnlyOneOfInterest = network.name then
found = found + 1
Wscript.echo "Found network: " + network.name
network.WebListenerProperties.ReturnAuthRequiredIfAuthUserDenied = setting‘ this is pure bumf- feel free to comment it out if you don’t want to be prompted
‘ the Wscript.stdin.readline line requires the latest version of the VBScript/WSH componentsWscript.echo "Property Set – press Enter to Save the change."
‘ Wscript.stdin.readline
Wscript.echo "Please wait…"‘ Commit the configuration changenetwork.WebListenerProperties.Save
end if
next
if found = 0 then
Wscript.echo "Target network was not found."
else
Wscript.echo "Done."
end if=================================Tom
http://www.isaserver.org
Tom and Deb Shinder’s Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Why don’t you allow comments in your blog?
Some people have
asked me offline why I don’t enable comments in my blog. The main reason is this
blog is meant to share info tidbits and interesting news and views on the ISA
firewall, not as a comprehensive meeting space and clearinghouse for ISA
firewall information. The best thing about using a blog is that I can post to it
using email, which is more efficient than the process I have to use to post News
items on the http://www.isaserver.org Web site.
This blog is also a lot more relaxed and informal than the material I put on the
ISAServer.org site, as I want to keep the http://www.isaserver.org Web site going as one of
the most professional tech Web sites on the Internet today
(IMHO).That doesn’t mean
I don’t want to hear from you! If you have questions about anything covered in
my blog, start a discussion with a post on the ISAServer.org forums over at http://forums.isaserver.org and then
send me an email to tshinder@isaserver.org with the
link to the discussion. This allows me to answer your question and enable all
the other members of the ISAServer.org community to benefit from our
discussion.Thanks!Tom
http://www.isaserver.org
Tom and Deb Shinder’s Configuring ISA Server
2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Custom List: ISA Firewall Sites
ISA Firewall Sites
- ISAServer.org: The biggest and best ISA firewall site
- MS ISA Firewall site: The Official ISA Firewall Site
- ISATools.org: Jim Harrison’s unparalled ISA firewall automation site
- Amy Babinchak’s SBS ISA Firewall Site: Leading Site for ISA on SBS info
-
ISA Pet Peeve #12536921
"I have an ISA
firewall in the DMZ"What does this
mean?Does the ISA
firewall have an external interface connected to the Internet and an internal
interface connected to the DMZ?Does the ISA
firewall have an external interface connected to a DMZ and an internal interface
connected to the private corporate network?Does the ISA
firewall have an external interface in an anonymous access DMZ and an internal
interface in an authenticated access DMZ?Does the ISA
firewall have 9 NICs, with 5 of them in DMZs and 4 in private corporate
networks?OR,
is it the most dreaded
possibility:Does
the single-NIC (caponized) ISA firewall have its only, solitary interface
in a DMZ segment between two "firewalls" (invariably souped up routers with a
FIREWALL sticker on their bezels)MORAL OF
THE STORY:Tell us about the
relevent network topology. "In the DMZ" means as much as "open a port" (cf. http://www.tacteam.net/openport.htm)
HTH,Tom
http://www.isaserver.org
Tom and Deb Shinder’s Configuring ISA Server
2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Redux: Solving the ReturnDeniedIfAuthenticated Problem in ISA 2004 Firewalls
Stefaan Pouseele, a redoubtable ISA firewall MVP comes back with a
trenchant comment regarding my post regarding the
ReturnDeniedIfAuthenticated issue:=============================
Hi Tom,
In your blog (http://spaces.msn.com/members/drisa/Blog/) you wrote on
August 24 about solving the ‘ReturnDeniedIfAuthenticated’ problem in ISA
2004 Firewalls. I was a little bit astonished about your statement
"While the fix for this was a no-brainer in ISA Server 2000, for some
reason we need to be scripting gurus to figure out how to do the same
thing with the 2004 ISA firewall".It’s correct that in ISA Server 2000 the default behavior was that when
a destination set is configured, the client receives an HTTP 407 error
for each domain that is restricted. To get rid of this unwanted
authentication prompt, KB http://support.microsoft.com/?id=297324 gives
a solution by adding a registry value ‘ReturnDeniedIfAuthenticated’.From my experience the default ISA 2004 behavior is that the client
receives an HTTP 502 error for each domain that is restricted. To be
really sure I tested it again with a simple web page with one external
image. I can confirm we have with ISA 2004 the opposite of the old
default behavior of ISA 2000. Therefore, nothing should be scripted at
all!I digged a little bit further into Tristank’s blog
(http://blogs.technet.com/tristank/archive/2004/11/01/250312.aspx) and
the title says "ISA 2004 does 502s rather than 407s if you’re already
authenticated". So, I think you have only to change the
‘ReturnAuthRequiredIfAuthUserDenied’ property to true if you want that
the client receives an HTTP 407 error for each domain that is restricted
and therefore reverting back to the default behavior of ISA 2000.Hopefully this clearup some confusion your blog could create.
Kindly,
Stefaan
MVP ISA Server
http://www.isaserver.org/Stefaan_Pouseele/
-
FW: Solving the ReturnDeniedIfAuthenticated Problem in ISA 2004 Firewalls
Stefaan Pouseele found this great piece of info on the ISA MSDN site. Check it out!============================
Hi Tom,Found on
http://msdn.microsoft.com/library/en-us/isasdk/isa/isa_server_2000_registry_
values.asp?frame=true?
HKLM\SYSTEM\CurrentControlSet\Services\W3proxy\Parameters\ReturnDeniedIfAuth
enticatedThis ISA Server 2000 registry value has been replaced in ISA Server 2004 by
the ReturnAuthRequiredIfAuthUserDenied property of the
FPCWebListenerProperties object, which indicates whether a Proxy
Authentication Required message should be returned when a user is
authenticated by the ISA Server Web proxy but is denied access by the rules.
By default, an access denied message is returned, and the user is not given
the option of authenticating with different credentials.
In the forward proxy scenario, when this property is set to True, a user
that is authenticated by the Web proxy but fails to pass the rules (for
example, because they deny access to this user) receives HTTP error 407
(Proxy Authentication Required) and can try again using different
credentials. If this property is set to False (the default value), the user
receives HTTP error 502 (Bad Gateway) with a resource denied error page and
is not prompted again for credentials when the Web proxy denies access for a
request. In the reverse proxy scenario, the corresponding HTTP errors are
401 (Unauthorized: Logon Failed) and 403 (Forbidden: Execute Access
Forbidden).Kindly,
Stefaan
-
ISA Firewall Hot Tip: FBA and RPC/HTTP are not two great tastes that taste great together
SITUATION: I have published OWA using forms-based authentication and it works great.WISH: Now that OWA is working so great, I want to use the ISA firewall to publish my RPC/HTTP Web sitePROBLEM: RPC/HTTP publishing doesen’t seem to work when OWA forms-based authentication is enabledSOLUTION: Create a second Web listener and use that for RPC/HTTP publishing. The second Web listener must be on another IP address. The second Web listener must NOT use the same IP address as the OWA Web Listener.BETTER SOLUTION: Get FlexAuth from http://www.collectivesoftware.com and then you’ll be able to publish both the OWA site using forms-based authentication and the RPC/HTTP site without requiring a second IP address.HTH,Thomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Why Publishing OWA Sites to the World is Secure with ISA Firewalls
thecoffeeguy
Junior Member
Member # 32550
posted August 29, 2005 08:45 PM
Maybe I am just
getting old, or maybe I am behind the times, but i’ve been trying to
wrap my head around the idea of publishing my Exchange server to the
world while it is parked in my internal network.Could
someone take the time and explain why this is secure and reliable
and that it’s not as bad as I think?I came from the school
of thought that you never ever opened up your internal servers of
any sort to the outside world so the idea of publishing my exchange
server to the outside world, makes me a little
uncomfortable.Don’t get my wrong, I like the idea and what
it will allow me to do. No need for a front end or back end
server(s) (which equals money saved on hardware and licensing), so
that is definitely a good thing.I’m just having a hard time
understanding this.
I have those thoughts where my exchange
server gets hacked (i work for a financial company and we have very
sensitive data), and poof!, there everything goes.But the
flip side to all of this is that, we need to give OWA access to our
employees so they can work from the field.I don’t mean to
sound like a pessimist, just need a little convincing and
reassurance that this is a good
thing.Thanks.
thecoffeeguy
Posts: 5 |
Registered: Aug 2005 | IP: Loggedtshinder
Moderator
Member # 11
posted August 30, 2005 06:36 AM 
Hi
Cguy,The key is *pre-authentication*
The ISA firewall
is able to pre-authenticate and pre-authorize the user *before*
allowing the connection to the OWA site.Only after the user
is pre-authenticated and pre-authorized is the connection passed to
the OWA site.Not only this, but the ISA firewall terminates
the SSL connection from the external user, performs HTTP protocol
inspection and compliance using the HTTP Security Filter, and then
re-encrypts the connection so that you have end to end SSL
security.My grand-pa’s "hardware" firewall can’t do that.
![[Cool]](http://forums.isaserver.org/ubb/cool.gif)
HTH,
Tom——————–
FACT: Firewalls
need at least two interfaces — put a second NIC in that ISA
firewall!
FACT: Deploying a single-NIC ISA Firewall is like
giving a soldier a Desert Eagle .50 and no
ammo.
=================Need a Whitepaper or Custom
Documentation for your ISA Server Implementation? I have per-word,
per-page or per-hour pricing plans. Write to me
at:
tshinder@isaserver.org
http://spaces.msn.com/members/drisa/GET
THE NEW BOOK! Configuring ISA Server 2004
Get It
Here!
Posts:
35729 | From: Texas | Registered: Jan 2001
| IP: Logged
Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Tom Shinder’s Trek through Small Business Server 2003 Service Pack 1 – Part 2: The CEICW from the Welcome Page to the Router Connection Page Published at www.isaserver.org
In this article I?ll begin my trek through
the installation and configuration of SBS 2003 SP1. The installation is a clean
installation. I will not discuss upgrade scenarios in this series. While I
realize that this isn?t the most common deployment scenario, it allows me to
discuss the salient points of the CEICW and subsequent ISA firewall installation
and configuration.Check it out
at:Discuss it
at:HTH,Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Solve SQLSERVER.EXE memory usage problems
Have problems with
the SQLSERVER.EXE process sucking up all your memory? MSDE
getting you down? Jim Harrison serves up a fix for this problem
for those of you using MSDE logging on your ISA firewalls:=========================
Found it:1 – open a cmd window
2 – type the
following:
osql -E -S
%computername%\msfw
sp_configure
‘show advanced options’,1 reconfigure with
override
go
sp_configure ‘max server
memory’, nnnn reconfigure with override
(where nnnn is in
mb)
go
exit
3 – restart MSDE – note
that you’ll also have to restart the ISA
Firewall service
manually...I’d recommend giving MSDE at least 1/3 physical RAM,
depending on how
much your system actually has.Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog:
http://spaces.msn.com/members/drisa/
Book:
http://tinyurl.com/3xqb7
MVP — ISA
Firewalls
-
Making the Boss Happy with a Well-Designed Split DNS Infrastructure
Of all the issues in ISA firewall networking, the
one that most commonly gets people hot under the collar is that of the split
DNS. I?ve never been able to figure out why barriers go up for a lot of folks
when you begin to talk about a split DNS.Maybe it?s because they believe they need to
rename their internal network domains, or that they think there is an adverse
security impact, or maybe its just because DNS is so difficult to understand in
the first place, that the idea of further complicating the issue puts them over
the edge.This is especially
true for SBS users. As I’ve mentioned in multiple articles, you
do not need to deploy a well designed split DNS to support your
SBS deployments. A well-designed split DNS deployment will only make
your deployment better. However, if you don’t understand how DNS works, and
how split DNS infrastructures work, then you will do yourself a significant
disservice by attempting to deploy one. However, if you take the time to
understand how it works, test it in your lab, and then take the knowledge gained
from your study and testing, you’ll wonder why you never used a split DNS
infrastructure.There is a a lot
of concern that you need to change your AD domain name to support a well-design
split DNS infrastructure. Sure, you can simplify things by planning in advance
and using the same domain name for internal and external resources, but its
definitely NOT required. You can use .local, .idontunderstand,
.mssbsdnsguidanceiswhack, or whatever top-level domain you like for your AD
domain name. Remember, the key to a split DNS infrastructure is using different
DNS zones for external and internal clients. That’s all.Remember:
A split DNS infrastrucutre has NOTHING to do with your AD
domainFor a detailed
account of how things work, check out Supporting ISA Firewall Networks
Protecting Illegal Top-level Domains: You Need a Split DNS! at http://isaserver.org/tutorials/2004illegaltldsplitdns.htmlThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Testament to ISA Firewall Security — Passes FBI Muster
Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
FW: ISAserver.org – August 2005 Newsletter
ISAserver.org Newsletter of August 2005
From: ISAserver.org [mailto:info@isaserver.org]
Sent: Wednesday, August 31, 2005 6:14 AM
To:
tshinder@hotmail.com
Subject: ISAserver.org – August 2005
Newsletter
The #1 unofficial ISA Server resource siteISAserver.org Newsletter of August 2005
Sponsored by: GFI
Software Ltd
ISAserver.org Newsletter
August
2005In this issue:
- How to Communicate Your Problems with the
ISA Firewall - Tom and Deb Shinder’s Configuring ISA
Server 2004 — Order Today! - ISAserver.org Learning Zone Articles of
Interest - KB Articles of the Month
- Tip of the Month
- ISA Firewall Links of the Month
- Ask Dr. Tom
Welcome to the
ISAserver.org newsletter! Each month we will bring you
interesting and helpful information on ISA Server. We want to
know what all *you* are interested in hearing about. Please
send your suggestions for future newsletter content to: tshinder@isaserver.orgGFI WebMonitor for ISA Server 3 out now in BETA –
Includes content filtering & virus scanning
features!The latest version of GFI WebMonitor for ISA Server,
a utility for ISA server that allows for real time
monitoring of web sites being browsed by network users
and the files they are downloading, is now available in
BETA! Version 3, BETA now includes a real-time online
adult content filter, virus scanning and file
type blocking capabilities and byte transfer
stats per user/per site.Click
here to download the new and improved BETA
version!1. How to Communicate Your Problems with the
ISA FirewallBy Thomas W Shinder MD, MVP
We try to answer as many questions as possible on the
ISAServer.org messages boards and mailing list. Sometimes
there are some very interesting and potentially solvable
questions, but there’s not enough information provided to
answer the question. Here are some things you can do to help
all of us be more effective in answering your questions:- Let us know what you have done to prove that it’s an ISA
firewall issue. From my experience, over 95% of connectivity
issues are falsely attributed to the ISA firewall where the
problem actually lies with some other network service or
network infrastructure device - Provide IP addressing information, including DNS
settings, for your ISA firewall’s NICs - Provide information on what Access Rules are created on
the ISA firewall and in what order they appear - Tell us exactly what you want to accomplish.
Don’t give vague examples, tell us exactly what it is your
trying to do - Tell us exactly what you have done to make happen
what you want to happen. Don’t provide vague descriptions,
tell us exactly what you did - Provide exact descriptions of error messages seen
on the client side, and also what appears in the ISA
firewall’s log files. Also, provide any information related
to ISA firewall errors in the Windows Event Viewer - If asked for an exact configuration of an Access
Rule or Web Publishing Rule, give exact information. That
means you put in real FQDNs, IP addresses, etc. If
you use http://www.example.com, that doesn’t help and it will
likely end the discussion
If you follow these simple guidelines, the chances that
your question will be answered quickly and correctly will be
increased significantly. It will also show you’ve performed
appropriate due diligence to solve the problem yourself and
keep everyone’s interest in making sure you get to your
desired result.=======================
Quote of the Month – "I’d rather be lucky than good.
It’s even better to be both" -Tom Shinder speaking of his
post-undergraduate days as a semiprofessional gambler=======================
2. Tom and Deb Shinder’s Configuring ISA
Server 2004 – Order Today!By Thomas W Shinder
Tom and Deb
Shinder’s best selling books on ISA Server 2000 were the
"ISA Server Bibles" for thousands of ISA Server 2000
network administrators. Tom and Deb Shinder present you
with their next ISA Server book, Configuring ISA
Server 2004. This book leverages the over two years
of pre-release experience Tom and Deb have had with ISA
Server 2004, from pre-alpha to RTM and all the versions
and builds in between. They’ve logged literally 1000’s
of flight hours with ISA Server 2004 and they have
shared the Good, the Great, the Bad and the Ugly of ISA
Server 2004 with their no holds barred coverage of
Microsoft’s new one of a kind application layer
inspection firewall.While the ISA Server 2000
books were good, Configuring ISA Server 2004 is
even better. Tom and Deb bring their unique "insider’s
perspective" to provide you with information that isn’t
and won’t be available anywhere else! Order your copy of
Configuring ISA Server 2004 by clicking the link.
You’ll be glad you did.
Click
here to Order your
copy today
GFI WebMonitor for ISA Server 3 out now in BETA –
Includes content filtering & virus scanning
features!The latest version of GFI WebMonitor for ISA Server,
a utility for ISA server that allows for real time
monitoring of web sites being browsed by network users
and the files they are downloading, is now available in
BETA! Version 3, BETA now includes a real-time online
adult content filter, virus scanning and file
type blocking capabilities and byte transfer
stats per user/per site.Click
here to download the new and improved BETA
version!3. ISAserver.org Learning Zone Articles of
InterestWe have a great group of articles in the Learning Zone that
will help you get a handle on your most difficult
configuration issues. Here are just a few of the newer and
more interesting articles:- Publishing
an OWA Site in a Back to Back ISA Firewall Configuration
(Part 2) - Publishing
an OWA Site in a Back to Back ISA Firewall Configuration
(Part 1) - Product
Review: HP ProLiant DL320 - Redirecting
OWA Users to the Correct Directories and Protocols (Part 2)
- Redirecting
OWA Users to the Correct Directories and Protocols (Part 1)
v.1.1 - Troubleshooting
IPSec Tunnel Mode Scenarios - How
to Record URL and User Information in ISA 2004 Firewall Logs
and Reports
4. KB Articles of the Month
Here are some interesting and useful ISA Server related Q
articles posted by Microsoft in the last month:- You
cannot use Netstat to verify holes in ISA Server 2004 - FIX:
The "Maximum number of VPN clients allowed" value is reset
when you install ISA Server 2004 Enterprise Edition and join
the server to an existing array - The
Firewall service may not start in Internet Security and
Acceleration (ISA) Server 2004 after you select a
certificate for a, SSL listener - How
to create a detailed firewall policy report for any firewall
policy in Internet Security and Acceleration Server 2004 - RPC
data may be blocked, and Outlook may not start in Windows
Server 2003 with SP1 - Programs
and services on a Firewall Client computer may not be able
to access remote resources in ISA Server 2004 - FIX:
You cannot use a different SSL certificate for each array
member in an ISA Server 2004, Enterprise Edition-based
array - You
receive a "Setup failed while registering Wspadmin.dll"
error message when you try to install ISA Server 2004
5. Tip of the Month
You’ve created a very slick, very secure, and exquisitely
functional split DNS infrastructure. Users never need to
reconfigure any application depending on his location. The
user just opens his laptop, opens the Web browser, e-mail
client, or other network application, and it just works. You
know it works because you’ve deployed a split DNS
infrastructure.However, you’ve been having problems with your VPN clients.
They’re not resolving internal names correctly when connected
to the ISA firewall’s remote access VPN server. The problem is
a bug in Windows 2000 and Windows XP that prevents the RAS
adapter from being automatically placed on the top of the
adapter list. The KB article Cannot Change the Binding Order
for Remote Access Connections at http://support.microsoft.com/default.aspx?scid=kb;en-us;311218&Product=winxp
provides a workaround for this bug. HTH -TomGFI WebMonitor for ISA Server 3 out now in BETA –
Includes content filtering & virus scanning
features!The latest version of GFI WebMonitor for ISA Server,
a utility for ISA server that allows for real time
monitoring of web sites being browsed by network users
and the files they are downloading, is now available in
BETA! Version 3, BETA now includes a real-time online
adult content filter, virus scanning and file
type blocking capabilities and byte transfer
stats per user/per site.Click
here to download the new and improved BETA
version!6. ISA Firewall Links of the Month
Compare Offerings from ISA Hardware Firewall Vendors
http://www.microsoft.com/isaserver/hardware/vendorcomparison.mspx
Reasons why a Hardware ISA Firewall might be best for you
http://www.microsoft.com/isaserver/hardware/default.mspx
ISA Firewall Webinars on the NS Hardware ISA Firewall
http://www.networkengines.com/sol/Webinars.aspx
Collection of New ISA Firewall Tools for FREE
http://www.microsoft.com/isaserver/downloads/2004/default.mspx
Check out this new ISA Firewall Scripts site
Microsoft Releases a TON of new ISA Firewall
Troubleshooting Guideshttp://www.microsoft.com/isaserver/techinfo/guidance/2004/planning.mspx
SSL Capacity Planning for ISA Firewalls
http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/ssl_performance.mspx
7. Ask Dr. Tom
QUESTION: The guy that came in before me setup the
ISA firewall with a single NIC configuration and has
configured the clients to be Firewall and Web proxy clients of
the ISA firewall. I’m concerned that this isn’t a secure
configuration, since the clients are also configured to use a
simple stateful packet inspection "hardware" firewall as their
default gateway. What’s the best way to correct the security
issues with this firewall infrastructure?ANSWER: There are two major problems with this
deployment:- The single NIC ISA firewall configuration supports only
a tiny subset of the ISA firewall’s full firewall
functionality - A single NIC ISA firewall cannot perform reliable access
control
A single NIC ISA firewall is a hamstrung
ISA firewall that is at the mercy of any other firewall you
have on the network. If your main network firewall is a simple
stateful packet inspection firewall, you’re in for some
serious trouble. The following ISA firewall features are not
available in a single NIC ISA firewall configuration:- Multi-network firewall policy. In single network
adapter mode, ISA Server recognizes itself (the Local Host
network). Everything else is recognized as the Internal
network. There is no concept of an External network.
Microsoft Firewall service and application filters operate
only in the context of the Local Host network. (ISA Server
protects itself no matter what network template is applied.)
Because the Firewall service and application filters operate
in the context of the Local Host network, you can use access
rules to allow non-Web protocols to the ISA Server computer
itself. - Application layer inspection. Application level
filtering is not functional, except for the Web Proxy filter
(for HTTP, HTTPS, and FTP over HTTP). - Server publishing. Server publishing is not
supported. There is no separation of Internal and External
networks, so ISA Server cannot provide the network address
translation (NAT) functionality required in a server
publishing scenario. - Firewall clients. The Firewall Client application
handles requests from Winsock applications that use the
Firewall service. This service is not available in a single
network adapter environment. - SecureNAT clients. SecureNAT clients use ISA
Server as a router to the Internet, and SecureNAT client
requests are handled by the Firewall service. Because the
Firewall service is not available in a single network
adapter configuration, such requests are not supported. - Virtual private networking. Site-to-site virtual
private networks (VPNs) and remote access VPNs are not
supported in a single network adapter scenario.
A
single NIC ISA firewall also cannot perform reliable access
control. The reason for this is that the ISA firewall must
be in the request/response path in order to prevent users,
both internal and external, from compromising your network.
It’s a relatively simple affair to bypass a single NIC ISA
firewall to access resources that would have otherwise been
protected if the ISA firewall had been setup
correctly.For these reasons, and many more, we at
ISAServer.org consider the unihomed, single-NIC ISA firewall
to be a legacy configuration that is deprecated and should be
eschewed by all serious network and firewall
administrators.You can correct the current
configuration by putting a second NIC in the ISA firewall and
reconfiguring it in a back to back firewall configuration,
with the simple stateful packet inspection firewall in front
of the ISA firewall. Configure the ISA firewall’s external
interface to use the LAN interface of the simple stateful
packet inspection firewall as its default gateway.Got
a question for Dr. Tom? Send it to tshinder@isaserver.orgGFI WebMonitor for ISA Server 3 out now in BETA –
Includes content filtering & virus scanning
features!The latest version of GFI WebMonitor for ISA Server,
a utility for ISA server that allows for real time
monitoring of web sites being browsed by network users
and the files they are downloading, is now available in
BETA! Version 3, BETA now includes a real-time online
adult content filter, virus scanning and file
type blocking capabilities and byte transfer
stats per user/per site.Click
here to download the new and improved BETA
version!Visit the Subscription
Management section to unsubscribe.
ISAserver.org is in no way
affiliated with Microsoft Corp.
For sponsorship information,
contact us at advertising@isaserver.org.
Copyright
? ISAserver.org 2005. All rights reserved.
- How to Communicate Your Problems with the
-
Upgrading from the Trial Version to the Full Version of the 2004 ISA Firewall
From the Horse’s mouth (Jim Harrison):"Always perform a backup of your current configuration. Failure to do
so illustrates anything from blind faith to outright hubris. Luckily,
ISA 2004 makes this really simple. Once you’ve finished the policy
backup, you can simply install the RTM version over the existing trial.
Odds are, you won’t even need the backup."‘nuf said.
HTH,
Thomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
The ISA Firewall’s Incredible VPN Server
Not too long ago I
wrote a two part series on the ISA firewall’s incredible, one of a kind, VPN
server and gateway. If you didn’t see it, check it out at:andWhat I was trying
to communicate in that article series is that the ISA firewall’s VPN server and
gateway enables you to perform fine-tuned user/group based access control over
VPN client access to resources on the corporate network and on the
Internet.So, it came as
some surprize to me when someone what asking:"This
looks pretty good, but don’t I need the Firewall Client in order to authenticate
and get that strong user/group based access control and
logging?"I guess I used too
many words and the message I was trying to communicate got lost in the flurry of
words I used to demonstrate the unique level of security the ISA firewall’s VPN
server provides. Because if I were more effective at communicating what I was
trying to say, it would be clear that you do NOT need to use the
Firewall client to perform strong user/group based access controls on VPN
clients.The reason for
this is that the VPN connection is always authenticated before it is
established. The ISA firewall then uses the user credentails from the log on.
This allows the ISA firewall to apply per user policies on VPN client
connections in the same way that the Firewall client enables you strong
user/group based access controls on outbound connections through the ISA
firewall. The clients on the internal networks use the Firewall client to
authenticate with the ISA firewall, and the VPN clients authenticate with the
ISA firewall during VPN connection establishment.I hope this clears
up any misunderstandings and provides more ammo in your attempts to make your
ISA firewall the preferred VPN server and gateway platform on your corporate
network.Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Detailed Logging of Firewall Client Installation
I seen a few posts
over the years from people having problems with installing the Firewall client.
I’ve never experienced one of these Firewall client installation problems, so I
never had much to contribute in terms of a solution. In fact, I didn’t even know
where to start troubleshooting the problem.Jim Harrison comes
to the plate again with a hot tip that will at least get us out of the starting
gate! Here’s what he has to say about Firewall client
logging:"Since the
FWC installs via an MSI, you can get some really detailed logging from the
install process. Re-run your installation as:
Msiexec /l*v:c:\fwc_i.log
/i:fullpathtofwc.msiYou’ll get
a bit more detail that may help you sort out this
error."As always, thanks
Jim!Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
VPNs and Slow Network Browsing? The VPN Kit Comes to the Rescue
You can find the
VPN Deployment Kit for the 2004 ISA firewall at:You should also
check out the Deployment Kit for the 2000 ISA firewall. It contains a ton of
information you won’t find anywhere else on the Web and is the most
comprehensive coverage of ISA VPN configuration on the Web:HTH,Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
OT: Best way to Help New Orleans Hurricane Victims
Hey
folks,Just a quick note
on what I think is the best way to help the New Orleans Hurricane victims. From
my long expereince with charitable organizations, I can say that one stands head
and shoulders above all others, and that’s the Salvation Army.
The men and women
in the Salvation Army are heads-down, in the ditches, get their
hands dirty, warriors against the forces of disaster and human misery. They
don’t waste money on the cocktail party circuit and the money you give them
won’t go to swank cocktail parties, first class airline fair, or three martini
lunches. Your money will feed, clothe, and comfort people who
really need it now.For ways you can
give.Thanks!Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
How One Man Changed the Service Account for CSS
I knew out of the
starting gate that using ADAM for configuration storage was going to introduce
quite a bit of pain, because firewall admins tend not to be Directory Services
admins. The following account from Andre, what sought to change the account used
for CSS provides a glimpse into the issue:adenhaan
Junior
Member
Member # 31587
posted
September 04, 2005 02:40 PM
Initially I had
installed the ISA 2004 Configuration Storage Server on my Domain
controllers, using the administrator account.
Now while trying to
tighten up security, I want to get rid of any service running under the
administrator account,
hence I began on a quest to change the
credentials for the ISASTGCTRL service, and I want to share my findings
here,
as documentation is hard to find on this.The ISA 2004
Enterprise Edition help contains the following phrase :quote:
In most scenarios,
the Configuration Storage server service runs under the Network Service
account.
However, when you install the ISA Server Configuration
Storage server on a domain controller,
you must specify a different
account under which the Configuration Storage server service will
run.
This is because the Network Service account cannot be used when
the Configuration Storage server runs on a domain controller.
I have my
Configuration Storage Server running on a domain controller,
and
eventhough things seemed to work just fine if I changed the account for
the ISASTGCTRL service to the local system account,
I wanted to give
it a try and create a domain account – with minimal rights – to be used
for running the ISA Configuration Storage service.Step
1:From ADAM helpfile:
quote:
To enable a
workstation or domain user account as a service account,
you must
grant the Log on as a service right to the account that is used as the
ADAM service account.
So create
a domain account (example: Domain\ISAService) in AD, and assign it the
rights to run as a service on domain controllers –
where my
configuration storage server(s) are – using Default Domain Controller
Security Policy snapin :
Add user Domain\ISAService to "Logon as a
Service"Using computer management, Services plugin, change the
logon account for ISASTGCTL to ISAService, and restart the service…
You will get the following messages in eventlog:code:
Event Type: Warning
Event Source: ADAM [ISASTGCTRL] General
Event Category: Service Control
Event ID: 2538
User: N/A
Computer: DOMAINCONTROLLER1
Description:
The directory server has detected that the service account used to run this service
has been changed.
This directory server may experience problems starting up.
Additional Data
Old service account:
DOMAINNAME\Administrator
New service account:
DOMAINNAME\ISAService
User Action
If service is experiencing problems starting up, verify that the new service account
has full control over the database folder(s), full control over the service registry key,
and that the VSSAccessControl registry key is updated appropriately.
Now this
is actually a usefull message, as it is pointing to fix the followingStep2 add ISAService account to VSSAccessControl
In
registry editor go to the following
key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControlAdd
a REG_DWORD, with the name of the account (Domain\ISAService), and a
value(data) of 1Step 3: Give ISAService account rights on
Registry
keyHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ADAM_ISASTGCTRL
Using
regedit, rightclick this Key, and select permissions. Add
DOMAIN\ISAService account with full permissions.code:
Event Type: Warning
Event Source: ADAM [ISASTGCTRL] General
Event Category: Security
Event ID: 2521
User: N/A
Computer: DOMAINCONTROLLER1
Description:
Active Directory was unable to initialize auditing security system.
It will run with auditing disabled. No security audits will be generated.
Additional Data:
Error value:
1314 A required privilege is not held by the client.
Step
4: Assign "Generate security audits" privilege to ISAService
account.To fix the warning message 2521, with a little help from
ADAM helpfile:To enable auditing for an ADAM instance running
under a service account other than the Network Service account,
you
must grant the Generate security audits right to the account that is used
as the ADAM service account.Use "Default Domain Controller
Security Policy" snapin : Add user Domain\ISAService to "Generate security
audits" item.code:
Event Type: Error
Event Source: ADAM [ISASTGCTRL] General
Event Category: Internal Processing
Event ID: 1003
User: N/A
Computer: DOMAINCONTROLLER1
Description:
Active Directory could not be initialized.
The directory service cannot recover from this error.
User Action
Restore the local directory service from backup media.
Additional Data
Error value:
-1032 JET_errFileAccessDenied, Cannot access file, the file is locked or in use
Step
5: Account needs full rights to ADAMData directoryMake sure
that this new account has full rights on the Directory where ADAM files
are stored
(Example: C:\Program Files\Microsoft ISA Server\ADAMdata)Note : This directory does NOT inherit permissions from higher
levels, so assigning rights
to the complete drive or program files
directory will not work.Now If you start the ISASTGCTRL service
again, using the ISAService account, the following shows up in
eventlog:code:
Event Type: Error
Event Source: ADAM [ISASTGCTRL] General
Event Category: Internal Processing
Event ID: 2536
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: DOMAINCONTROLLER1
Description:
The directory server has failed to update the ADAM serviceConnectionPoint object
in the Active Directory. This operation will be retried.
Additional Data
SCP object DN:
CN={401d891c-d654-454b-9f93-d744cb082bb6},CN=DOMAINCONTROLLER1,OU=Domain Controllers,
DC=domainname,DC=com
Error value:
5 Access is denied.
Server error:
00002098: SecErr: DSID-03150A45, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
Internal ID:
339038f
ADAM service account:
DOMAINNAME\ISAService
User Action
If ADAM is running under a local service account, it will be unable to update the data in the
Active Directory. Consider changing the ADAM service account to either NetworkService or a
domain account.
If ADAM is running under a domain user account, make sure this account has sufficient rights
to update the serviceConnectionPoint object.
ServiceConnectionPoint object publication can be disabled for this instance by setting
msDS-DisableForInstances attribute on the SCP publication configuration object.
Step
6:To fix this, go into ADSI Edit and you will find a CN={GUID}
under your domain controllers.
Right click it to go into properties,
and on the security tab assign the ISAService account full rights to this
object .Unfortunately we’re not there yet….
The array
members now have difficulty connecting to the configuration server as you
will see in Monitoring Alerts,
and the following error in eventlog on
the array members:code:
Event Type: Warning
Event Source: Microsoft ISA Server Control
Event Category: None
Event ID: 21238
User: N/A
Computer: ARRAYMEMBER1
Description:
ISA Server cannot connect to the Configuration Storage server domaincontroller1.domainname.com
for one of the following reasons:
- The Configuration Storage server is not available.
- General networking or authentication issues.
- A policy misconfiguration on the array.
For information on resolving these issues, see
"Troubleshooting installation and connectivity" in the ISA Server help or
http://go.microsoft.com/fwlink/?LinkId=37487.
--------------------------
Event Type: Error
Event Source: Kerberos
Event Category: None
Event ID: 4
User: N/A
Computer: ARRAYMEMBER1
Description:
The kerberos client received a KRB_AP_ERR_MODIFIED error from the server
host/DOMAINCONTROLLER1.DOMAIN.COM.
The target name used was ldap/DOMAINCONTROLLER1.DOMAIN.COM:2171.
This indicates that the password used to encrypt the kerberos service ticket is different than
that on the target server. Commonly, this is due to identically named machine accounts in the
target realm (DOMAIN.COM), and the client realm.
Please contact your system administrator.
Step
7:At this time I was pulling my hair out… trying to reboot
the servers, with no resolution.
It turned out that in the process, a
batchfile was created on the domaincontroller, as described in the chapter
"Administring Service Principal Names" in the ADAM
helpfile:quote:
To register SPNs for
ADAM manually in Active Directory, use the dnsdomainname.bat script
file
that ADAM setup creates in the data directory of the ADAM
instance (Program Files\Microsoft ADAM\instancename\data),
where
dnsdomainname represents the name of the DNS domain in which the ADAM
instance resides.
Running
this batchfile did the trick, Members can connect to storage server and
all that was left is to execute steps 2,3,5, 7
on the other
Domaincontroller(s) that contain a replica configuration storage
server.Phew… was a rocky ride, hope this info will help-out the
next person that wants to do this.G’luck, Andre.
[
September 04, 2005, 03:26 PM: Message edited by: adenhaan ]
Posts: 4 |
Registered: Jul 2005 | IP: Logged
MORAL OF THE
STORY:Nothing is easy,
and nothing is fast, esp. when it comes to dealing with ISE EE and
ADAM.Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
OT: Red Cross Needs Sysadmin Volunteers
The Red Cross needs volunteers with system
administration, network engineering and information security (infosec) expertise
to assist in the design and implementation of a network of Internet kiosks.
These kiosks will be deployed to all of the Red Cross shelters to be used be
people displaced by the hurricane and flooding to report that they are alive and
to try to contact others.Check out http://isc.sans.org/diary.php?date=2005-09-04 for
more info.Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Blacklists for ISA Firewalls
Hey folks, here’s
some GREAT News! One of the pieces they left out of the ISA SE and EE software
is the ability to easily import hundreds or thousands of site addresses
for blacklisting. Sure, you can cipher out a script and hope you get it right
and that it doesn’t hork your configuration (I’ve always wondered by MS gets hot
under the collar regarding Registry Edits, but ignores the mortal dangers of
using scripts?).Many thanks to
Maciej Rusinek for his hard work on this project. Check it out
Blacklists 2004 application at:HTH,Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
ISA Pet Peeve #3698745 Redux
Jim Harrison ups the ante on the common ISA firewall malspeak "ISA client":<peeve type="pet">
"ISA clients" is a misnomer – this is more accurately referred to as "ISA client request type", since any given ISA client can act as any
combination of the three, depending on how the client host is configured.
</peeve>Say no more…HTH,Thomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
GREAT White Paper on ISA Firewall Protection for Exchange Servers
Unless you?ve been living under a rock for the last
two years, you know that if you have an Exchange Server, you?d be nuts
not to use an ISA firewall to protect it from Internet intruders. While there?s
a ton of great ISA firewall for Exchange docs out on both http://www.isaserver.org and http://www.microsoft.com/isaserver, Steven
Hope steps up to the plate with an exceptional effort. Steven has included a
wealth of information in this document, much of which was undocumented. He also
includes a great overview of the SMTP protocol verbs, with guidance on how and
when to use them with the ISA firewall?s SMTP application layer
inspection filter.Check out Steve?s doc Application Layer Firewall protection for Exchange Server 2003 with ISA
Server 2004 at http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/firewall-exchange2003.mspxHTH,
Tom
-
Possible Fix for Site to Site VPN Timeouts and Failed Reconnection Attempts
I see a few posts every week on problems with site to site VPN connections timing out when there is a short disruption in Internet connectivity or link disruption between the local and remote VPN termination points. One way you might be able to fix this is to change the default TCP and non-TCP timeout interval, which is 60 seconds by default.
Some people have had success with fixing the problem by increasing this timeout interval to something longer. You can do this by going to the following Registry Key:
HKeyLocalMachine\SYSTEM\CurrentControlSet\Services\Fweng\Parameters
Then add a new Reg_Dword Value: ConnectionTimeout
Add the number of seconds.
Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000002
HTH,
Tom
-
Publish SharePoint Portal Server (SPS) the RIGHT Way
I often see questions from people who have problems with posting Word and other Office docs to their SPS sites after publishing them using an ISA firewall Web Publishing Rule. I?ve been meaning to test this from a location for quite a while, but never got around to it, and I use my SPS server for maintaining lists and accessing the library. Well, I finally got around to testing it during this week during my latest trip to the mother ship. I created a new Word 2003 doc and then tried to save it to my personal workspace. It worked with no problems at all. In fact, the experience was the same as it is when I?m on the Internal network.
So, we know it works and it works nicely. What I don?t know is why it isn?t working for these other folks, since I?ve never received the details of their configuration. However, if you want to make it work like mine, and have it work every time, just follow these simple ISA firewall best practices:
1. Use the same domain name for internal and external access
2. Create your split DNS infrastructure to support using the same domain name for internal and external access
3. Use symmetric bridging (SSL to SSL or HTTP to HTTP) ? props to Jim Harrison for sharing this elegant term with me.
If you follow those three ISA firewall best practices, your SPS deploying will work right the first time every time.
Discuss this post at:
http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000002
HTH,
Tom
+the+RIGHT+Way&referrer=)
-
Webcast on using ISA Firewalls and Antigen to Secure Exchange Servers
I’ve said it over and again, but its still worth repeating: you need an ISA firewall to provide secure remote access to your Exchange Servers. As Mr. T so eloquently stated "I pity the fool who doesn’t use an ISA firewall to protect his Exchange Server organization".A new playing in the ISA firewall protection for Exchange scene is Antigen. Microsoft recently aquired Antigen and the Antigen team is as sharp as tacks! Check out this week’s Webcast on Secure Your Exchange Server with Antigen and ISA firewalls. You can register for the Webcast at:http://msevents.microsoft.com/cui/WebCastEventDetails.aspx?EventID=1032280058&EventCategory=4&culture=en-US&CountryCode=USHTH,Thomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
OWA Web Publishing Article Updated
Microsoft has updated their walkthough on publishing Outlook Web Access (OWA) sites using ISA firewalls.This update includes key information on configuring the HTTP Security Filter for Outlook Mobile Access and Exchange ActiveSync. This is a nice walkthough (even though they forgot to add screen shots, I guess I’ll need to rip this article and include a screenshot version on http://www.isaserver.org) and it provides even more evidence that "he who is with an Exchange Server, but without an ISA firewall, is lost".Check out the Outlook Web Access Walk-though for ISA 2004 at:HTH,Thomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
ISA Firewall Dinner Party Fast Fact – NLB and ISA EE
Did you know that NLB is limited to 16 interfaces?This means that ISA firewalls (Enterprise Edition) are limited to 16 physically attached networks that can be load balanced.HTH,Thomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
The World is not Flat, the Moon isn’t Made of Green Cheese, and There is no Santa Claus
OK, now that I have your attention, I want you to reflect on these observations. Indeed, at one time many thought the world was flat and long treatises were written on this fact. Not as many believed the Moon was made of green cheese. However, just about all of us believed there was a Santa Claus.What does all this have to do with ISA firewalls? It has to do with the fourth fairy tale:FAIRY TALE: "ISA firewalls on the edge should not be domain members"Yes, you got it, and you got it right. Reports of workgroup based ISA firewall as being more secure are premature and incorrect.ISA firewalls can and often should be domain members. In spite of the fact that many pointy haired highschool graduates with clipboards acting as compliance managers tell you that ISA firewalls should not be domain members, the fact is that they’re living in a flat world, eating green Moon cheese and waiting for Santa Claus to give them a sleek new Stingray bike.Those of us living in the world of facts and figures understand that domain member ISA firewalls end up being more secure, more manageable, and more flexible than the dreaded workgroup configuration ISA firewall.Don’t fall into the echo chamber of the canaille. Those guys who phantasmgorically believe that workgroup ISA firewalls represent the most secure configuration are still working on the classic animal husbandry problem of "which end eats".Don’t be like them — be like us. We know which end eats.HTH,Thomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Bogus Reasoning of the Week
I’ve always been interested in the "echo chamber" effect when it comes to technical and scientific issues. You know how it goes. Someone does a study that gets reported in some obscure journal, then that guy’s buddy writes a textbook that quotes the article as a source, then other textbooks get written that quote what this textbook said, accepting on faith that the original source was valid. Finally, some enterprising undergraduate student years later checks the original journal article and finds that its full of holes and the entire chain of reasoning based on the flawed article and developed over the decades in textbooks falls apart.I thought of this today when I read this quote in a article regarding the placement of front-end Exchange Servers in perimeter networks. The original article can be found at: http://www.msexchange.org/tutorials/Dual-Pass-Through-Authentication-Exchange-2003-Front-EndBack-End.htmlThe relevant quote is:Note:
It?s not recommended to place your FE Servers on a perimeter network; you should instead place any it on the internal network, and if possible publish the required Exchange services trough an ISA Server located on the perimeter network. In the past, it was popular to place the FE server on the perimeter network, and then open all required ports in the intranet firewall. Since the FE server needed to be able to communicate with both the Exchange BE servers as well as Global Catalog servers on the internal network, quite a few ports needed to be allowed through. I know an alternative is to configure IPSec, but this solution is a bit complex. Even though you may not have an ISA Server in your organization, you still should place the FE server on the internal network, and then open the required ports on the intranet firewall.What’s up with this? Just because the handful of ports required for intradomain communcations is open does not vitiate the validity of creating a authenticated access DMZ where the front-end Exchange Server should be published. Last time I looked, there are over 65,000 ports available, and to make a blanket statement that you shouldn’t leverage the ISA firewall’s superior security architecture to enhance security is misguided at best, and incompetent at worst.Since I know the author is not incompetent, I suspect he is a victim of the Exchange product group’s (and maybe the ISA PG’s?) echo chamber. There are docs on the ms.com site foisting this illogic on busy, harried and sometimes hapless Exchange admins. This is a heads-up. Don’t let the echo chamber effect wrest your logic from you!I’ve completed to comprehensive series of documents on the value of putting the front-end Exchange Server in a authenticated DMZ segment and have included detailed, step by steps with screenshots on how to create the configuration. Stay tuned to http://www.isaserver.org for these article series.Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000004HTH,Thomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Urinary Tract Infections and Cisco
In a former life I
had to do things like count the number of white blood cells (WBCs) in a
patient’s urine as part of workup for UTI (urinary tract infection). There were
often times when there were so many WBCs in the patients urine that I gave up
counting the number of cells and put in my notes "TNC". TNC means "too numerous
to count".There are a lot of
reasons to dislike Cisco. In fact, the the reasons are TNC. But if I had to pick
one, its their recent unrequited attempt to squash Michael Lynn’s presentation
on a major security exploit (just one of the many, many security issues with
Cisco products, which never seem to get the grand attention that MS security
issues get).Take a gander at
this video showing Cisco employees in their true form:Many thanks to
Sunbelt Software’s W2knews (http://www.w2knews.com) for the heads up on this
videoThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
test
testThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
ISA Firewalls Reach EAL4+ Security Rating
From the Blog of Steve Lamb at:
http://blogs.technet.com/steve_lamb/archive/2005/10/03/411873.aspx=====================================
"The wait has been long as those of you who are familiar with the time
it
takes to achieve EAL4 approval will understand.Common Criteria is an assessment/approval programme for the security
capability of software products as agreed by many governments around theworld (at least fifteen countries including the USA, UK, and Germany).
The levels range from 1 (least comprehensive) to 7 (most comprehensive).EAL 4 is the highest mutually recognised level – above this each
government customer takes their own approach. I gather that most EAL 6
and 7 systems are in orbit – that somewhat reduces their attack surface!The assessment was carried out by an independent testing laboratory
known as a CLEF – there’s debate as to the meaning of the "L" in the
acronym (according to the two UK CLEF Managers!) the rest stands for
Commercial Evaluation Facility.Few Firewalls have EAL4 certificates and those that do often require
specific hardware appliances to comply. Many Government customers
(defence being a good example) often mandate EAL4 compliance for any
network edge security software. Be aware that whilst EAL4 is a good
indicate of the quality of the software the CONFIGURATION/IMPLEMENTATIONBY YOU/YOUR SUPPLIER must match the requirements of your security policy
to have benefit.
ISA Standard Edition has EAL4+ which means that it was evaluated for at
least one higher level assurance requirement – in this case we added
"Flaw remediation" to the assessment criteria as welll as deeper
independent vulnerability assessment (AVA_VLA 3 instead of the required
AVA_VLA 2).A complete list of Common Criteria evaluated products can be found by
clicking here
<http://www.commoncriteriaportal.org/public/consumer/index.php?menu=4>The certification will be mentioned on Germany’s BSI site following
their next update. It will be listed here
<http://www.bsi.bund.de/zertifiz/zert/aktuelle.htm>.One last point – when assessing the value of a product’s Common Criteria
certification inquire about the "target of evaluation" – this is a
definition of the functions and features to be assessed – some products
only go for assessment of a small subset of features."================================
This should come as no surprize to ISA firewall admins. We know that the
ISA firewall provide a superior level of protection, not only for
Microsoft services, but for all services on the corporate network. And
while I doubt the used the ISA firewall in its most secure configuration
for testing, its great to get this imprimatur of security from a third
party organization. Follow my best security practices listed throughout
http://www.isaserver.org and you’ll easily surpass the security in the tested
configuration.HTH,
Tom
-
Quick Network Performance Tips from Jim Harrison
A couple of nice
tips from Jim Harrison come down the pike today:============================It may have gone overlooked in the
general melee of postings, but I had posted these before and thought them worth
reiterating?Tired of the ISA sending
NetBT broadcasts when DNS lookups fail?This setting:
HKLM\SystemCurrentControlSet\Services\NetBT\Parameters
NodeType, DWORD, 0x2..will cure that.
By setting this to a value of 2,
You?re telling Windows to limit its name lookup efforts to defined DNS and WINS
servers.As a result, Windows will no longer
wait for NetBT broadcasts to fail before reporting a name lookup
failure.Can you say ?faster lookup responses
and therefore faster connections (or failures)?, boys and
girls?(TOM’s NOTE: The above setting configures the
ISA Firewall’s NetBIOS Node Type. The suggested Node type is Peer Node or "P
node". Peer Node NetBIOS nodes use name resolution servers only and do not
failover to NetBIOS broadcasts for name resolution.)– MS05-019 fixed an ICMP MTU
vulnerability that existed in Windows.Because the ISA team was aware of
this issue before ISA 2004 shipped, they opted to give you a ?safe by default?
configuration since they had no idea if or when the Windows issue might be
fixed.Unfortunately, it also has the
unfortunate side effect of limiting Windows to 576-byte packets on all
interfaces, reducing network efficiencyThis setting:
HKLM\SystemCurrentControlSet\Services\Tcpip\Parameters
EnablePMTUDiscovery, DWORD, 0x0..is what the ISA installer
creates.This setting:
HKLM\SystemCurrentControlSet\Services\Tcpip\Parameters
EnablePMTUDiscovery, DWORD, 0x1..is what will remove this
protection (or you can delete the ?EnablePMTUDiscovery? value).(TOM’S NOTE: Small MTU values can cause
performance issues. If you find that you’re not getting the bandwidth you
expect, then try increasing the MTU value).Both settings require a machine
reboot to take effect.Both settings will clean up your
network traffic a bit.============================HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Microsoft Site for ISA 2004 Firewall EAL4+ Certification
Here’s the link for the real deal. Nice tool for checking your ISA CD integrity too!HTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
More Secrets from the Belly of the Bisque
Wisdom from Jim
Harrison regarding SecureNAT sessions in the ISA Firewall
Console:A
SecureNAT session is not necessarily the same as SecureNAT clients. Application filter actions will create "SecureNAT" mappings because
ISA is actually making the connections to
the upstream server.The correct math is:
SecureNAT client sessions == (Firewall sessions +
Web Proxy sessions) –SecureNAT
MappingsHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Mystery of the Empty Cache(dir)
It came up today on
the ISAserver.org mailing list that its possible to have cached content and it
not appear in Cachedir.exe.Why?Jim Harrison reminds
us that the Cachedir.exe utility only reads what’s in the disk cache, and that
you need to restart the firewall service on the ISA firewall to get it flushed.
Of course, there’s stuff in the in memory cache that might time out before you
get a chance to flush.If you want to find
out what’s actually cached and need to troubleshoot a specific site, then the
take home message is that NetMon is ALWAYS your best friend.HTH,Tom—
Internal Virus Database is out-of-date.
Checked by AVG Anti-Virus.
Version: 7.0.344 / Virus Database: 267.11.0/103 – Release Date: 9/15/2005
&referrer=)
-
Open Console Sessions from the Command Line
My preferred
method of managing the ISA firewall is from a remote RDP console session. The
problem is that something in the terminal services component whacks out and says
I need a license server for remote desktop admin connections to the ISA
firewall. I don’t think so. However, exhautive searches on this issue fail to
comes up with an answer on why this happens.You can get around
this problem by using a console session rather than a typical remote desktop
client connection. For example, at the Run command
enter:mstsc
/w:1024 /h:768 /console /v:amysbox:1234The
/w: sets the width, the /h: sets the height,
and the /v: sets the IP address or name, with an alternate port
if you’re using an alternate port for the RDP listener on the ISA
firewall.HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Preventing Disconnects from Published RDP Servers
I see more than my share of complaints over users being disconnected from published RDP servers after X period of time. The ISA firewall, being the "sin eater" (http://96.1911encyclopedia.org/S/SI/SIN_EATER.htm) of the network world, isn’t the problem. In fact, from my own experience, 99% of the time a network issue is attributed to an ISA problem, its actually a problem with a horked client application or another network problem not related to ISA.You can fix these disconnections to the RDP server by creating a Registry entry to support TCP keep-alives. Now when your users camp out on the line, they won’t complain to you that they were disconnected:You can enable the TCP keep-alives by opening the Registry on your published terminate server and navigating to HKEY_LOCAL_MACHINE\ SYSTEM\CurrentControlSet\Control\Terminal Server. Create a new key called KeepAliveEnable with a DWORD value of 1.HTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Possibile Explanation for Some SSL Connection Problems
Listened to an
interesting Podcast from the PSS boys over at:They mentioned
some interesting issues with the ISA firewall’s Connection Limits feature. They
said PSS has received a good number of calls on client unresponsiveness,
especially when connecting to SSL sites. This is interesting, because SSL
clients need to create a lot of connections to the Web server, so this *might*
be a reason for this finding. However, with a Connection Limit of 160, its hard
to believe that the average SSL visit would hit the wall. However, if things
made sense, we wouldn’t need PSS 🙂If you’re running
into strange SSL slowness issues, try disabling Connection Limits and bounce the
Firewall service and see what happens.The PSS crew also
mentioned that you shouldn’t run the Firewall client on the ISA firewall. But
you already knew that because you read the book.HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
ISA Firewalls Often Blamed for Windows XP SP2 “Improvements”
As a follow up
from the Connection Limits mentioned earlier today, I should mention that
there’s another connection limit issue that often gets blamed on the ISA
firewall, but has nothing to do with the ISA firewall. This is a TCP connection
limit imposed on Windows XP Service Pack 2 clients. This is a truly annoying
feature, almost on par with the Windows XP Service Pack 2 breakage of L2TP/IPSec
NAT traversal. At least the Windows XP PG came up with a Registry hack that
allows you to fix the Service Pack 2 bug that breaks NAT-T.Unfortunately, if
you find that you’re Windows XP Service Pack 2 client is not connecting as
quickly or reliably as it should, hold your horses and put blaming the ISA
firewall on the bottom of your blame list (this is a good general principle,
since the ISA firewall, unless misconfigured, probably isn’t the problem).
Instead, you’ll need to get a third party tool to fix this
problem.Download the TCP
Connection Limit hork fix tool at:HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
OT: For Former Screen Savers Fans
As Screen Savers
fans know, G4 bought TechTV and killed the Screen Savers show. The show was
dying anyhow, because you could tell over time that the bimbo factor was taking
over and the tech was circling the drain.The good news is
that there is a GREAT show now available for download or streaming. The show’s
name is Digital Life TV and you can find it at http://www.digitallifetv.com.
Lots of good
hardware lessons and the reviews rock. Two fat thumbs up for this show. Check it
out.HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
New article posted on ISA firewall DMZ Perimeter Service Design
There’s been a lot
of tripe published in the last year regarding the imminent (if not immanent)
demise of the DMZ. If your gut told you that maybe these authors are trying to
grab headlines, among other things, then trust your gut. The DMZ isn’t dead, its
alive and well and becoming more important with each passing
day.What you need to
understand is that the concept of the DMZ is changing. A DMZ is no
longer the "party down" network segment where unauthenticated users from the
Internet have unlimited opportunities to investigate exploits in your published
services. Now a DMZ is defined as a security zone, and each
security zone has an edge where you need a device, like an ISA
firewall, to perform access controls.Learn more about
network security zones and how to protect them using ISA firewalls over
at:Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
ISA firewall pet peeve #36639889: The ISA Firewall is a Network Firewall – NOT a Firewall “Server”
One thing that drives me crazy, which shouldn’t drive me crazy, is when people call the ISA firewall ISA Server. Now, this is a pretty strange thing to have driving me crazy, since ISA Server is the actual name of the product.The truth is, its not the name of the product that drives me to my wits end — its what the name does to normally rationale people when the deploy the ISA firewall product. They figure since its ISA Server, then its OK to make the ISA firewall a file server, Web server, FTP server, Exchange Server, SharePoint Server and even an eDonkey server.People think that since "Server" is in the name of the product, it stands to reason that we should using the ISA firewall as just one other server service to make part of the server consolidation plan.If I were the marketing boss over at MS, I would try to bend Heaven and Earth to obliterate Server completely from the name of the product. Can it be done? You bet! How about MOM? MOM is Microsoft Operations Manager. I don’t know of anyone who calls it "Microsoft Operations Manager Server".So, as the imaginary boss of the ISA firewall maketing team, I would change the product name to Microsoft ISA Firewall. This allows us to keep the ISA brand name, removes the egregious and self-defeating (from a security standpoint) impression that firewalls are anything but a single purpose network security device, and reinforce the Firewall aspect of the ISA firewall product.Some ABM security wankers might come back at me at say "but it is a server, running on the Windows Server platform". I’d say "so what, Cisco refers to the PIX product as a firewall server too, for example, check out http://www.cisco.com/en/US/products/sw/secursw/ps2120/prod_release_note09186a008008cff8.html".More later,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Hiding the Firewall Client Icon
I’ll never
understand some users. They get themselves out of bed in the morning, they can
read menus and order breakfast, they can dress themselves, operate complex heavy
machinary live SUVs, use MP3 players, fill out income tax forms and file them,
and even count to ten without having to resort to using their fingers or a
calculator.Given this
objective evidence that users are sentient beings, what I don’t understand is
why users should not have access to the Firewall client icon in the system tray.
I consider it vitally important that users have access to this icon, since they
will need to enable and disable at times to get things working. If you take it
away from them, then they’ll call you at a moment’s notice and never be able to
fix the problem themselves.However, you might
work in a building that has lead paint, or perhaps your company is near an area
where there was a nuclear power plant accident, conditions that might lead
to your users not being as high on the food chain as they might otherwise
be. In that case, you might want to hide the Firewall client icon from
them.How?Create a software
restriction policy for the executable that is launched from the Firewall Client
icon (%ProgramFiles%\Microsoft Firewall Client
2004\FwcMgmt.exe). That all there is to it!HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Automatically Backing Up the Firewall Config
I see a lot of
requests for backing up the ISA firewall configuration. At first I thought this
was a marginal idea, because I’ve made it a habit of backing up my config each
time I make a change, so I always have delta backups available. However, I do
understand how the underpaid, overworked, and multitasking firewall
administrator can forget to make a backup and that could leave him in a
lurch.The good news is
that an ISAserver.org member has come to the plate with a configuration backup
script! You’ll need to schuedule it, but the script does the
rest.Check it out
at:HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Interesting VPN Quarantine Issue Solved
While not many people are using the VPN Quarantine feature that is part of the ISA firewall’s feature set (something we expect to change radically in a few months), Chrigi from Switzerland points out an interesting issue when the VPN client has the Firewall client installed and how this intereferes with the remote access VPN client’s notifier from communicating with the ISA firewall’s rqs.exe listener.chrigi-ch
Junior Member
Member # 30615 posted October 12, 2005 03:11 AM
Hey and helloafter 3 month working with the Microsoft Hotline on that issue, here is the description and the solution:
If you are using the RQC and RQS Quarantine control from Microsoft, there is an issue which stopps the quarantine from correct function.
The "old/2000" ISA had the LAT to control who is internal an who external. So, if a user was dialing in via VPN from external the Firewall Client was disabled.
If a user is dialing into the ISA2004 via VPN the Firewall Client tries to connect to the ISA-Server.
As soon as the FWC sees the ISA, it will be activated. Now here comes the problem into the game. The RQC and RQS application will communicate on port 7250 (default) but the FWC will redirect the traffic to the own used port 1745. So the feedback to the RQS will fail because the answer comes on 1745 instead on 7250.
The solution is very easy:
Use the ISA2004 GUI:
Configuration –> General –> Define Firewall Client Settings –> Application settings –> New –> Application –> type "rqc" / key "disable" / value "1".
This will prefent the Firewall Client from starting when the application rqc is running on the client to communicate with the Quarantine control on the ISA.I hope this will help others from getting mad on this issue
Chrigi-CH
Posts: 21 | From: Zurich/Switzerland | Registered: Jun 2005 | IP: LoggedDiscuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000005HTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Publish RCP over HTTP (RPC/HTTP) using an Alernate Port
Libor from Prague in the Czech Republic has come up with a method of publishing the RPC/HTTP proxy.<Libor>
unregistered posted October 05, 2005 11:46 AM
There are many step-by-step guides on publishing an Exchange server for RPC over HTTPS on standard SSL port (443). I have, however, found none on configuring this on an alternate SSL port. I was asked whether this kind of publishing is possible, tested it and found it working. To make it even more interesting and useful I configured it with the listener available for forms-based authentication. If interested, check http://isaserver.webpark.cz/altrpcoverhttps/ for detailed description.
Should you have any comments or questions, please let me know here.Greetings
Libor, Prague, Czech Republic
IP: LoggedDiscuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000005HTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls+using+an+Alernate+Port&referrer=)
-
Network Engines and Matrixforce Deploy NS6400 at Perry Schools
Press Release Source: Network Engines, Inc. Network Engines and Matrixforce Deploy NS6400 at Perry
Schools
Tuesday October 18, 10:18 am ETNew Solution Updates
Security Framework and Enables Parents Secure Access to Children’s School
RecordsCANTON, Mass.–(BUSINESS WIRE)–Oct. 18, 2005– Network Engines,
Inc. (NASDAQ-NENG), a leading OEM appliance partner for Microsoft security
solutions, and Matrixforce, a leading Microsoft Gold Certified Solution Partner,
today announced the successful deployment of an NS6400 security appliance with
Surf Control’s web filtering solution at Perry Public Schools.Perry Public Schools, based in Perry, Oklahoma, serves 1,200 K-12 students in
a community of 6,000. In an effort to update the school’s network security,
content filtering, and also create a solution to securely extend student records
to parents online, technology director Joel Hall engaged Oklahoma-based
Matrixforce earlier this year to assess the school’s systems and recommend
enhancements.Matrixforce quickly determined that Perry Schools needed Microsoft ISA Server
2004 and a new web filtering solution to replace its aging security software.
After reviewing several alternatives, Hall and Matrixforce chose the Network
Engines NS6400 security appliance, a hardened device powered by ISA Server 2004,
which is available with Surf Control Web Filtering pre-loaded."As the school’s only network administrator, I have a lot of roles and
responsibilities. The last thing I needed was a bunch of new software that
increased my maintenance tasks," said Hall. "Therefore, it was a nice surprise
to add a single box to my network, which gives us the latest web filtering
capabilities compliant with Federal law, and runs a state-of-the-art DMZ that
can be extended to parents. Thanks to the automated update service provided by
Network Engines a great deal of my security routine is now automated, which
allows me to sleep better at night. I am now spending a lot of time working on
other more valuable tasks.""The NS6400 is an incredible product, not only because of the ease of use and
ease of deployment features, but also because it provides significant cost
advantages," said Bob Gunn, Solution Engagement Manager at Matrixforce. "By
deploying the Network Engines’ hardened version of ISA Server 2004 with Surf
Control’s web filtering solution pre-configured, we believe that end customers
realize an immediate two-fold cost reduction when compared to installing and
maintaining each software package independently. Longer term, customers also
enjoy significant annual savings in maintenance costs.""We are very pleased with the results after deploying the NS6400 at Perry
Public Schools. The savings in money and time are further proof that the NS
Series security appliances are the best alternative for deploying Microsoft ISA
Server 2004 in conjunction with solutions such as Surf Control," said Derek
Chueng, channel manager at Network Engines.About Matrixforce
Matrixforce is a leading business support firm in the U. S. South Central
region, headquartered in Tulsa, Oklahoma and founded in 1978. Its mission is
providing superior computer support for customers to lower technology costs and
improve business performance. As a premier Microsoft Gold Certified Partner
(MGCP), Matrixforce specializes in implementing and supporting business systems
utilizing Microsoft Server System, Desktop, and integration products as well as
associated best-in-class hardware and software products.Network Engines – THE Appliance Company
Network Engines appliances are designed to ease the deployment, enhance
manageability, and increase security of mission critical software applications.Our heritage of providing technology products and services tailored to
supporting the entire lifecycle of our customers appliances has made us the
appliance partner of choice for software market leaders.Founded in 1997, Network Engines is headquartered in Canton, Massachusetts
and trades on the NASDAQ exchange under the symbol NENG. For more information
about the Company’s products and services visit: http://www.networkengines.com.Safe Harbor for Forward-Looking Statements
Statements in this press release regarding Network Engines’ (the "Company")
future financial performance and any other statements about Network Engines’
management’s future expectations, beliefs, goals, plans or prospects constitute
forward-looking statements within the meaning of the Private Securities
Litigation Reform Act of 1995. The Company’s actual results could differ
materially from those stated or implied in forward-looking statements due to a
number of factors, including those factors contained in the Company’s most
recent annual report on Form 10-K for the year ended September 30, 2004 and the
most recent Form 10-Q for the quarter ended June 30, 2005 under the section
"Factors That May Affect Future Operating Results" as well as other documents
that may be filed by the Company from time to time with the Securities and
Exchange Commission. Forward-looking statements include statements regarding the
Company’s expectations, beliefs, intentions or strategies regarding the future
and can be identified by forward-looking words such as "anticipate," "believe,"
"could," "estimate," "expect," "intend," "may," "should," "will," and "would" or
similar words. The Company assumes no obligations to update the information
included in this press release.Network Engines and the Network Engines logo are trademarks of Network
Engines, Inc. All other registered and unregistered trademarks in this document
are the sole property of their respective owners.
Contact:Network Engines, Inc. Joni Moore, 508-308-7900 joni.moore@networkengines.com
-
Interesting News on Sipura 2000 VoIP Boxes – The Continuing Story of SIP
I don’t know
anything about the Sipura 2000 VoIP box and although the name of the device
indicates that it uses SIP, I don’t know anything about how they’ve implemented
SIP for this device. As you know, SIP support for ISA is problematic. However,
there is some interesting news regarding ISA firewall support for this
device.Note that the
instructions indicate that secondary protocols are required. This indicates that
the Firewall client must be installed on the box (clearly impossible) or that
you write an application filter for the device to support its protocols.
However, Nathan Rausch says it works, in the post listed below. I never argue
with success, but I wonder how exactly the device and the solution
work.HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
New White Paper on using WSUS with ISA
Wow! Check out
this new White Paper by MS. We’ve been fielding a ton of questions on how to
make WSUS work with ISA firewalls and now MS steps up to the plate and delivers.
This is great stuff! One of the things that really impresses me about this paper
is that the WSUS group is taking up the approach to how-to documentation that I
pioneered with the ISA Deployment Kits. This paper has the detailed, step by
step instructions with screen shots, exactly what we want and
need!Check out the
description of the White Paper, listed below:"Today?s companies have a growing mobile
workforce. Keeping these assets up to date with current patches is extremely
important to ensure continued productivity and decreased security risk. Many
organizations are finding it more and more difficult to keep these mobile
devices patched as the need for VPN decreases as the number of applications
utilizing Internet protocols such as HTTP and HTTPS grows. Using Windows Server
Update Services (WSUS) in combination with Internet Security and Acceleration
Server 2004 (ISA 2004) organizations can extend their existing Intranet based
patch management to their growing number of mobile devices. The purpose of this
document is to detail the implementation planning and steps needed to create an
Internet based patch management solution using WSUS and ISA 2004."Find it
at:HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Top Ten Clues Indicating a Consultant Shouldn’t Be Within Ten Parsecs of your ISA Firewall
The latest version of GFI WebMonitor for ISA
Server, a utility for ISA server that allows for real time monitoring of web
sites being browsed by network users and the files they are downloading, has
just been launched! Version 3 now includes a real-time online adult content
filter, virus scanning and file type blocking capabilities and byte transfer
stats per user/per site. Click here to download the new and improved GFI WebMonitor for ISA
Server!The following is
excerpted from this Months ISAserver.org Newsletter. Subscribe to the newsletter
at http://www.isaserver.org/pages/newsletter.aspTop Ten Clues Indicating a Consultant Shouldn’t Be
By
Within Ten Parsecs of your ISA Firewall
Thomas W Shinder MD, MVPI’m seeing a lot of requests on the ISAserver.org mailing
list and Web boards for expert consultant help in setting up ISA firewalls for
organizations of all sizes. This is great news, because it shows the word is
getting out that the ISA firewall is indeed ready for prime time and is an
enterprise grade firewall that works for any company, regardless of size.
As with all consultant situations, caveat emptor should be
the working phrase. There are some darned good ISA firewall consultants out
there, and there are some who figure that since they’re the best Xbox guys on
the block, they might as well be highly paid firewall consultants. Seek the
former and run from the latter.To help you folks currently in the market for an ISA
firewall consultant, I present my list of the top ten warning signs that your
firewall consultant might be off the reservation. If you hear the potential
consultant utter any of these phrases or ideas, run and not walk away.
1. Consultant
recommends that you "open a port"You can’t "open a port" on a firewall, because ports are
not bidirectional "holes" in some sort of digital pegboard. Even the least
powerful of real firewalls control traffic based on source and destination IP
address and source and destination port, and that’s just for TCP and UDP
protocols. Implicit in the concept of "open a port" is that the device allows
all traffic to and from a particular host or network by default. The basic
firewall fact is that "open a port" means nothing to a firewall administrator
and if the consultant utters this phrase, you need to put your guard up. Accept
use of this phrase only if the firewall consultant says it only to condemn it.
2. Consultant
recommends a "hardware firewall"All firewalls run software. Hardware is dumb and only does
what software tells it to do. A "hardware firewall", in terms of common usage,
means a dedicated firewall device that doesn’t run on Windows. There are other
definitions of hardware firewalls, such as those having no fans, no hard disks,
or in general "no moving parts". The misconception is that "hardware firewalls"
are more secure than a firewall that runs on a hardened operating system.
Objective data and experience show that this is an illusion, and is strongly
promulgated by "hardware" firewall manufacturers. I don’t blame the vendors for
spewing out this information, they’re just trying to gain a competitive
advantage, but I do blame someone who claims to be a firewall expert if he
chooses to believe this canard. The fact is no correctly configured ISA firewall
has been successfully attacked to the extent that there was data loss. So-called
"hardware" firewall vendors cannot make this claim. If your consultant
recommends a "hardware" firewall for security reasons, you better look at the
guy with a jaundiced eye and check the phonebook for another consultant.
3. Consultant
calls a host-based or personal firewall a "software firewall"As mentioned earlier, all firewalls run on software.
That’s a fact and there’s no way around it. Even "hardware" firewalls with no
moving parts have software included in memory. One of the most useful measures
for assessing consultant cluelessness is when they refer to host-based or
personal firewalls as "software firewalls" and low-cost NAT devices as "hardware
firewalls". This is a common error made in the consumer radio personality space,
and it creates no end of confusion in that space. However, profession firewall
consultants never refer to host-based or personal firewalls as "software
firewalls" because he knows that all firewalls require software instructions to
carry out their firewall duties.4. Consultant
says you need to "poke a hole" or "create a pinhole" in the firewall
In the same way that you can’t "open a port" on a
firewall, you can’t "poke a hole" or "create a pinhole" in the firewall. Again,
a network firewall is not an electronic pegboard, where you can poke a hole in
one of the punch outs and allow "stuff" to flow in both directions. There is no
"stuff" that flows through such "hole pokes". Again, if someone thinks in terms
of poking holes in firewalls, it indicates that he doesn’t understand how
firewalls work, and that should reflect on the consultant’s lack of
understanding and skill set.5. Consultant
refers to a NAT device as a "firewall"There are a number of low cost devices on the market today
providing simple NAT services for SOHO and very small businesses and branch
offices. These unsophisticated devices are able to NAT outbound connections and
sometimes reverse NAT inbound connections. However, these devices do not perform
stateful packet and application layer inspection, do not enable strong
user/group based access control for protocols, sites, content and time of day,
and do not maintain comprehensive logging information about all connections
moving through and to the alleged firewall device. Firewall experts will call a
spade and spade, and a NAT device is neither a spade or a firewall. Consultants
who refer to them as firewalls are showing that they have a bad hand.
6. Consultant
recommends putting a Web or FTP server on the firewallThe network or perimeter firewall is a highly specialized
piece of security gear and everything possible should be done to reduce the
attack surface on the firewall. Any time you allow connections to services on
the firewall, you exponentially increase the risk related to an increased attack
surface, and if you enable connections from the Internet to services on the
firewall, then you’ve increased the attacker surface by many orders of
magnitude. Any firewall consultant that recommends running Web or FTP services
on the firewall should be run out of town on a rail or hung by his own petard,
or both.7. Consultant
refers to the ISA firewall as a "proxy server" and recommends a single-NIC
configurationThe ISA firewall is a firewall, first, second and last.
Even if you try to harpoon the ISA firewall’s network security model by
installing it in unihomed Web proxy only mode, it’s still a firewall (albeit
providing firewall protection only for itself). The ISA firewall does include a
Web proxy filter that works with the ISA firewall’s firewall services, but it’s
a filter like any other filter. The ISA firewall also supports the Winsock proxy
client (Firewall client), which can remote Winsock connections directly to the
ISA firewall, but the ISA firewall is a firewall that supports these proxy
components, not a proxy server with firewall components. Therefore, be
suspicious of those who refer to the ISA firewall as a proxy server, since it
may indicate that they think the ISA firewall is something like Proxy Server
4.0, which is definitely not the case and indicates that the consultant may not
understand the ISA firewall’s firewall architecture.8. Consultant
creates "all open" Access Rules to the ISA firewall’s Local Host Network
The ISA firewall’s Local Host Network includes all IP
addresses bound to all interfaces on the ISA firewall. System Policy is the
primary method you should use when controlling traffic to and from the ISA
firewall itself. You should be very careful about allowing any traffic to and
from the ISA firewall itself, since any such traffic could have potentially
disastrous effects. If you ever see a consultant create or recommend a rule
allowing all traffic to or from the ISA firewall, you need to steer clear of
this consultant. There are no valid scenarios where all traffic should be
allowed to or from the ISA firewall. Any consultant who would create such a rule
shows that he doesn’t appreciate the profound effects that such rules could have
not only on the ISA firewall, but on your entire network infrastructure.
9. Consultant
says that ISA firewall should not be on the Edge of the NetworkI’ve spent a lot of time teaching ISA firewall admins that
the ISA firewall can and should be used as an edge firewall, and that it is
designed to be an edge firewall. After installation is complete, the ISA
firewall is a network brick and no one is going to get past that brick until you
create rules making is possible. No one is going to break through the ISA
firewall. For this reason, you should be completely at ease with putting the ISA
firewall at the edge of the network. Give a wide berth to the consultant who
recommends putting a "hardware" firewall in front of the ISA firewall, if the
recommendation is made because "he doesn’t trust" the ISA firewall on the edge.
In fact, you should not trust the consultant. Stop him before he harms your
network security.10. Consultant
recommends against using the Firewall and Web proxy client configuration
You can significantly increase the overall level of
security the ISA firewall can provide your network if you deploy both the
Firewall and Web proxy client configurations throughout your network, as
appropriate. Any ISA firewall consultant who doesn’t push for such
configurations demonstrates a impressive lack of knowledge about the outrageous
security advantages these client configurations represent. If the consultant
says "I prefer the SecureNAT client because it provides all the security you
need", then you need to lock your checkbook away in a safe place, call security,
and have the consultant escorted swiftly, but considerately, out the door.
=======================
Quote of the Month – "I’ve never thought of the IRS and
network security together before. I don’t think I want to, makes my brain panic"
– Amy Babinchak responding to Tom Shinder’s observations on dealing with painful
issuesHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Solving Performance Problems with Back to Back ISA Firewall Deployments
Many ISA firewall
adminstrators find that when they deploy a back to back ISA firewall topology,
their former high performance ISA firewall solution went from Corvette to Prius.
The reason for
this is related to DNS name resolution issues. The problem only takes place when
the back-end ISA firewall is configured to use an internal DNS server that can’t
resolve Internet DNS host names. If this problem sounds familar, then check
out:You
experience slow Web browsing performance on internal client computers that use
Internet Security and Acceleration Server to manage Web requests at http://support.microsoft.com/Default.aspx?id=839510HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
One Click User Control of Internet Explorer Proxy Settings and Firewall Client Settings
Need some help for
hapless users who are challanged with disabling and enabling the Web proxy and
Firewall client settings on their computers when they’re on the road? Yes,
sometimes you need to disable the Web proxy client config and sometimes you need
to disable the Firewall client config to test and get things working when on the
road. Unfortunately, not all hotels are running ISA firewalls
🙂Well, here’s some
good news for you! Tim Trace has put together a nice little solution that allows
you one-click access to configuring these client settings. Check this
out:timtrace
Senior
Member
Member # 3094 posted
September 14, 2005 10:23 PM
Greetings,I’ve
coded up a little gift to the community…ConfigMe! is a small
freeware program which allows a user to reconfigure a workstation’s IE
proxies and MS Firewall Client 2004 settings with a single click. (It
works fine even if the FWC is not on the system.)All of the
settings are kept in .INIs for ease of use.Login scripts or SMS
can be used to update the app or the INIs. If you’re good with RoboCopy
you can work some neat tricks to preserve INIs that the user has created,
even as you are overwriting your ‘corporate’ INIs.Click here to
download ConfigMe!:
http://tinyurl.com/9tjveIf you’re going
to be using ConfigMe! to control the MS FWC 2004, you’ll need to put the
FWC Tool into the FWC directory:
http://tinyurl.com/a6sfbBest regards,
Tim ==
[ September 14, 2005, 10:24 PM: Message
edited by: timtrace ]
Posts: 80 |
From: St. Louis MO | Registered: Oct 2001 | IP:
Logged
HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
ISA Firewall Hot Tip: Avoid the SecureNAT Client Configuration Whenever Possible
The SecureNAT client was designed to support hosts that cannot be configured as Web proxy or Firewall clients, or for network servers. The SecureNAT client was not designed to support fear, mistrust, or misunderstanding of the Firewall and Web proxy client configurations.
The only circumstances when you should configure a host as only a SecureNAT client is when:
- The host does not support the Firewall client software, or
- The machine is a server.
Only Windows operating systems support the Firewall client software, so all non-Windows machine may require SecureNAT configuration. However, if the non-Windows operating systems only require Web proxy access, then configure them only as Web proxy clients only. Almost all operating systems support the Web proxy client configuration. Servers should not have logged on users, therefore, there is no reason to configure them as Web proxy or Firewall clients, in addition to the fact that you should not install the Firewall client on servers.
HTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
Wildcard Certs and ISA Firewalls
Did you know that
the ISA firewall supports using wildcard certificates for SSL Web Publishing
Rules? You bet! Check out http://isaserver.org/tutorials/2004wildcardcert.html for
details.One thing to watch
out for when using Wildcard certs is that while you can use them to publish
multiple sites that belong to the same second-level domain, you
can’t use wildcard certs on the Web sites
themselves.For example,
suppose you want to publish to Web sites:owa.msfirewall.orgrpc.msfirewall.orgYou can create a
wildcard certificate with the common/subject name
*.msfirewall.org and bind that to the Web listener publishing
the sites. However, you can not use that same certificate on
the Web site, because the redirect entry in the Web Publishing Rule must be
the exact name.HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
OT: Fine-tuning and known issues when you use the Urlscan utility in an Exchange 2003 environment
The URLScan
utility is a tool that helps you control what types of communications are
allowed to an IIS Web server. While this tool is extremely helpful in locking
down your Web servers, you can easily DoS yourself before any hacker gets a
chance if you use it incorrectly or do not have information regarding the
implications of your configuration decisions.URLScan is
especially problematic when you want to protect an Exchange 2003 Server
published to the Internet. Make one wrong move and BANG! something’s broken and
you’re up ship’s creek without a paddle (notice the Great
Discretion?).The good news is
that MS has come out with a great doc entitled Fine-tuning and known issues when
you use the Urlscan utility in an Exchange 2003 environment located at http://support.microsoft.com/kb/823175/If URLScan has
horked your Exchange configuration, this article is the place to start and
probably end — that’s how good the info in here is.HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Firewall Client Whacks Active (PORT) Mode FTP Connections through the ISA Firewall?
FTP is a bad
protocol. Just plain bad. Any firewall admin worth his salt knows of the
problems firewalls have with dealing with this unruly protocol. The ISA firewall
is no exception.With this in mind,
I was still surprised to see that the Firewall client has a problem with FTP
active (PORT) mode transfers. I learned about this in
KB884580 at http://support.microsoft.com/default.aspx?scid=kb;en-us;884580.Here’s the
configuration you need to see the effects:? The ISA Server 2004 Firewall
Client program is installed and enabled.? The Enable folder view
for FTP sites check box is selected in Internet
Explorer.When this check box
is selected, Internet Explorer exhibits the same behavior as a non-Web proxied FTP client program. This
behavior is described in RFC 959. If this check box is not selected,
Internet Explorer sends FTP requests to the Web proxy server as HTTP tunneled requests to the Web proxy
listener.? The Use Passive
FTP check box is not selected in Internet
Explorer.The end result of
these options is FTP requests are NOT handled by the ISA
firewall’s Web proxy filter.Another important
observation is that the command line http://ftp.exe client is not broken by the Firewall
client. Why? Because the command line http://ftp.exe FTP client does not call Windows
Sockets and thus isn’t handled by the Firewall client. The SecureNAT client
configuration handles http://ftp.exe
client connections.HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**+Mode+FTP+Connections+through+the+ISA+Firewall%3f&referrer=)
-
Hotfix for Recalcitrant Site to Site VPN Connections
I’ve seen a number of people complaining of site to site VPN connections failing between ISA firewalls at local and remote locations. The common observation is that the connection fails and then there is no way to reconnect except for bouncing the VPN gateways. That’s not good.Something that is good is that there is a hotfix for this problem. Note that the fix is only for ISA firewalls acting as VPN gateways running on Windows Server 2003. If you have this problem on Windows 2000, then you’re outta luck :-\Check out the hotfix info here http://support.microsoft.com/default.aspx?scid=kb;en-us;888090 and give your friendly PSS engineer a call.HTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
One way to NOT Define an Effective Firewall
You’ve heard
these:"I can’t get my
game/warez app/P2P app/slimeware/sludgeware/non-RFCware/customware to work when
its behind the ISA firewall but when I move the computer in front of the
firewall it works fine — what’s wrong with ISA""I could connect
to the site when I was using my [fill in the name of your favorite NAT
device that has firewall scrawled on the box] but when I installed the ISA
firewall it doesn’t work any more — what wrong with ISA""Everything worked
before I installed the ISA firewall. Now no one can connect to the
Internet"Yes indeed, its
all true. And its all good too. The following is not a viable definition for a
firewall:A network
device providing universal access to all sites, using any protocol, at any time
of day to any user making a connection request through that device without any
technical knowledge required by the firewall
operator/administratorSeems like common
sense, doesn’t it? You bet. That’s why drivel like this http://techrepublic.com.com/5254-6257-0.html?forumID=99&threadID=181286&messageID=1869990&id=4224622 drives
me up the wall. What’s worse, Dr. Johansson is a
world-renowned security specialist. And adding insult to this
injury is that he’s configuring the ISA firewall on SBS (which is a security
compromise by definition) and referring to the ISA firewall’s configuration
interface as firewall configuration by cartoon.I could go on with
a long-winded rant, but this type of calumny (there are no cartoon’s and the
templates are meant to be used as very basic configuration starters, not for
full fledged firewall administration and policy customization) is especially
disappointing from a Microsoft employee. Its disappointing because the
overwhelming majority of Microsoft employees are extremely perspicacious and
don’t denigrate the company’s products unless the product really deserves it,
and even then, they do it in a well considered and circumspect
manner.The ISA firewall
product has enough problems getting traction in the marketplace without having
to deal with what looks like an enemy within. I’m sure this is
not the case, but it smells like it and that’s what
chaps my hide.I also remove four
social credits from TechRepublic’s account for highlighting this post as a
featured blog entry. TechRepublic has historically been very supportive of the
ISA firewall and has a lot of information on their sites on how to use the ISA
firewall intelligently to secure network resources. I know that choosing to
feature this ill-considered post was not representative of an overarching
editorial position for TechRepublic/TechProGuild, but its saddening
nonetheless.Now back to
fighting the good fight!Thanks!TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Update on the Firewall Client FTP Issue
Well, I got caught
with my pants down today regarding my post on the FTP/Firewall client issue. I
figured that since the KB article mentioned in the post was dated
September 29 2005, that this was a new issue. However, ISA
firewall MVP Stefaan Pouseele points out the error in my
ways:spouseele
Senior
Member
Member # 4220 posted October
24, 2005 03:30 PM
Hi Tom,I think
that the info you provided in your blog http://spaces.msn.com/members/drisa/Blog/cns!1p9yz6owxXl-uIlyqIZXkCrg!257.entry
concerning Firewall Client Whacks Active (PORT) Mode FTP Connections
through the ISA Firewall is somewhat outdated. As far as I know, the
fix mentioned in KB 884580 was already included in ISA 2004 SP1 ( http://download.microsoft.com/download/3/0/2/30242226-ac76-4a91-b854-6cc3c12a1d28/
readme.htm ).However, check out http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=20;t=002693
if you want to learn about a new FTP bug I found with ISA 2004 SP1.
According to my info it sounds to be a rule engine bug! There is no fix
yet, but there are some possible workarounds.![[Wink]](http://forums.isaserver.org/ubb/wink.gif)
HTH,
StefaanThanks!TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
SharePoint Upload Problems when site is Published through an ISA firewall?
If you find that
your having problems with uploading files and creating foldings to your
published SharePoint document library, try disabling the Verify
Normalization feature in the HTTP Security Filter’s Properties dialog
box.HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
ISA Firewall Pet Peeve #125978A2Z5: VLANs are NOT Network IDs
One problem we have in this business is a lack of precision in our professional terminology. There are a lot of reasons for this, which isn’t something we need to go into here. But one of the problems with this imprecision is that misunderstanding of terminology can have an adverse effect on implementing techologies in a production environment.For example, the ISA firewall supports the concept of an ISA firewall Network. Each NIC on an ISA firewall becomes the "root" of an ISA firewall Network. An ISA firewall Network can include a group of addresses, or even an entire network ID. This is actually the most typical usage and configuration for ISA firewall Networks — to enter all addresses in all network IDs behind a specific interface as part of the same ISA firewall Network.So what’s the problem? The ISA firewall is a layer three and above firewall. It doesn’t give a hoot about what’s happening at layer 2. The problems come in when ISA firewall admins ask questions that include phrases like:"I have three VLANs connected to my ISA firewall, what’s the best way to configure things"or"Computers on one of my VLANs can’t connect to hosts on another VLAN. What should I do in my ISA firewall Policy to fix this problem?FACT: The ISA firewall doesn’t care about your VLANs. While it will support 801.1q VLAN tagging, the ISA firewall just sees each VLAN virtual ethernet segment as a physical interface; the ISA firewall is blissfully unaware of the layer 2 workings.What is a VLAN? Here’s some help:- Short for virtual LAN, a network of computers that behave as if they are connected to the same wire even though they may actually be physically located on different segments of a LAN. VLANs are configured through software rather than hardware, which makes them extremely flexible. One of the biggest advantages of VLANs is that when a computer is physically moved to another location, it can stay on the same VLAN without any hardware reconfiguration.
http://www.angelfire.com/anime3/internet/network.htm- Virtual Local Area Network. The ability to associate different LAN-attached workstations as being part of the same LAN independent of where the workstation is physically attached to the LAN.
http://www.wi-lan.com/technology/glossary.htm- The term VLAN was specified by IEEE 802.1Q; it defines a method of differentiating traffic on a LAN by tagging the Ethernet frames. By extension, VLAN is used to mean the traffic separated by Ethernet frame tagging or similar mechanisms.
community.roxen.com/developers/idocs/rfc/rfc4026.html- Virtual Local Area Network is a very flexible type of LAN in which machines located in the same physical area are not necessarily on the same LAN broadcast domain. VLANs can be implemented using sophisticated switches. Individual workstations are connected to switch ports (eg, 10/100/1000Mbps), and it is the job of the latter to create the broadcast domain. VLANs can be of different types: port-based, MAC-based, or IEEE 802.1p/Q-based. …
authors.phptr.com/morris/glossary.html- Virtual Lan Area Network A logical group of user end stations, servers, and other network devices that appear to be on the same LAN, regardless of their physical location ? The switches can be parametered so a specific workstation can reach any other specific workstation(s) on the LAN. ? The switches can be accessed and controlled directly from a console port or via the LAN using IP. ? The LAN Administrator can use the MAC addresses or the IP addresses to interconnect the workstations. …
http://www.ventusnetworks.com/glossary/v.html- Virtual Local Area Network. A logical grouping of two or more nodes which are not necessarily on the same physical network segment but which share the same network number.
http://www.ru.ac.za/library/theses/2003/halse/ft/html/glossary.html- Virtual LAN. Workstations on different LANs can be connected using VLAN tagging.
http://www.nationaldatamux.com/G80001.htm- Virtual LAN. A logical, not physical, group of devices, defined by software. VLANs allow network administrators to resegment their networks without physically rearranging the devices or network connections.
http://www.hscgroup.co.uk/v.html- Virtual LAN. Workstations connected to an intelligent device which provides capabilities to define LAN membership.
http://www.dsltechie.com/glossary/glossary.htm- A virtual LAN, commonly known as a VLAN, is a logically independent network. Several VLANs can co-exist on a single physical switch. IEEE 802.1Q is the predominant protocol. Prior to the introduction of 802.1q, Cisco’s ISL (Inter-Switch Link), a variant of IEEE 802.10, was one of several proprietary protocols. ISL is now deprecated in favor of 802.1q.
en.wikipedia.org/wiki/VLANNow that you know that VLANs and Nework ID and physical Ethernet segments are not the same thing, you’ll be able to ask the right questions, which will get your the right answer.HTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
- Short for virtual LAN, a network of computers that behave as if they are connected to the same wire even though they may actually be physically located on different segments of a LAN. VLANs are configured through software rather than hardware, which makes them extremely flexible. One of the biggest advantages of VLANs is that when a computer is physically moved to another location, it can stay on the same VLAN without any hardware reconfiguration.
-
Microsoft, Nokia Team On ISA Firewall Appliance
From: USEast News Service [mailto:USEastNewsService@USEast.Net]
Sent: Wednesday, October 26, 2005 1:42 PM
To: USEast News Service
Subject: Microsoft, Nokia Team On Security ApplianceMicrosoft, Nokia Team On Security Appliance
By Paula Rooney,
0:46 PM EDT Wed. Oct. 26, 2005Microsoft and Nokia, archrivals in the mobile phone operating-system space, are partnering on a Unified Threat Management security appliance, channel sources said.
The companies plan to offer a UTM appliance that would act as a gateway for secure VPN access to network-based applications from remote locations or mobile devices such as smart phones, according to source familiar with the vendors? plans. For example, the appliance would monitor e-mail, Web and application traffic between a company?s internal network and the Internet to detect, block and prevent various security threats, the sources said, adding that the product would support Microsoft and non-Microsoft environments.
The planned product would be a special-purpose, integrated software and hardware package with a unified management framework, the sources said. It?s designed to eliminate the need for customers to install and support multiple products to defend against Internet-based attacks.
Plans call for the appliance to be targeted at companies with 100 to 1,000 employees and carry a price of $2,500 to $4,500, sources said. It would support 100 Mbit-per-second bandwidth to external networks and more than 100 VPN connections.
Solution providers said such a security appliance would be a universal VPN solution.
"The box would unify ISA and protocol/traffic monitoring," said Phil Ernst, president and CTO of Convergence Technology Consulting, Bowie, Md. "They are attempting to compete in the space with what is being termed a universal VPN. Citrix introduced this with Citrix Access Gateway, which was the Net6 product."
The planned appliance is designed to be easy to install and maintain and would use Microsoft security technology to integrate with Windows Active Directory and Exchange, sources said. The product also would employ Nokia hardware and other Nokia technology to work well in non-Microsoft environments or mixed environments.
In September, Nokia launched a software solution called Nokia Business Center that delivers business applications and mobile e-mail to smart phones and business-optimized mobile devices.
Mirosoft and Nokia are in discussions with partners about the viability of such security appliance, so it?s unclear when–and if–the product would go to market. Still, such an offering would help Microsoft compete in the hot security market plus give partners a familiar Windows-based tool to use, even though it could be a tough sell, solution providers say.
"Nokia has substantial experience in marketing hardware security appliances that use software from partners such as Check Point. However, these appliances have traditionally been Unix-based," said Alex Zaltsman, managing director at Exigent, Morristown, N.J. "A VPN and network monitoring appliance that runs Microsoft’s operating system is a good idea but may lead to some level of pushback from security-conscious administrators who typically prefer to separate those two functions."
"If they stick with the UTM functionality without VPN, I think it could be a great product," Zaltsman added. "It may be a hit with Windows administrators, who are already familiar with the user interface of Windows software.?
Some partners expressed surprise that Microsoft is collaborating on the appliance with Nokia, a competitor in the mobile OS arena.
"An appliance would be a good thing, basically a special-purpose firewall with more features," said Robert Tedesco, CTO of Resolute, a Microsoft Business Solutions partner in Bellevue, Wash. "For some customers, the only way to get sick is from the network. This would be good, but Nokia and Microsoft have not been the best of friends over phone OS wars.
Simon Chan, director of business development at Iteration2, an Irvine, Calif.-based solution provider, said he expects Microsoft and Nokia to remain fierce rivals on the mobile phone front. He also noted that Microsoft is pairing with rivals in several other markets.
"It’s interesting that Nokia and Microsoft are teaming together, but not surprising anymore with Microsoft working with RIM and Palm," Chan said. "It would help Nokia in getting a foothold in that enterprise e-mail market, where Exchange obviously is the leader. It shows how Microsoft’s different product groups really are very independent organizations.?
Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000007
-
Using Wildcard Certs to Support OMA and ActiveSync
In your Web
Publishing Expeditions, you might have found that wildcard certs work just fine
for Web Publishing OWA sites, but when you try to publish the OMA and Exchange
ActiveSync sites, all heck breaks loose. The problem is apparently related to
issues with root certificate checking on the Windows Mobile 2003 client. Now, I
haven’t confirmed that this is a problem, because I haven’t deployed wildcard
certs to support Windows Mobile clients yet. But here’s some advice from Rob
Marlbrough on the http://www.isaserver.org
message boards that might be of some use to you:Rob Marlbrough
WebWizards.Net
Junior Member
Member # 33837 posted October
26, 2005 07:51 PM
It’s easy to use
wildcard certs with ActiveSync, just use the "certchk" utility from
Microsoft to turn off the root cert validation on the mobile
device:http://www.microsoft.com/downloads/details.aspx?FamilyID=D88753B8-8B3A-4F1D-8E94-530A67614DF1&displaylang=en
I
bought a wildcard cert, and installing the root cert on the mobile device
still did not work, so this method allows SSL to still be used, but gets
around the device complaining that it can’t validate the cert against an
installed root cert (Error INTERNET_55).For more details
visit:http://www.petri.co.il/temporarily_disable_root_certificates_checking_in_windows_mobile_ppc.htm
and
http://www.petri.co.il/adding_root_certificates_to_windows_mobile_2003_ppc.htm
![[Razz]](http://forums.isaserver.org/ubb/tongue.gif)
——————–
Thanks,
RobWeb
Wizards
http://www.webwizards.net/Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000007HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Day of Reckoning Coming for “Hardware” Firewall Guys?
Hardware firewall guys always remind me of doctors in the early and mid
20th century who recommended smoking to cure such ills as neuresthenia
and the vapors. Why? Because like the docs of yore, they somehow came to
believe in a superstition based on "common sense". The bromide goes
that so-called hardware firewalls are more secure than a "software
firewall" like the ISA firewall, and an ISA firewall could never be as
secure. Its so funny I forget to laugh.The problem is the joke’s on them. The hardware firewall guys are going
to end up with their day of reckoning in the not too distant future, as
the following indicates:–Cisco Customers Unaccustomed to Updates
(20 October 2005)
Cisco CSO John Stewart says that because Cisco customers are
unaccustomed to updating their network hardware operating system on a
regular basis, many are still running old versions of the company’s
Internetwork Operating System (IOS). Mr. Stewart says Cisco has not
adopted automatic patching because its customers do not want it. He
hopes that the outcome of an unexpected vulnerability disclosure earlier
this year will be that Cisco IOS users upgrade to the latest version to
protect their systems.
http://www.zdnet.com.au/news/security/print.htm?TYPE=story&AT=39217949-2
000061744t-10000005c
[Editor’s Note (Pescatore): The issue is more that it has been really,
really painful to update IOS. It isn’t a patch action, it is a shut
down and reload the OS action, which is very disruptive to the network
and very manpower intensive. While the best solution is always better
software development processes to reduce vulnerabilities, software
vendors (and switch vendors ship a lot of software) have to invest a lot
to make the patch process easier and faster for their customers.
Microsoft learned this back during the worms of 2001 and now most
enterprises can patch Windows much, much faster with much less pain.]
————————————————————————
—
=========================
Discuss this post at:
http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000007
-
Nice Flash Demo for Executives on ISA Firewall VPN Advantages
View a Demo on Network Access
View this demo to learn about the value provided by
Microsoft networking technologies. Find out about the different services
available through Windows Server 2003 and ISA 2004.This is a nicely
done Flash demo for exectives to help them see the advantages of using the ISA
firewall as their remote access VPN server.HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Solving Compressed Content Problems for Published Servers
You might have
seen this one. You’ve published a Web server and occasionally, for no apparent
reason, the ISA firewall’s HTTP Security Filter whacks access to content that it
shouldn’t. You get a 500 Internal Server Error and can’t figure
out what the problem is. You might have even seen this problem when trying to
access PDF files located on published Web servers (not directly related to PDF,
but that’s another story).The solution might
be that you need to change how the ISA firewall handles compressed content for a
publishing rule. The ISA firewall allows you to make a choice: speed up access
and allow compressed content to pass without application layer inspection, or
slow things down a bit, and provide secure access for non-compressed content and
deny compressed content (which cannot be inspected by the ISA firewall at this
time).Victoare, and ISAserver.org member,
has a helpful script to allow you to set whether or not you want to support
compressed content on a per Web Publishing Rule basis:Victoare
Junior
Member
Member # 30382 posted May 25,
2005 05:11 AM
Hi!
I wrote a little
vbs script (wrote … copy from microsoft, and add a little more
stuff)
It goes through the web publication roles and ask a question to
invert the state of the desired property (SendAcceptEncodingHeader).
I
use ISA 2004 and Merak mail server with Icewarp too, and this script
solves the attachment problem!so, here it is: (i call it
‘SendAcceptEncodingHeader.vbs’)‘ Define the constant
needed.
Const fpcPolicyWebPublishing = 2‘ Create the root
object.
Dim root ‘ The FPCLib.FPC root object
Set root =
CreateObject("FPC.Root")‘ confirm function
function
Confirm(sText)
‘ 4 = Yes/No
‘ 32 = "?" icon
‘ 256 = "No" selected
by default
‘ "=6" = "YES" selected
Confirm = (msgbox(sText,4+32+256)
= 6)
end functionfunction Info(sText)
‘ 64 = "i"
icon
call msgbox(sText,64)
end function‘ Declare the other
objects needed.
Dim isaArray ‘ An FPCArray object
Dim rules ‘ An
FPCPolicyRules collection
Dim rule ‘ An FPCPolicyRule object
Dim
bValue ‘ the original and the new value
Dim sMessage ‘ the confirm
message‘ Get references to the array object and the policy rules
collection.
Set isaArray = root.GetContainingArray()
Set rules =
isaArray.ArrayPolicy.PolicyRulesFor Each rule In rules
If
rule.Type = fpcPolicyWebPublishing Then
bValue =
rule.WebPublishingProperties.SendAcceptEncodingHeader
sMessage =
"WebPublish( " & rule.name & " ).SendAcceptEncodingHeader=" &
bValue & vbcrlf & _
vbcrlf & _
"Set it to " & (not
bvalue) & "?"
if confirm(sMessage)
then
rule.WebPublishingProperties.SendAcceptEncodingHeader = not
bValue
Info "WebPublish( " & rule.name & "
).SendAcceptEncodingHeader=" & (not bValue)
end if
End
If
Nextrules.save
WScript.Echo "Done!"[ May
25, 2005, 05:13 AM: Message edited by: Victoare
]——————–
Victoare
Posts: 1 | From:
Hungary | Registered: May 2005 | IP: LoggedHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Network Engines Wins as Best Firewall in Redmond Magazine Editor’s Choice Awards 2005
Network Engines Wins as Best Firewall in Redmond Magazine Editor’s Choice Awards 2005
NS Series Security Appliances now available with Websense Security Suite, winner in the IDS/IPS categoryCANTON, Mass.–(BUSINESS WIRE)–Nov. 1, 2005– Network Engines, Inc. (NASDAQ-NENG), a leading OEM appliance partner for Microsoft security solutions, today announced that it has won a prestigious Redmond Magazine Editor’s Choice Award for Best Firewall."We choose Network Engines NS Series because of the products enterprise-class functionality, outstanding ease of use and its ability to manage software updates," said Joern Wettern, Redmond Magazine editor. "I was impressed with the usability, especially for smaller company’s branch offices that need enterprise-level firewall protection, but don’t have extensive experience in configuring firewalls. It’s an ingenious customization of turning an existing product (Microsoft ISA Server 2004 running on Windows Server 2003) into a true appliance. At the same time, it shields an administrator from tasks that are not part of the firewall, such as operating system configuration and software updates."
"Network Engines is honored to receive this year’s Editor’s Choice Award from Redmond Magazine," said Mike Riley, vice president of marketing and corporate strategy at Network Engines. "Having introduced the NS Series just a year ago – and new models as recently as this week – this is exceptional reinforcement that we are meeting the market’s needs, and continue to remain a step ahead of other vendors."
Riley added that it was particularly gratifying to learn that the Websense Security Suite won in the category for best Intrusion Detection System/Intrusion Prevention System: "We have worked closely with Websense to integrate their Security suite into our family of security appliances and announced availability of the combined solution earlier this week. Our goal is to enable customers to deploy a single, cost effective solution that provides comprehensive defense in depth protection for core Microsoft applications including Exchange(TM), SharePoint Portal server, and IIS Webserver."
The NS Series is a family of security appliances powered by Microsoft ISA Server 2004 and Network Engine’s NEWS(TM) appliance management technology. These security appliances maximize defense-in-depth for core Microsoft infrastructure applications, and leverage the power of market leading web security capabilities from Websense.
Network Engines – THE Appliance Company
Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008
-
OT: Mark’s Sysinternals Blog: Sony, Rootkits and Digital Rights Management Gone Too Far
|Off Topic|
Like most responsible people in the business, I believe in the right of a copyright holder to be paid for his work. However, one place where the right stops is when the rights holder decides to install a Rookit on my computer.
This is a facinating and exceptionally well written account of how Sony is using Rookits to compromise the security of your Computers when you buy some of their copy protected music CDs. My concern now is whether Sony has deployed other rootkit technology in their products outside that included with CDs. This could be a major blow to Sony’s Desktop and laptop business, if Rootkit installation compromises all Sony out of box computing products.
Mark’s Sysinternals Blog: Sony, Rootkits and Digital Rights Management Gone Too Far: http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html
Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008
HTH,
Tom
Thomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
OT: F-Secure Helps Customers Detect Possibly Criminal DRM
|Off Topic|
Looks like F-Secure has come to the rescue. They have a Rootkit remover for the Sony spyware/rootkit ware.
Check it out at:
F-Secure : News from the Lab: http://www.f-secure.com/weblog/
Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008
UPDATE: It appears I was too hasty. F-Secure only detects the Sony Rookit — it will not remove it.
HTH,
Tom
Thomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
OT: Symantec assists Sony Development of Audio CD Rootkit Compromise
The story is getting
deeper. This article on ZDNet indicates that the firm that created the Rootkit
compromise included with some versions of Sony CD DRM technology worked with
Symantec to create this potentiall illegal malware:Sony CD protection sparks security concerns | Tech
News on ZDNet: http://news.zdnet.com/2100-1009_22-5926657.htmlDiscuss this
entry at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008HTH,
TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John
Galt?**
-
TFTP and ISA Firewalls
Question: Why do I have problems with TFTP?
Answer: TFTP is a complex protocol and is not friendly to "open a port"
mindset firewall admins.Details:
TFTP is trivial file transfer protocol. It is less complex than than the
FTP application protocol and is designed to be used for booting diskless
systems like X terminals, diskless workstations, and routers.TFTP does not support authentication; the TFTP client simply to the
server and requests a file and does not include an authentication header
in the protocol specification. If the server can service the request,
the server gives the client the file.There’s no reason to allow TFTP across your edge firewalls. However, if
you use the ISA firewall as a increase your network security by using it
as a perimeter firewall solution you can use the TFTP built in protocol
definition in Access Rules.TFTP uses UDP as its transport. TFTP servers listen on port 69 for the
initial client-to-server packet to establish the TFTP session, then use
a port above 1023 for all further packets during that session. Clients
use ports above 1023. Notice that dynamic ports are negotiated, which
makes TFTP a complex protocol and thus unfriendly to "open a port"
firewall admins.Simple stateful packet inspection "hardware" firewalls often have
difficulty supporting TFTP because the responses do not match what the
simple stateful packet inspection firewall understands. Simple packet
inspection firewalls considered a response to be valid only if its
source and destination are reversed from a recently received packet and
that information is stored in the simple packet inspection firewall’s
state table. With TFTP, the response packet has a destination that
matches a recent source, however, the source is new. And unlike the FTP
protocol where this is port negotiation with information about the
negotation carried in the FTP application layer data, TFTP does not
negotiate such ports and assumes a clear, routed path between source and
destination.For this reason, make sure there is a route relationship between the
source and destination network and you use the built in TFTP Protocol
Definition included in the ISA firewall. Do not used this Protocol
Definition for Server Publishing Rules and do not publish the TFTP
protocol.RECOMMENDATION:
Avoid the use of TFTP in all secure environments.Thomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
OT: Sony provides Decloaker for Rootkit bearing DRM Music CDs
Talk about a
public relations SNAFU!Sony releases a
decloaker for their music CD DRM rootkit, but all it does is act as a
"decloaker" — it won’t enable you to remove the malware.Get this, if you
want to remove the Rootkit from your computer, you have to call Sony
customer support.Now, that’s a
twist — I wonder if spyware writers will try this trick themselves. Offering to
remove their rootkits if you call them at a evanescent VoIP address bought with
a stolen credit card — at which time they will Phish you since you’ll believe
you’re talking to a real person.Some companies
have more dollars than sense.Check it out
at:Discuss this
post at:HTH,Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Hardware ain’t what it used to be – ISA Firewalls Come to the Rescue
Life has to be
getting rough for the "hardware" firewall folks. The image of a "device
inviolate" continues to crumble around their feet. The number of exploits
against hardware firewalls, especially against Cisco devices, is accelerating
and there’s no evidence that it’ll slow down in our lifetimes.
This makes sense.
Just as the Windows large installed base made it a tasty target for Internet
scumbags, the Cisco attack surface is even more tasty, because in spite of the
communal illusion, Cisco is not a security company — its a networking
company.Check this
out:Now, you can
become part of the solution by bringing in ISA firewalls to shore up security
weaknesses hardware firewalls bring to your organization. You don’t have to
white-box it either. You can use ISA "hardware" firewall appliances to get the
same level of support and management control you have with your soon to be
former "hardware" firewall solution.Check out the
Microsoft ISA Hardware Firewall page at:Check out the
ISAserver.org hardware firewall page at:Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Reminder: ISA Firewall Scripts
A quick reminder
to all ISA firewall admins that there are two places you can go to get scripts
to help manage your ISA firewalls.First, there’s the
premiere ISA firewall scripts site run by the ISA Firewall Grand Master
Jim Harrison. Jim’s site http://www.isatools.org is the
authoritative site for ISA firewall scripts.A new player in
the ISA firewall script space is Jason Fossen. Jason is a
Dallas native (like your’s truly) and has come up with an awfully nice ISA
firewall scripts site. Jason’s site is http://www.isascripts.org. If you haven’t
been there yet, you should make it a point to going there in the near future.
And I won’t even hold it against him that he works for SANS
😉Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Using an ISA Firewall with a Cisco CSS?
If so, make sure
that the Cisco CSS is not sending keepalive packets to the ISA firewall’s
external interface. The ISA firewall, by default, does not allow inbound PING
requests. If you require this functionality, you can create an access rule that
allows outbound PING from the source Network to the IP address on the external
interface of the ISA firewall.Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
World of Warcraft Cheaters using Sony Rootkit
Talk about a
Pandora’s box. Sony used unethical and questionably legal means to protect some
of their music CDs. Now other people of questionable ethics are making hay of
it.Check out this
securityfocus article on how cheaters are using the Sony Rootkit to steal from
Blizzard entertainment:Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
OT: World of Warcraft Cheaters using Sony Rootkit
Talk about a Pandora’s box. Sony used unethical and questionably legal means to protect some of their music CDs. Now other people of questionable ethics are making hay of it.Check out this securityfocus article on how cheaters are using the Sony Rootkit to steal from Blizzard entertainment:Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008HTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
The Miracle of the ISA Firewall Deployment Kits
Did you know that
almost all your ISA firewall configuration questions have already been answered?
Well, almost all
of them. Yes, its true! The answers to your ISA firewall configuration, branch
office, VPN, and Exchange Server publishing questions are all contained within
some ground-breaking documents called ISA 2004 Deployment
Kits.I know, its sounds
to good to be true. Don’t take my word for it. Check them out
at:Let me know what
you think of them and if you have any questions.Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
ISA Firewall Fact: You Do NOT Need Multiple NICs for Multiple Addresses
I see the question
come up too often. It goes something like this:"I have five
IP addresses I want to put on my external interface, but I only have four NICs
in my computer. Do I have to install more NICs to get all these IP addresses on
my ISA firewall"?The answer is
NO.You can bind
multiple IP addresses to the external interface of the ISA firewall. As long as
all these IP addresses are part of the same ISA firewall Network (typically part
of the default External Network, but this is not required) and the same Network
ID (do NOT confused network IDs with VLANs – do NOT let Cisco marketers drive
you understanding of TCP/IP networking) then you can bind them to the same
NIC.Just open the
Properties dialog box of the external interface and open the
TCP/IP Properties dialog box from there. Then click the
Advanced button and add more IP addresses.Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Microsoft Contractors, Document BUGS and ISA Firewalls Protecting WSUS
"Stupid is as stupid does, sir" — Forrest Gump to Lt. DanWhat am I talking about?Read this little flight from reality snippet from page 3 of the Implementing WSUS with ISA Server 2004 to Manage Remote Clients guide that you can download from http://www.microsoft.com/downloads/details.aspx?FamilyID=ab72eb03-09cf-4cfb-9af5-1a7dc9c80bc9&DisplayLang=en :"Note: This figure does not show any other firewalls used on the Contoso network. It is recommended that the ISA 2004 Server be installed behind another firewall device. Depending on security needs a second firewall may also be installed between the Internet Accessible Network and the Internal Network"You know, I don’t know if its the air, the water, pot, ecstasy, space base (http://parentingteens.about.com/cs/cocainecrack/l/blsldiccrack.htm), ghost buster (http://parentingteens.about.com/cs/cocainecrack/l/blsldiccrack.htm), roofies (http://www.urban75.com/Drugs/rohypnol.html) or a combination of the above, but there has to be something that causes people of otherwise average intelligence to act like they’ve just left Icepick Freeman’s office (http://en.wikipedia.org/wiki/Walter_Freeman)Listen up and listen up good. Print out the following and tape it to your bathroom mirror and recite it five times each morning:===================Print Below This Line==========================FACT:You do NOT need another firewall in front of the ISA firewall. Its is NOT recommended to have another firewall in front of the ISA firewall. Its is also NOT recommended that you not put another firewall in front of the ISA firewall. The only people who recommend putting another firewall in front of the ISA firewall are sales reps from Cisco, Juniper, Sonicwall and other firewall vendors.===================Print Above This Line==========================Is that so hard to understand? Its really simple. Its not rocket science, its not even medical science. If you have a problem with any of the concepts implicit or explicit in this FACT please post to the discussion link so that you can be disabused of you delusional thinking.Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008HTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Protecting Exchange Servers with ISA Firewalls
I was going
through my treasure trove today and found an article I did on using ISA
firewalls for Microsoft Exchange Server way back in October of 2004. This is a
great article on how to integrate ISA firewalls into your corporate network. I
highlights the ISA firewall’s flexibility as a front-end firewall, back-end
firewall, or only firewall on your network. Definitely worth a
read.Check out
Protecting Microsoft Exchange with ISA Server 2004 Firewalls at
http://www.msexchange.org/articles/2004protectexch.htmlDiscuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000009HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
ISA Firewall Preventive Measures
Did you know that
there is a ton of cool articles on how to configure the ISA firewall to block
attacks that you might have inadvertantly allowed? Yes, in the best of all
possible worlds, Dr. Pangloss would tell you that application of the Principle
of Least Priviledge would make preventative measures configuration a spurious
effort.Unfortunately, for
technicial, political or moral reasons, its not always possible to properly
deploy a well-designed least privilege firewall policy. If you’re in this
position, then you’ll need to get good information on how to configure the ISA
firewall with strong preventative measures.Check out the
Preventative Measures page at http://www.microsoft.com/isaserver/support/prevent/default.mspx for
more information.Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000009HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
True Silent Install of the Firewall Client Application
Ben, an
ISAserver.org member posts on the ISAserver.org message boards some cool
information on getting a true silent instllation of Firewall client
application:Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Slow Downloads through the ISA Firewall?
Are you
experiencing slow downloads through the ISA firewall for HTTP downloads? Try
this:1. Configure the
browsers to be Web proxy clients2. Configure the
browsers to use HTTP 1.1 through proxy connectionsDiscuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000009HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
-
MSDE mssql and Memory Usage and ISA Firewalls
Do you have problems with MSDE logging on your ISA
firewalls, in that the MSDE mssql process takes up what appears to you to be
"too much" memory? If you’re uncomfortable with MSDE using the amount of memory
its currently using, then check out the below for how to tune the amount of
memory used by this process.Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA FirewallsYou may experience high memory usage on an ISA Server 2004-based
computer that logs messages to an MSDE databaseArticle ID : 909636 Last Review : November 10, 2005 Revision : 1.1 SYMPTOMS
You may experience high memory usage on a Microsoft Internet
Security and Acceleration (ISA) Server 2004-based computer that is configured to
log messages to a Microsoft SQL Server Desktop Engine (MSDE) database.CAUSE
Microsoft SQL Server uses the available physical memory to
optimize MSDE insertion and query processes. SQL Server is designed to release
physical memory as soon as there is a request for physical memory from other
processes that are running on the computer.Note This behavior by
SQL Server does not affect the regular operation of other processes on the ISA
Server 2004-based computer.STATUS
This behavior is by design.MORE INFORMATION
Although this behavior does not affect the regular operation of
other processes, you may want to limit the amount of physical memory that is
allocated for SQL Server. To do this, follow these steps:1. Determine the maximum memory limit that is allocated for
SQL Server. To do this, follow these steps:a. Paste the following text into a text editor such as
Notepad, and then save the file by using a ".sql" extension. For
example, save the file as ?checksqlmemory.sql.?USE master
EXEC sp_configure ‘show advanced
options’, 1
RECONFIGURE WITH OVERRIDEUSE master
EXEC
sp_configure ‘max server memory (MB)’USE master
EXEC
sp_configure ‘show advanced options’, 0
RECONFIGURE WITH
OVERRIDEb. At the command prompt, type the following command: osql -E -S ServerComputerName\msfw
-i
Path\checksqlmemory.sqlNote
In this command, checksqlmemory.sql is the file that you
created in the previous step and Path is the full path of
the file that you created in the previous
step.2. Reduce the amount of physical memory that is allocated for
SQL Server. To do this, follow these steps:a. Paste the following text into a text editor such as
Notepad, and then save the file by using a ".sql" extension. For
example, save the file as ?setchecksqlmemory.sql.?USE master
EXEC sp_configure ‘show advanced
options’, 1
RECONFIGURE WITH OVERRIDEUSE master
EXEC
sp_configure ‘max server memory (MB)’,
MaxServerMemory
RECONFIGURE WITH OVERRIDEUSE
master
EXEC sp_configure ‘show advanced options’,
0
RECONFIGURE WITH OVERRIDENote In this example,
MaxServerMemory is the value of the physical memory in
megabytes (MB) that you want to allocate. For example, replace
MaxServerMemory with ?512.?b. At the command prompt, type the following command: osql -E -S ServerComputerName\msfw
-i
Path\setchecksqlmemory.sqlNote
In this command, setchecksqlmemory.sql is the file that
you created in the previous step and Path is the full path of the
file that you created in the previous
step.Note The optimum physical memory
allocation for SQL Server may vary for your system.
-
Firewall Client Script that Automatically Detects the Nearest ISA Firewall
Here’s a cool script put together by Networking-Guru that detects the nearest ISA firewall and automatically configures the Firewall client machine to use that ISA firewall. It also does dead firewall detection. Neat!Networking-Guru
New Member
Posts: 4
Joined: 26.Oct.2005
Status: offline
Hi,
I put a script together which detect which ISA Server (or Array) is closest
then sets the Firewall Client to use this Server(using FWCTOOL). The script
can also detect whether the firewall has failed so with a bit more work it
could be configured for failing over in the event of an outage.e.g. run at
regular intervalsIt is currently a early version of the script, but worth publishing so it
http://www.networking-guru.net/
can be adopted and improved upon in the community.
seeany comments please feed back
—
Networking-Guru!["[Smile]"](http://forums.isaserver.org/image/smiles/smile.gif "\"\"")
Discuss this post at: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htmHTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Britestream Networks Announces “Britestream Applied” Solution Set Offering for Microsoft ISA Server 2004
Britestream Networks Announces ?Britestream Applied? Solution Set
Offering for Microsoft ISA Server 2004New Solution
Delivers Enhanced SSL Performance and Fortified
SecurityAUSTIN, Texas ? October 3, 2005 ?
Britestream Networks, the leading provider of hardware-based data privacy
solutions , today announced the enhancement of its Britestream Applied: Windows
Server System program by announcing the additional support of ISA Server 2004.This extends Britestream ?s commitment to supporting the Window Server
Systems. With the Britestream solution installed, ISA can offer fortified
security to key Microsoft application servers like: Exchange, SharePoint Portal
Services and IIS.SSL-based encryption has become the predominant method of providing privacy
and confidentiality for data in transit. However, implementing SSL in software
can leave applications vulnerable to attacks and require updates which can
negatively impact the performance of the server. With the Britestream Applied
Windows Server System Edition, SSL can be turned on by default in more server
applications for the secure transmission of data, both inside and outside the
network.?This product offering is the next logical step in our Britestream Applied
program,? said Gordon Daugherty, CMO of Britestream. ?ISA 2004 represents a key
application security platform for Microsoft customers. We are very excited to be
able to enhance both the performance and security of the ISA Server.?Collective Technologies headquartered in Austin, Texas is a Microsoft Gold
Certified partner and one of Britestream?s Gold Certified channel partners. They
were an integral part of the early evaluation program and they will be among the
first to integrate it into their service offerings.?We are very please d to be able to integrate this Britestream solution into
our Microsoft-based solution offerings,? said David Leonard , VP of the
Infrastructure Services Group at Collective Technologies. ?This represents a
critical security and performance enhancement for all ISA Server 2004 users.?Security for ISA 2004
Adding the Britestream SSL security Network Interface Card (NIC) to an ISA
Server provides a simple way to add fortified security and to extend the
end-to-end secure connection to both remote and internal users. Britestream
securely stores the encryption keys and certificates within the tamper-resistant
chip. Only authenticated users can then gain access to the key.Scalable Performance for ISA 2004
Very often ISA Server is used as an application firewall for high volume
transaction web sites or Exchange environments. SSL is often used as
the default method to secure transmissions from the browser or Outlook
client. The Britestream SSL security NIC offers 100% offload and
termination for this extremely processor intensive function. It completely
offloads the SSL termination and processing from ISA allowing it to do
its deep packet inspection of the data. Together,
Britestream and ISA Server offer superior security and performance, with no
penalty for simply activating SSL. IT administrators can choose among
Britestream?s supported advanced cryptographic functions, including RSA key
sizes of up to 4K and a variety of encryption algorithms.Britestream Applied Windows Server System Edition is available now from
Britestream authorized channel partners. For more information please refer to
http://www.britestream.com.About Britestream
Britestream
Networks provides SSL security NICs or ASICs that deliver a unique
combination of powerful simplicity, un-compromised performance and fortified
security. Delivered in an industry-standard Ethernet NIC, Britestream?s solution
eliminates the need for network integration and provides 100% CPU offload. With
sensitive information stored in hardware, Britestream solutions are
tamper-proof. From existing applications such as servers, load balancers,
firewalls, and content switches to fast-growing emerging applications such as
SSL VPNs, XML/Web Services, and secure e-mail gateways, Britestream?s board and
chip solutions remove all barriers and penalties of deploying data security. For
more information, visit: http://www.britestream.com.Media Contact:
press@britestream.com
-
10 reasons to use ISA Server 2004 as your remote access VPN server and VPN gateway
Takeaway:
ISA Server
2004 isn’t just a multilayer filtering firewall and Web caching server, it’s
also a secure remote access VPN server or gateway. Here’s a look at some key
advantages that could make ISA Server the best VPN choice for your network.
Description:
Windows expert Dr. Thomas
Shinder created this list
that explains 10 key benefits of using ISA Server 2004 as your remote access VPN
server or VPN gateway. Here are just a few:- Active Directory integration for user
authentication. The ISA firewall’s VPN server enables you to leverage your
current Active Directory user database and group classifications to
authenticate with the VPN server. - RADIUS user mapping for non-Active
Directory users. The ISA firewall’s VPN server allows you to map
non-Windows users to Windows accounts. When user mapping is enabled, you can
create and enforce any firewall policy rules that apply to
users. - Granular access control over what VPN
users can access on the corporate network. Unlike the typical hardware VPN
server, the ISA firewall’s VPN server enables you to easily control what users
access once they connect to the corporate network through the VPN link. You
can use the ISA firewall’s per-user/per-group access controls and extend those
to determine which resources users can access once
connected.
Check it out
at:DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htmThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
- Active Directory integration for user
-
Presentation: 10 things you should know about securing DNS
Hey folks, here’s
a short tip sheet I did on how to secure your DNS servers. By no means is it
comprehensive, but it’ll give a quick start on getting a secure DNS
configuration up and running faster than you might otherwise
🙂Takeaway:
DNS software is a favorite target of
hackers, which can lead to security problems. This PowerPoint presentation
explains some of the most effective ways to lock down DNS servers.
Description:
Without DNS, you can’t resolve an
Internet address, and customers can’t send e-mail to you or browse your Web
site. Unfortunately, DNS servers are also vulnerable to a multitude of attacks,
which can come in several forms. Dr. Thomas
Shinder put together a
list of 10 key tactics you can follow to help make DNS more secure,
including:- Using DNS forwarders
- Disabling zone transfers
- Setting access controls on DNS registry entries
- Using DNS resolvers
We’ve turned the PDF version of his list into a PowerPoint presentation so the information can be
shared and discussed with your IT staff.What do you think of using
discussion of this download and let us know your opinion.
PowerPoint as a vehicle for sharing this type of information? Join theDownload at: http://techrepublic.com.com/5138-1035-5931066.htmlDISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htmThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Hole found in widely used VPN gear — ISA Firewalls are NOT Affected by this Hardware VPN Firewall Flaw
I’ve been telling you folks time and again that hardware
firewalls are not a security panacea, and in fact are often less secure than a
properly configured ISA firewall. Unfortunately, its hard for "network" guys to
appreciate this simple fact. The time is coming soon where CxOs are going to
realize that their "networking" guys are a major security risk to the data
you’re trying to secure . The following article provides some a key fact
point that illustrates just the tip of the "hardware" security
illusion.See
the link for the rest of the story.(InfoWorld) – Virtual private
network products from a variety of vendors, including Cisco Systems Inc. and
Juniper Networks Inc. are vulnerable to a denial of service attack, thanks to a
bug that was recently discovered by researchers at Finland’s University of
Oulu.The flaw affects a component of the IPsec (Internet Protocol Security)
protocol used by VPN (virtual private network) software and hardware to securely
exchange data over the Internet. While there is some risk of affected VPN
systems being taken over by attackers, a more likely threat is a DOS (denial of
service) attack, in which machines would be forced to reset repeatedly, jamming
up networks and causing headaches for users."This issue is … very important to you if you are using an IPsec VPN," said
security research center The SANS Institute in a statement posted to its Web
site. "While this is not as severe as remote code execution, it can still break
a business if critical network links are impacted."DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htmThomas
W Shinder, M.D.
Site:
http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book:http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Group Policy Updates on ISA Firewall VPN Clients
Domain joined VPN client machines can use Group Policy refreshes to stay secure, but if users don’t log on using the Log on via dial-up networking option in the log on dialog box, then they won’t get the Group Policy updates and they won’t get password change notifications either. This can create a potential security issue, since Group Policy is a pivotal part of your overall corporate security scheme. You can get around this issue for users who forget to log on correctly by using a post-connection script (which you can include in your CMAK profile) to runs the following line:gpupdate.exe /force /wait:0BTW — do you know what the gpupdate switches are? I looked them up just for fun. You can amaze your friends at your next MCSE cocktail party with your knowledge of these switches and how to use them:/Target:{Computer | User}
This switch can be used if you want to specify that only user or computer policy settings are updated. If you do not use any switch, by default, both user and computer policy settings are updated./Force
This switch reapplies all policy settings. By default, only the policy settings that have changed are applied./Wait:{value}
This switch enables you to set the number of seconds that you have to wait for any policy processing to finish. The default value is 600 seconds. The value, zero (0), means that you do not have to wait. The value, -1, means that you have to wait indefinitely. When the time limit is exceeded, the command prompt returns, but the policy processing continues./Logoff
This switch can cause your session to log off from the computer after the Group Policy settings have been updated. This behavior is required for those Group Policy client computer extensions that do not process policy on a background update cycle, but are able to process policy when a user logs on to the computer. Two examples of such behavior can be observed with the user-targeted Software Installation and Folder Redirection features. This switch does not have an effect if extensions have not been called that require you to log off from the computer./Boot
This switch can cause a restart of your computer after the Group Policy settings are updated. This behavior is required for those Group Policy client extensions that do not process policy on a background update cycle, but are able to process policy at Startup. An example of this behavior is observed with the computer-targeted Software Installation feature. This switch does not have an effect if extensions have not been called that require a restart of your computer.
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htmHTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
ISA Server or a “Hardware” Firewall Appliance?
Here’s a great post from the
securityfocus.com, focus-ms mailing list from an ISA firewall fan. Nick does a
great job describing the advantages of using an ISA firewall over "fry up your
own packet filter" alternatives.—–Original Message—–
From: Nick
(last name and address withheld for security reasons)
Sent: Tuesday, November
15, 2005 5:36 PM
To: focus-ms@securityfocus.com
Subject: RE: ISA Server or
Firewall Appliance?I’ve been using ISA 2004 on a box that’s been facing
the internet since it’s
was released as a public beta. I’ve run other
firewall "appliances" as well
as both m0n0wall and pfSense (pfSense is a
variant of m0n0wall optimized for
use on standard PC hardware) and I’ve
really found it to have the best
featureset. I also read an article on
Network Computing or Windows Magazine
that put ISA2004 as one of the fastest
firewalls, almost achieving "full"
1000Base-TX speeds.I think ISA’s
real redemption comes from the hardware that it runs on,
standard (sometimes
cheap) PC components. If you get a power surge on an
Ethernet card
(because only in the engineer’s dreamworld does the Ethernet
cable get it’s
on surge arrestor) and blow the card, there’s a $20
replacement at the local
computer store. On the other hand, you have the
sleek, integrated units
that you have to throw away or RMA if something gets
zapped, and you won’t be
able to troubleshoot it to the same degree you’d be
able to troubleshoot an
ISA server.Personally, I was able to configure the ISA2004 box to do
just about
everything, once I understood how the rules worked. I’ve got
setup to
demand dial a PPPoE connection, it also handles the site-to-site
VPN, which
was a PPTP connection at first, but then IPsec after the remote
site got a
sonicwall Pro 330 (which is no where near as configurable,
IMO). The only
real issues I’ve had with it are more related to
windows, rather than ISA
(compared to a cisco 2600, windows’ routing table
leaves something to be
desired).m0n0wall is a nice package if you’re
planning to use something like a PC
Engines’ WRAP or a Soekris single-board
computer (WRAPs are limited to about
45Mbps throughput, soekris is
substantially more powerful). pfSense was
forked from the m0n0wall
source and developed specifically to run on
standard PC hardware, it’s SMP
aware so there’s a benefit if you need a
really fast firewall. PfSense
has a lot of features, but I don’t think
they’ll all ever be as mature as the
features that ISA has, which has more
features than I have explored.I
don’t know how helpful I’ve been, but I figured I’d speak up since
I’ve
worked with a few different types of firewalls (I work for an
ISP).
==========================
==========================DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htmHTH,
Thomas W Shinder, M.D.
Site:
http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP —
ISA Firewalls
**Who is John Galt?**
-
Microsoft announces ISA Server 2004 Service Pack 2 and ISA Server 2006
Here’s somebody talking about the ISA firewall’s upcoming Service Pack 2. The ISA firewall’s Service Pack 2 is going to be more than just some fixes and tuneups. This Service Pack will include some all new features, such as:-
Support for compressed HTTP content, which will significantly speed up your OWA access and branch office user experience when they’re accessing Web content at the main office.
-
BITS caching, which will allow the ISA firewall to cache byte range requests. What’s this mean? It means that when one client on the network requests content from the Windows or Microsoft Update Site, the content will be held in the ISA firewall’s Web cache and the next client to make a request for the same content will get it from the cache. The BITS feature is a killer upgrade which will save you megabucks in bandwidth costs for branch offices that do not have WSUS servers on site
-
The HTTP QoS feature is a bit a of red herring — I won’t tell you about this yet, but don’t get your hopes up if you’re looking for Internet bandwidth shaping and quotas.
As for ISA Server 2006, all I can tell you is I know nothink! 😉===================================This article is written by Raymond Comvalius a Security Consultant from the Netherlands is also attending the MS IT Forum and is guest contribituer to the IT Forum coverage on Bink.nu.Microsoft is currently in the final stages of beta testing ISA Server 2004 SP2. Besides a couple of bug fixes, SP2 will contain the following new features:
? HTTP compression
? BITS caching
? HTTP QoS
The service pack is ought to be out in January 2006. This means that ISA Server 2004 Enterprise Edition has never seen a SP1. SP1 has been the service pack for ISA Server Standard Edition only.
The next version of ISA Server, codename Wolvereen and currently planned as ISA Server 2006, is planned for release in the second half of 2006. So it might end up being named ISA 2007 [;)]DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htmHTH,Thomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
-
Configure ISA 2004 as a Network Services Segment Perimeter Firewall – Part 5: Configuring the Clients and DNS Infrastructure
Configure ISA 2004 as
a Network Services Segment Perimeter Firewall – Part 5: Configuring the Clients
and DNS InfrastructureIn the first four
parts of this series on creating a network services segment using ISA firewalls,
we discussed general DMZ and perimeter segment networking principles and design
concepts, configuration of the network services segment ISA firewall, and
routing principles and procedures required to make our solution work. We also
configured the edge ISA firewall so that users on the Corpnet ISA firewall
Network could gain access to Internet resources and external users could access
Exchange Server resources located on the network services segment.Check it out at: http://isaserver.org/tutorials/Configure-ISA-2004-Network-Services-Segment-Perimeter-Firewall-Part5.htmlHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Using the ISA Firewall as a Network Services Perimeter Firewall
One of the biggest
differences between networks of the 90s and 21st century networks is the fact
that there are no longer any trusted networks. While the Interent edge
of your network is exposed to a larger attacker surface, most security
analysts will agree that attacks, compromises and exploits from within the
corporate network are more common, and more destructive, than what comes in from
the outside. For this reason, we can no longer implicitly trust our internal,
corporate network and the traffic moving through it.This has lead to
an increasing awareness in the importance of Security Zones.
Each security zone is populated by a group of devices that share a common level
of trust, or trustworthiness. Each zone zone also needs to take into account the
common and aggregate value of the devices within that zone. In general, the less
trusted the security zone, the less valued are the assets contained within
it.For example, your
Exchange Servers, SQL servers and domain controllers represent a different
security zone than wireless devices connected to an anoymous access WAP, and
wired hosts populated with Windows XP computers run by temporary clerical
workers is a different security zone than both the servers and the anonymous
access wireless clients.This has led to
the push for corporate network perimeterization and strong access controls
between hosts belonging to each perimeter. The best way to do this is to use
internal firewalls to control access between network security zones. The good
news is that an ISA firewall is an idea candidate for an internal network
perimeter firewall because of its strong stateful packet and application layer
inspection feature sets.That’s why I did a
series of articles on how to configure the ISA firewall as a network services
perimeter network firewall. If you’re interested in taking network security to
the next level, then check out all five articles in the
series:Configure
ISA 2004 as a Network Services Segment Perimeter Firewall – Part
1
Configure
ISA 2004 as a Network Services Segment Perimeter Firewall – Part
2
Configure
ISA 2004 as a Network Services Segment Perimeter Firewall – Part
3
Configure
ISA 2004 as a Network Services Segment Perimeter Firewall – Part 4Configure
ISA 2004 as a Network Services Segment Perimeter Firewall – Part
5Discuss
this post at: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
The Miracle and the Mystery of ISA Firewall Secure Exchange RPC Publishing and its Limitations
It doesn’t seem that long ago when I wrote
the aritcle Enabling Full Outlook Client Access Anywhere using the ISA
Firewall?s Secure Exchange RPC Filter at http://www.isaserver.org/articles/2004securerpc.html
In that article I pointed out that the ISA firewall enables the Liebnitz
scenario (best of all possible worlds — aka Pangloss Scenario A) where you can
use the full Outlook MAPI client from anywhere in the world and never need to
change the configuration information on the Outlook client.In this scenario, the user is at home, opens
Outlook to read mail and then closes the laptop to hibernate the machine while
Outlook is running. Then the user goes to the office, brings the laptop out of
hibernation and Outlook automatically connects — the user didn’t even need to
start Outlook becuase it was already open when the machine exited hibernation.
The laptop connects to the Exchange Server while the user is in the office
without a skip. The user then closes the laptop, with Outlook still open, and
hibernates the machine.He then goes to the airport. He connects to
the WLAN at the airport and Outlook starts working automatically soon as the
WLAN connection is established. No muss, no fuss, no VPN, and doesn’t even
require Outlook 2003. Then the user closes the laptop to hibernate (not closing
Outlook before hibernation) and get on the plane. He gets to the hotel, plugs
into the hotel broadband network, opens the laptop to bring it out of
hibernation, and Outlook just works. Never did the user have to touch a
configuration open, never did the user need to establish a
VPN.However, this scenario does have some limitations
and I discussed them when a member of the http://www.isaserver.org mailing list asked why
anyone would want to mess with RPC/HTTP when secure Exchange RPC Publishing is
available. That was a good question and I gave him a comprehensive response,
which I am now sharing with you:
However, there are limitations to secure RPC publishing:1. "Open
a Port" firewall admins often will block the RPC endpoint
mapper (TCP 135).
This was a big problem when Blaster hit, and even the
moron ISPs decided to
DoS their customers by "doing them a favor" and
blocking outbound access to
this port. Things are much better now, and
I’ve been able to use Secure
Exchange RPC at most hotels and airports,
but there are still a number of
locations that block this port, or have
unintelligent firewalls/firewall
admins who don’t support RPC outbound
from the remote location2. You
need to publish each mailbox server. In a simple one or two box
Exchange
organization, secure Exchange RPC is a great option. But for
companies that
have lots of Exchange Servers, publishing each one can be
a hassle.3.
The weak link in the security chain for many companies is "the network guy" as
he will
balk at opening the packet filters on their packet filter device
(aka
"firewall") in front of the ISA firewall. Since the Syphco rep
slipped
the network guy some roofies, he’s convinced Spyhco is a
security
company, when in fact they’re a network company and security is
a
sideline, and if they were to secure something, its this
"network"
thing, instead of securing the server applications that require
the
security. So, you’ll end up in a war with both the "open a port" network
dude and
management, doesn’t know the difference, other than he paid 50 grand
for
the hardware firewall and only 5 grand for the ISA firewall, and
since
money talks and BS walks, you lose because the psychiatric (notice
I
used the term psychiatric and not psychological, because there’s
clearly
some psychopathology involved with spending that much money for a
really
fast packet filter) motivators are on his side, not yours.4.
When remote users get stuck because the trisomy running the packet
filter
device (ah, I mean firewall) doesn’t understand RPC or the RPC
endpoint
mapper is blocked, then you have to rely on VPN. Unfortunately,
some popular
packet filter firewalls don’t have PPTP NAT editors, so you
can’t use that.
OK, you could use L2TP/IPSec, which is secure and fully
supports NAT-T, and
the "network guy" on the remote client end probably
hasn’t figured out where
the "close a port" button is for that. But this
highlights the reason why you
choose to use Secure Exchange RPC
publishing in the first place, which was to
avoid using VPN — not
because VPN isn’t good, because its very good, not
because you can’t
limit VPN users based on user/group to access only the
Exchange Server
using the MAPI client, because you can, but because of the
user
overhead, which is what you were trying to avoid.5. So, instead
of falling back on VPN, Microsoft came up with the great
idea of doing what
the Internet criminals do, but without the criminal intent. In
fact,
quite the oppostite of criminal intent becaues they did this to
allow
users full Outlook MAPI client access to the Exchange
Server in spite of the
criminal stupidity of the NAT devices, packet
filter firewalls, and
lissencephalic "hardware" firewall admins who
check their horoscopes and
throwin’ bones to see what "port they should
open" today. The common
tool of Internet criminals and Microsoft’s RPC/HTTP is to tunnel another
protocol inside an
HTTP header, in this case Exchange RPC. Since "open a
port" firewall
admins don’t care about application security (they’re only
concerned
with ‘port attackers’ and ‘pinhole abusers’), they allow
outbound TCP
ports 80 and 443. RPC/HTTP uses TCP 443 to reach the RPC proxy,
where it
is then detunneled and the nekkid RPC communcaitons move from the
RPC
proxy to the Mailbox server. The responses return to the RPC proxy,
the
HTTP header is added, and returned to the client. No need for VPN,
no
need for RPC endpoint mappers. All secure within an SSL
tunnel.Well, those are some of the reasons, there are more, like rainbow
tables and integrated authentication. However, when the enviornments on the
client
and server side for Secure Exchange RPC publishing are right, then
it
r0XOrS. When they’re not, life S0XouRxS.DISCUSS THIS POST
AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htmThomas
W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP —
ISA Firewalls
**Who is John Galt?**
-
Quick Tip: Outbound VPN Access through the ISA Firewall
Every now and then
we get questions on configuring the ISA firewall for outbound VPN access. Here’s
what you need to do:1. Determine what
VPN protocol is required. PPTP, L2TP/IPSec, IPSec tunnel mode,
NAT-T?2. Create Access
Rules allowing the required protocols.3. Configure the
clients as SecureNAT clients4. Disable the
Firewall client applicationThat’s all you
need to do. Keep in mind that the ISA firewall will not be able to perform
application layer inspection on VPN tunneled communcations, so you better have
implicit trust in the users who are launching VPN connections from within your
corporate network.Discuss
this post at: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Publishing Multiple Non-SSL Web Sites with a Single IP Address using ISA Firewalls
One of the very cool things you can do with ISA
firewall is publish multiple Web sites using a single IP address on the external
interface. You can use a single IP address on the external interface of the ISA
firewall to publish multiple sites, or if you have a hundred addresses on the
external interface. The ISA firewall?s Web proxy filter component is what makes
it all happen.Read all about it
at: http://isaserver.org/tutorials/Publishing-Multiple-Non-SSL-Web-Sites-Single-IP-Address-using-ISA-Firewalls.htmlHTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
ISA on SBS Webcast by Amy Babinchak
Amy Babinchak is
the ISA on SBS guru and you’ll do yourself a favor by checking out this Webcast
she did recently on how to optimize ISA firewall configuration on an SBS 2003
computer. It won’t be up forever, so you better fire up those browsers and
screen recorders and listen up now.Check out Amy’s
Web cast on her blog at http://isainsbs.blogspot.com/2005/11/isa2004-recorded-live-meeting.htmlDISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Network Engines takes Redmond Magazine’s ISA Hardware Firewall Award
Network Engines NS 6000
Series
Judge: Joern Wettern
The enterprise-class functionality, managed software updates and outstanding
ease of use are three reasons why the Network Engines NS 6000 series is Joern Wettern’s pick for
firewall system. "I was impressed with the usability, especially for smaller
company’s branch offices that need enterprise-level firewall protection, but
don’t have extensive experience in configuring firewalls," he says. "It’s an
ingenious customization of turning an existing product (Microsoft ISA Server
2004 running on Windows Server 2003) into a true appliance. At the same time, it
shields an administrator from tasks that are not part of the firewall, such as
operating system configuration and software updates."For more
information on Redmond Magazine’s Editor’s Choice Awards, head
on over to http://redmondmag.com/features/article.asp?EditorialsID=523DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Add These Sites to Your ISA Firewall’s BLOCKED Sites Domain Name Set
Here’s a list of
anonymous proxy sites that help your malicious users bypass the ISA Firewall’s
access control policies (actually, any firewall’s access control policies, not
just the ISA firewall’s). Make sure to include them in your BLOCKED
Sites Domain Name Set and use that set in your global Deny
rule.http://www.xanproxy.be/
http://ieproxy.com/
http://www.techtakeover.com/search/
http://www.spysurfing.com/
http://www.myfreeproxy.be/
http://worldwideproxy.com/
http://www.proxytastic.com/
http://www.nomorelimits.net/
http://www.proxifree.com/
http://browseatwork.com/
http://www.netsack.net/
http://www.afreeproxy.com/
http://cgi-proxy.net/
http://www.coveredtracks.com/homepage.php
http://www.easyproxy.org/
http://www.privatizer.net/
http://www.secure-tunnel.com/
http://www.spiderproxy.com/
http://thestrongestlinks.com/
http://www.unipeak.com/
http://betaproxy.com/
http://proxy7.com/
http://webwarper.net/
http://www.chronicpulse.net/
http://www.space.net.au/~thomas/quickbrowse.html
http://www.proxyking.net/
http://w3privacy.com/
http://freeproxy.us/
http://www.goproxing.com/
http://greenrabbit.org/
http://hujiko.com/
http://poxy.us.to/
http://hidemyass.com
https://proxify.com/
http://projectbypass.com/
http://www.proxymouse.com/
http://letsproxy.com
http://www.the-cloak.com/login.htmlDISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
10 things you should do to protect your network against wireless devices
Takeaway:
Learn what
you can do to protect your corporate network assets from both managed and
unmanaged wireless devices.Description:
Plenty of information is available that
explains how to create a secure wireless network. But what about securing your
network FROM wireless devices? This list of pointers from Dr. Thomas Shinder
will help you reduce the
risk. Recommendations include:- Place anonymous access WAPs on perimeter
networks - Limit anonymous access perimeter segments to
unencrypted protocols - Enforce strong bandwidth control on anonymous
access WAP segments - Use IPSec-based domain isolation to protect
domain members
Download the this
top ten list at: http://techrepublic.com.com/5138-1009-5962748.htmlDISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
- Place anonymous access WAPs on perimeter
-
Webcast with Tom Shinder: Inside Application Layer Inspection
Want to know more about the ISA firewall’s stateful application layer inspection feature set?Want to get a few minutes of PowerPoint slides and a lot of minutes of demonstrations on how to do cool stuff with the ISA firewall?Then check out this Webcast. I’m going to demo stuff that’s never been demo’ed before, and I guarantee that you’re going to like it a bunch.? TechNet Webcast: Inside Application Layer Filtering (Level 300)
Tuesday, November 29, 2005 – 11:00 A.M. – 12:30 P.M. Pacific Time
Thomas W. Shinder, M.D., ISA Server MVP, TACTEAM.
How safe is your firewall? Buffer overruns, mail viruses, and other attacks penetrate many corporate firewalls and use protocols such as HTTP, SMTP and FTP to defeat port-based rules and pass attacks inside data streams. This webcast shows how Microsoft Internet Security and Acceleration Server 2004 features such as URL filtration, pre-authentication, syntax checking, and intelligent content inspection help deliver a high-degree of protection through application awareness. Understand the SMTP filter model and the HTTP filtering engine, and see how these integrate with Internet Information Services 6.0, Microsoft Exchange Server 2003, and the Remote Authentication Dial-In User Service to help form a well-defined defensive strategy.DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htmHTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
ISAserver.org – November 2005 Newsletter
ISAserver.org Newsletter of November 2005ISAserver.org –
November 2005 Newsletter
The #1 unofficial ISA Server resource siteISAserver.org Newsletter of November 2005
Sponsored by: Rainfinity
ISAserver.org
Newsletter
November 2005In this issue:
- Serving the ISA Firewall Community: What
can ISAserver.org Do for You? - Tom and Deb Shinder’s Configuring ISA
Server 2004 — Order Today! - ISAserver.org Learning Zone Articles of
Interest - KB Articles of the Month
- Tip of the Month
- ISA Firewall Links of the Month
- Ask Dr. Tom
Welcome to the
ISAserver.org newsletter! Each month we will bring you
interesting and helpful information on ISA Server. We want to
know what all *you* are interested in hearing about. Please
send your suggestions for future newsletter content to: tshinder@isaserver.orgDownload RainWall High Availability for ISA:
Optimize Firewall, Internet and Content Security
Rainfinity
delivers High Availability and Dynamic Load Balancing
for Microsoft ISA 2004. Rainfinity’s next generation
high availability platform extends beyond the firewall
to protect and optimize all of your network resources,
including your ISP connections and content security.
This is the only integrated solution for firewall and
Internet connectivity that takes advantage of all nodes
with load balancing and advanced failure detection. Download
RainWall and RainConnect for ISA
today!1. Serving the ISA Firewall Community: What
can ISAserver.org Do for You?By Thomas W Shinder MD,
MVPWith the new year coming at us with a bullet, I’d thought
I’d take an opportunity to review with everyone what we have
on ISAserver.org to help out the ISA firewall community, and
introduce some things we have in mind for the future. With
your help we hope to expose new avenues of communication that
will allow you to get the most out of your ISA firewall
experience.At this time we have the following features that I think
provide the most value to the ISA firewall community:- Hundreds of articles on how to configure the ISA
firewall for a huge number of networking scenarios - Most articles include links to message board sections
where you can ask questions about the content of the article
to the author - The ISAserver.org mailing list where you can ask
questions about ISA firewall problems and get answers - The monthly newsletter where you get a rundown on what’s
been happening on ISAserver.org for the last month, and also
get some tips and tricks and links to interesting stuff in
the ISA firewall world - Real time article updates and RSS feeds, which enable
you to get real time updates when new content is released on
the site - Sections on hardware ISA firewalls and software add-ons
that provide extra value for the ISA firewall. ISAserver.org
members can also comment on the hardware and software
offerings and rate the products
We’ve had a lot of success with these interactive features
of the site and now we’re thinking of the future and taking
things to the next level. I’ve had a few ideas on what we can
do to provide extra value for ISAserver.org members and I’d
like to share a few of those with you:- Weekly newsletter covering the week’s KB articles, where
I discuss the articles and the implications of your ISA
firewall deployment - Weekly "Questions of the Week" newsletter, where I
answer in depth two questions I’ve received from email
queries, the ISAserver.org message boards, and the
ISAserver.org mailing list - A weekly podcast, where I discuss some of the
interesting ISA firewall issues of the week, articles that
have gone up on the site, and interviews with Microsoft ISA
firewall project managers and support professionals - An ISAserver.org "reference architecture" guide, that
walks you through the steps of creating the core lab network
on which you can replicate all the configurations and
scenarios discussed in the articles at http://www.isaserver.org - An ISAserver.org certification program where you take a
little quiz after reading an article, and then send it to
us. After you get X number of credits on the quizzes, you
get a continuing education certificate from us recognizing
your professional efforts to stay up to date on ISA
firewalls
That’s just a few of the things we have in mind. We don’t
have the personnel to implement all of these new features
right away, but if there is something you’d like to see happen
quickly, let me know. Send me a note at tshinder@isaserver.org
with your opinion. Finally, if there’s something I didn’t
mention, but that you’d like to see on the ISAserver.org site,
let me know! Thanks! -Tom.=======================
Quote of the Month – "Give a man a match and he’ll be
warm for a minute. Light a man on fire and he’ll be warm the
rest of his life"=======================
2. Tom and Deb Shinder’s Configuring ISA
Server 2004 – Order Today!By Thomas W Shinder
Tom and Deb
Shinder’s best selling books on ISA Server 2000 were the
"ISA Server Bibles" for thousands of ISA Server 2000
network administrators. Tom and Deb Shinder present you
with their next ISA Server book, Configuring ISA
Server 2004. This book leverages the over two years
of pre-release experience Tom and Deb have had with ISA
Server 2004, from pre-alpha to RTM and all the versions
and builds in between. They’ve logged literally 1000’s
of flight hours with ISA Server 2004 and they have
shared the Good, the Great, the Bad and the Ugly of ISA
Server 2004 with their no holds barred coverage of
Microsoft’s new one of a kind application layer
inspection firewall.While the ISA Server 2000
books were good, Configuring ISA Server 2004 is
even better. Tom and Deb bring their unique "insider’s
perspective" to provide you with information that isn’t
and won’t be available anywhere else! Order your copy of
Configuring ISA Server 2004 by clicking the link.
You’ll be glad you did.
Click
here to Order your
copy today Download RainWall High Availability for ISA:
Optimize Firewall, Internet and Content SecurityRainfinity
delivers High Availability and Dynamic Load Balancing
for Microsoft ISA 2004. Rainfinity’s next generation
high availability platform extends beyond the firewall
to protect and optimize all of your network resources,
including your ISP connections and content security.
This is the only integrated solution for firewall and
Internet connectivity that takes advantage of all nodes
with load balancing and advanced failure detection. Download
RainWall and RainConnect for ISA
today!3. ISAserver.org Learning Zone Articles of
InterestWe have a great group of articles in the Learning Zone that
will help you get a handle on your most difficult
configuration issues. Here are just a few of the newer and
more interesting articles:- Configure
ISA 2004 as a Network Services Segment Perimeter Firewall –
Part 5: Configuring the Clients and DNS Infrastructure - Installing
ISA Server 2004 Enterprise Edition – Part 2 – Installing ISA
Server 2004 Firewall on two Servers - MSTerminalServices.org
– New Terminal Services and Server Based Computing Website
added to the TechGenix Network! - Bypassing
the Firewall Client using Locallat.txt File - Configure
ISA 2004 as a Network Services Segment Perimeter Firewall –
Part 4: Configuring the Edge ISA Firewall - Installing
ISA Server 2004 Enterprise Edition – Part 1 – Installing and
Configuring the Configuration Storage Server - Configure
ISA 2004 as a Network Services Segment Perimeter Firewall –
Part 3: Creating Services Access Rules and Joining Machines
to the Domainand Joining Machines to the Domain
4. KB Articles of the Month
Here are some interesting and useful ISA Server related Q
articles posted by Microsoft in the last month:- MMS
stream splitting is not supported in ISA Server 2004 - ISA
Server 2004 does not listen for Web proxy requests after you
enable a network adaptor or remove an IP address - You
may experience a long delay when you try to use Internet
Explorer to access a redirected Web page and Internet
Explorer uses ISA Server 2004 as a Web proxy server - POP3
clients cannot connect to an Exchange Server computer that
is behind an ISA Server firewall - You
may experience high memory usage on an ISA Server 2004-based
computer that logs messages to an MSDE database - Active
mode FTP client programs cannot access an FTP server from
behind Internet Security and Acceleration Server 2004 - Routing
and Remote Access stops responding in Windows Server 2003
- In
Internet Security and Acceleration Server 2004, the password
appears to be automatically generated in the "Dialing
Configuration" dialog box, but the dial-up connection does
not work
5. Tip of the Month
Ever find yourself in this position:
- The Firewall client is installed on the client machine
- The Require all users to authenticate option is enabled
on the Web proxy listener for the network(s) that the
Firewall client(s) are connecting from - Users get hit with multiple authentication prompts from
out of no where?
If so, there’s a fix. You need to add the
SkipAuthenticationForRoutingInformation value into your
Registry. The step by step configuration information can be
found in the KB article You receive error messages if the
Internet Security and Acceleration Server 2004 Firewall Client
program is configured for auto-discovery or if you try to
configure this program for auto-discovery at http://support.microsoft.com/default.aspx?scid=kb;en-us;885683HTH, Tom
Download RainWall High Availability for ISA:
Optimize Firewall, Internet and Content SecurityRainfinity
delivers High Availability and Dynamic Load Balancing
for Microsoft ISA 2004. Rainfinity’s next generation
high availability platform extends beyond the firewall
to protect and optimize all of your network resources,
including your ISP connections and content security.
This is the only integrated solution for firewall and
Internet connectivity that takes advantage of all nodes
with load balancing and advanced failure detection. Download
RainWall and RainConnect for ISA
today!6. ISA Firewall Links of the Month
Do you use the Firewall client on your client systems? I
sure hope so, because the Firewall client significantly adds
to the level of security the ISA firewall can provide your
organization. As a Firewall client fan, you’ll want the
Firewall client tool pack. It includes tools that enable you
to set autodiscovery settings and Web browser config on the
Firewall clients, and also has a number of diagnostic tools.
Check out the Firewall Client Tool for ISA Server 2004 atEver wonder what’s in your Web cache and how to remove
stuff in the cache? If so, then you need the cachedir.exe
tool. Check it out atWant to know how to install and configure the ISA firewall
to publish Exchange Server services, like OWA, OMA, Exchange
ActiveSync, POP3, SMTP and IMAP4? Then check out the
ISA/Exchange Deployment Kit atAre you looping back through the ISA firewall when you
shouldn’t be doing so? If so, then check out Configuring
Internal Client Access to Internal Resources in ISA Server
2004 athttp://www.microsoft.com/technet/prodtechnol/isa/2004/plan/internalclientaccess.mspx
Are you looking to deploy remote access quarantine for your
VPN clients but don’t have the time or the inclination of
putting together a development project to support it? Then
check out Fred Esnouf’s QSS security suite for ISA firewalls.
He’s recently released a an update, which you can learn out athttp://www.esnouf.net/qss_main.htm
Finally, here’s something everyone needs. Who doesn’t have
problems connecting to the Microsoft Update site through the
ISA firewall? Right, no one. To get a handle on this problem
we all need to read Troubleshooting Windows Update v5
Authentication Issues athttp://www.microsoft.com/technet/prodtechnol/winxppro/support/updateauthen.mspx
7. Ask Dr. Tom
QUESTION: I have two interfaces on my ISA firewall:
one interface connected to the Internet and one interface
connected to the corporate network. There are five network IDs
managed by a router on the corporate network. I create four
internal Networks for the network IDs that weren’t covered by
the default Internal network. Now I’m seeing errors on my ISA
firewall indicating that my other Internal Networks are not
"reachable" from the Internal Network interface. What
gives?ANSWER: All IP addresses behind a single NIC on the
ISA firewall as considered to be part of the same Network.
Their ISA firewall’s view of Networks is that communications
between different Networks must traverse the ISA firewall. Any
communications that take place directly between two hosts take
place on the same Network. So, even though you have multiple
Network IDs located behind the same Network interface on the
ISA firewall, the ISA firewall considers them all a single
Network because the ISA firewall doesn’t handle communications
between any two hosts located behind the same ISA firewall
NIC. This discourages the poor practice of looping back
through the ISA firewall to reach hosts on the same
Network.QUESTION: My clients on the corporate Network are
able to connect to all Web sites except the Web sites we
manage on our Internal network. What’s up with that?ANSWER: The most likely reason for this problem is
that your corporate network clients are attempting to access
the Web sites by looping back through the ISA firewall. You
can correct this problem by configuring the Web Proxy and
Firewall clients to use direct access for internal IP
addresses and domains, and to configure a split DNS so that
internal network hosts resolve names for internal resources to
their internal IP addresses.Got a question for Dr.
Tom? Send it to tshinder@isaserver.orgDownload RainWall High Availability for ISA:
Optimize Firewall, Internet and Content SecurityRainfinity
delivers High Availability and Dynamic Load Balancing
for Microsoft ISA 2004. Rainfinity’s next generation
high availability platform extends beyond the firewall
to protect and optimize all of your network resources,
including your ISP connections and content security.
This is the only integrated solution for firewall and
Internet connectivity that takes advantage of all nodes
with load balancing and advanced failure detection. Download
RainWall and RainConnect for ISA
today!Visit the Subscription
Management section to unsubscribe.
ISAserver.org is in no way
affiliated with Microsoft Corp.
For sponsorship information,
contact us at advertising@isaserver.org.
Copyright
? ISAserver.org 2005. All rights reserved.
- Serving the ISA Firewall Community: What
-
Skype and ISA Firewalls
I was reading the
Skype network admin guide today (a fine thing to do on Thanksgiving, when
figuring out how to call Mom on the cheap) and found these recommendations for
firewall configuration:Outgoing
TCP connections should be allowed to remote port 1024 and
higherTranslation:
Create a Protocol Definition for TCP outbound with ports 1024-65535. And create
an access rules that allows these connections to
everywhere.Outbound
TCP connections should be allowed to remote ports 80 and
443Translation: Allow
outbound TCP 80 and 443 to everywhereOutgong
UDP packets should be allowed to remote ports 1024 and higher. For UDP to be
useful to Skype, the NAT must allow for replies to be returned to sent UDP
datagrams. (The state of UDP "connections" must be kept for at least 30 seconds,
and Skype recommends that these translations be maintained for as long as an
hour, if possibleTranslation:
Create a Protocol Definition with UDP Send/Receive Primary connection 1024-65535
and secondary connection ???. They don’t explicitly state what the second
connections are or if the secondary connections are actually required. All they
say is that "the NAT must allow for replies". What I think they mean here is
that you can use the ISA firewall’s stateful packet inspection engine to
automatically manage the replies, and that there are not secondary inbound
connections. What I don’t know is if they’ve misused the term "reply". Create a
rule that allows this connection to everywhere.The NAT
translation should provide consistent translation, meaning that outgoing address
translation is usually the same for consecutive outgoing UDP
packetsTranslation: Who
knows? Like the second amendment of the Constitution, poorly worded
documentation creates no end of confusion. However, if I interpret this
correctly, the ISA firewall’s stateful packet inspection engine will do this
automatically, without any changes required on your part.So, bottom line
according to their documentation, you need to allow all TCP and UDP ephemeral
ports, as well as TCP 80 and 443 and that no secondary connections are
required.If my
interpretation is wrong, it means that the Skype documentation SuX0Rs.
Which would be no surprise, becuase they write this stuff for "open a
port" ‘hardware’ firewall admins who always let everything outbound,
becuase they think there are no malicious uses are their corporate network
:\Try this out and
let me know what happens. If it works with the SecureNAT client configuration,
using the rules I’ve indicated above, then there are no secondary
connections required and I can apologize to the Skype technical writers. If it
doesn’t work, it indicates that secondary connections are required and the Skype
technical writers owe me and everyone else an apology for wasting our time with
their spotty docs.Final note: Skype
is not a secure application, with the poor documentation being on a very small
issue of the overall security risks imposed by Skype communications. I’m not
going to go over all the details here, but you can easily use Google or MSN
Search and find a ton of links to Skype security issues.The Skype network
admin guide can be found at: http://www.skype.com/security/guide-for-network-admins.pdfDISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Speed Up Back to Back ISA Firewall Web Proxy Filter Performance
I see a good
number of posts from ISA firewall admins who experience poor Web proxy filter
performance for their Web proxy clients when using a back to back ISA firewall
configuation. The most likely issue in this scenario is that the downstream ISA
firewall is performing name resolution. You can significantly improve Web proxy
filter performance by disabling name resolution on the downstream ISA firewall’s
Web proxy filter.Check out
How to configure ISA 2004 to skip name resolution in a Web proxy
chaining configuration at http://support.microsoft.com/default.aspx?scid=KB;EN-US;891244 for
detailed instructions.DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Very Cool Blocklist Management Application for ISA Firewall
In a perfect world
we never never need to create a single deny rule. Yes, in the most perfect of
all possible worlds, we would actually use the principle of least privilege and
allow uses access only to the sites they require access. But
that ain’t going to happen in my lifetime, so we chase our tails creating block
lists.If you’re such a
tail chaser, then check out Maciej Rusinek’s Blacklist
2004 application. It takes the drudgery out of implementing and
managing mammoth block lists.Find the
application at http://blacklists.w.interia.pl/index_b2004.htmDISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Moving ISA Firewall MSDE Logs
The first place
most ISA firewall admins check for information on setting up and configuring the
ISA firewall is the ISA firewall’s Help File, which is pretty darned good if you
ask me. However, not everything you’d expect to be in there is in
there.Why? Becuase they
stuck it in the ISA firewall Software Development Kit (SDK) Help file. A good
example of this is information on how to move the ISA firewall’s MSDE log files.
If you want info on how to do this, check the ISA SDK info over at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/isasdk/isa/logs.aspDISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-02-2005/m_2001998768/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Creating Multiple Security Perimeters with a Multihomed ISA Firewall Part 1: DMZ Design Concepts and Why the Front-end Exchange Server is Placed in a DMZ
The DMZ is not dead. It?s not even breathing
hard. In fact, DMZs become more important every day. No longer can you have
implicit trust in any network. Back in the days of yore, you could depend on two
types of networks: the scary ?untrusted? external (Internet) network and the
safe and sane (trusted) internal network.Learn more
at: http://www.isaserver.org/tutorials/Creating-Multiple-Security-Perimeters-Multihomed-ISA-Firewall-Part1.htmlHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Fun ISA Firewall Webcast Today (November 29 2005) LOTS of Demos
Lots of Demos of stuff I
haven’t written about before and that I haven’t seen anywhere else. Have
fun!TechNet Webcast:
Inside Application Layer Filtering (Level 300)Tuesday, November 29, 2005 – 11:00
AM – 12:30 PM Pacific TimeThomas W.
Shinder, M.D., ISA Server MVP, TACteamHow safe is your firewall? Buffer
overruns, mail viruses, and other attacks penetrate many corporate firewalls and
use protocols such as HTTP, SMTP and FTP to defeat port-based rules and pass
attacks inside data streams. This webcast shows how Microsoft Internet Security
and Acceleration Server 2004 features such as URL filtration,
pre-authentication, syntax checking, and intelligent content inspection help
deliver a high-degree of protection through application awareness. Understand
the SMTP filter model and the HTTP filtering engine, and see how these integrate
with Internet Information Services 6.0, Microsoft Exchange Server 2003, and the
Remote Authentication Dial-In User Service to help form a well-defined defensive
strategy.http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032283954&Culture=en-US
+LOTS+of+Demos&referrer=)
-
10 common social engineering ploys… and how to protect against them
Takeaway:
Many computer
security problems involve exploitation of employees by social engineers. Here’s
a look at some of the most widely used tactics and techniques aimed at
manipulating people to gain access to your network.Description:
Just as talented
hackers can use their programming skills to exploit applications, operating
systems, and protocols to get inside your company’s network, talented social
engineers can breach your network by using their people skills and powers of
observation to exploit your company’s employees, partners, and others who have
legitimate network access. Social engineers are adept at psychologically
manipulating people into giving them access or the information necessary to get
access using a variety of schemes. IT pro Deb Shinder put together a list of tricks typically
used by these intruders, along with some suggestions for how to thwart some of
them. Common ploys include:- Impersonating IT staff
- Playing on users? sympathy
- Using intimidation tactics
- Shoulder surfing
Download this doc
at: http://techrepublic.com.com/5138-1009-5976521.html?part=rss&tag=feed&subj=trDISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-02-2005/m_2001998768/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Inside ISA Firewall Application Layer Inspection Webcast Now Available for Download
If you made it to
my talk about the ISA firewall’s stateful application layer inspection feature
set, then you know that we covered some key concepts in how the ISA firewall
provides superior firewall protection using a multilayered approach to network
security. I appreciate the time you took out of your scheudule to attend the
talk and I hope to see you again at the next one!If you didn’t have
a chance to attend the Webinar, then I have some good news. You can now download
the file for offline viewing. You’ll be able to see the slide show and the over
45 minutes of really cool demos. I had planned to do seven demos, but only got
five of them done due to time running out.I’m working on a
collection of seven documents now that gives the deep details of how to
replicate the demostrations I did, and am also including a ton of cool
ISA firewall tips and tricks in each of these docs, many of which I
didn’t have time to explain during the demonstrations.Head on over to
http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032283954&Culture=en-US and register for the meeting. After you register, you’ll be taken
to a page where you can download the Webinar recording. Let me know if you have
any questions on what I talked about by clicking on the discussin link.
Thanks!DISCUSS THIS
POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-02-2005/m_2001998768/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
DHCP versus DNS WPAD
WPAD allows you to automatically configure your Web browser and the
Firewall client with key configuration information that enhances the
security your ISA firewall provides and is just one of the myriad of
reasons why the ISA firewall whacks the low level of security provided
by common "hardware" firewalls.You have two options for WPAD: DHCP or DNS. I always use DNS because
it’s a much more efficient protocol, and I understand more than the
average bear how the DNS infrastructure works (that is to say, I’m at
the 51st percentile). DHCP is an option, but its lower performance and
you might not be happy with the results. This was an empirical
observation of mine for years, but I never saw any authoritative
documentation of the issue until today.To quote Jim Harrison regarding the use of DHCP WPAD delivery:
=========================
Don’t use DHCP wpad – it’s cr*p.
We’ve found that WinInet (what IE uses) can take up to 10 seconds to
"digest" the DHCP data it gets.Use only DNS or WINS (if you must).
=========================
I wholly agree with Jim. Don’t fear DNS. Embrace it, use it, make it
dance and sing for you. Don’t put your head in the sand like some SBS
MVPs and MVP manque types we know 😉HTH,
TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
-
Update to WPAD Issue
Here’s an update to the WPAD issue discussed
in my last post, courtesy of Stefaan Pouseele:=========================
That’s what
described in my article:
http://www.isaserver.org/articles/ISA2004_ClientAutoConfig.htmland related to:
http://forums.isaserver.org/m_350016600/mpage_1/tm.htmA fix for Windows XP SP2 is officialy
released on November 11, 2005. The
related knowledge base article is KB906055
and should be available soon on
the web. IE uses an obsolete DHCP API but
this API has been fixed (DHCPCSVC)
for Windows XP SP2
only.HTH,
Stefaan
==========================I did try to find a link
to the KB article Stefaan mentions, but its not yet up on the MS.com Web site.
I’ll keep my eye out for it and let you know when it shows
up.BTW — if you haven’t had
a chance to read Stefaan Pouseele’s excellent articles on ISAserver.org, you
should do yourself a favor. Stefaan has a great talent in getting into the
internals of the ISA firewall’s networking behavior and sharing his insights in
a way that is easy to understand.Check out Stefaan’s
section at: http://www.isaserver.org/Stefaan_Pouseele/
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-02-2005/m_2001998768/tm.htm
HTH,
Thomas
W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP —
ISA Firewalls
**Who is John Galt?**
-
WSUS Support for ISA Firewall Coming in February 2003
Thanks to Susan
Bradley (http://msmvps.com/bradley/) for the
heads-up on a newsgroup post regarding the planned WSUS support for ISA
2004 SP2 firewalls and subsequent versions.Check it out
at:DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-02-2005/m_2001998768/tm.htmHTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
ISA Firewall and Antigen Hands on Labs
Posted to
Bruce Cowper’s Canadian IT Pro Community blog at http://blogs.technet.com/brucecowper/archive/2005/12/02/415438.aspx===============================
Last week we held a 2 day series of hands-on labs for ISA
server and Antigen that convered a huge range of scenarios and practical
solutions for security, junk mail filtering and anti-virus. I hope all of you
that attended will agree that it was an awesome experience. I spent a great deal
of time not only working through the labs with you, but talking about how you
could leverage the technologies in your environment.As a result of the labs, I have been contacted by a number
of you wanting to get hold of the presentation material from the labs, so here
are the links:To download the presentation on
Internet Security & Acceleration Server 2004 Enterprise Edition, click
here: http://download.microsoft.com/download/a/6/c/a6c4a976-da3e-4950-8c46-c3964cbbec1f/ISA
EE Presentation.pdfTo download the presentation on
Microsoft?s Sybari Antigen click here:
http://download.microsoft.com/download/a/6/c/a6c4a976-da3e-4950-8c46-c3964cbbec1f/Antigen
Presentation.pdfTo
download the presentation on Frontbridge click here: http://download.microsoft.com/download/a/6/c/a6c4a976-da3e-4950-8c46-c3964cbbec1f/Frontbridge
Presentation.pdfThanks
again for attending this great event.I look forward to seeing you all again
soon!===============================DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-09-2005/m_2001999425/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
WSUS Support for ISA Firewall Coming in February 2006
Thanks to Susan Bradley (http://msmvps.com/bradley/) for the heads-up on a newsgroup post regarding the planned WSUS support for ISA 2004 SP2 firewalls and subsequent versions.Check it out at:DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-02-2005/m_2001998768/tm.htmHTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Microsoft Windows Server Reference Architecture (WSSRA) Released
If you’ve never
read the WSSA, then you’re in for a treat. This collection of documents provides
detailed information on creating a complex distributed network using all the
Microsoft networking services. You can learn a ton about how to get the most out
of MS network services using these documents and there are a ton of tips and
tricks that you won’t find anywhere else.While its unlikely
that you’ll fully implement a similar network, there are chunks of valuable
information that you can take and put in your fact master’s
toolkit.Check it out at:
http://www.microsoft.com/downloads/details.aspx?FamilyID=d44e34ec-b4e2-49a1-9f40-9ed4ba3765df&DisplayLang=enDISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-09-2005/m_2001999425/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**+Released&referrer=)
-
TechRepublic Opens Tech Wiki Site
Wiki’s have been
around for a long time, but it seems that only recently they’ve been popular.
What’s a Wiki?
According to wiki.org (http://wiki.org/wiki.cgi?WhatIsWiki)
its:"Wiki is in Ward’s original description:
The simplest online database that could possibly work.
Wiki is a piece of server software that allows users to freely create and
edit Web page content using any Web browser. Wiki supports hyperlinks and has a
simple text syntax for creating new pages and crosslinks between internal pages
on the fly.Wiki is unusual among group communication mechanisms in that it allows
the organization of contributions to be edited in addition to the content
itself.Like many simple concepts, "open editing" has some profound and subtle
effects on Wiki usage. Allowing everyday users to create and edit any page in a
Web site is exciting in that it encourages democratic use of the Web and
promotes content composition by nontechnical users."=========================There are some big
advantages to having a tech wiki. No writer can possibly think of everything
when writing an article on a particular subject. So, having the ability to
leveage the collective experience of thousands of IT Pro’s is a big plus.
However, there are disadvantages to allowing anyone to edit content, in that not
everyone knows which end eats 🙂I’ve tried to
implement something like this at http://www.isaserver.org by including a discussion
board link with each article I publish and making that link prominent in each of
my articles. I wish folks would use this feature more often, because it allows
me to update articles with fresh content, and get ideas that I wouldn’t have
ever considered without other people’s input. In addition, the discussion board
link allows you to ask me "what did you mean when you said ….". It’s
like being able to ask the professor pointed questions about stuff he mentions
in a lecture.TechRepublic hosts
a lot of my content, so I’ll be very interested to see how this works out. Check
out their beta version of their Tech Wiki at:TechRepublic’s "10 things" … The Wiki
Version:DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-09-2005/m_2001999425/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Troubleshooting Unsupported Configurations in ISA Server 2004
Dear ISA firewall
admins, I’d like to take this opportunity to introduce you to one of the best
ISA firewall documentation projects on the microsoft.com Web site:
Troubleshooting Unsupported Configurations for ISA Server
2004.Why do I think
this is one of the seminal works of ISA firewall documentation on the Web today?
The reason is that the writers really listened to ISA firewall
admins and collected the most common misconfiguration issues that afflict the
ISA firewall.I highly recommend
that you read this document at least three times and digest the all the tasty
morsels contained therein. You’ll be a much better ISA firewall admin and
consultant after reading this doc.DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-09-2005/m_2001999425/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Why the Unihomed ISA Firewall SuX0rS
You might notice
on the http://www.isaserver.org Web site and
message boards that there is a distinct prejudice on my part against
the use of the unihomed (single NIC) ISA firewall.Why? Because the
unihomed ISA firewall isn’t a security solution, per se. Yes, in some scenarios
the unihomed ISA firewall can bolster the otherwise abysmal level of security
provided by simple stateful packet inspection firewalls, but since the unihomed
ISA firewall can be easily bypassed (since its not in a compulsory path between
source and destination) its rediculously easy for both the neophyte and
experienced intruder to bypass the unihomed ISA firewall.The ISA firewall
isn’t MS Proxy Server 4.0. While the ISA firewall has a Web proxy filter that
hooks into the ISA firewall’s Firewall Service, the ISA firewall is a firewall
first, second, last and always.Here are some more
compelling reasons for not deploying unihomed ISA firewalls:Multi-network firewall policy. In single network adapter
mode, ISA Server recognizes itself (the Local Host network). Everything else is
recognized as the Internal network. There is no concept of an External network.
The Microsoft Firewall service and application filters operate only in the
context of the Local Host network. (ISA Server protects itself no matter what
network template is applied.) Because the Firewall service and application
filters operate in the context of the Local Host network, you can use access
rules to allow non-Web protocols to the ISA Server computer. This has
implications for running applications located on the ISA Server
computer.
Application layer inspection.
Application level filtering does not function, except for Web Proxy Filter for
Hypertext Transfer Protocol (HTTP), Secure HTTP (HTTPS), and File Transfer
Protocol (FTP) over HTTP.
Server publishing.
Server publishing is not supported. Because there is no separation of Internal
and External networks, ISA Server cannot provide the NAT functionality required
in a server publishing scenario.
Firewall clients.
The Firewall Client application handles requests from Winsock applications that
use the Firewall service. This service is not available in a single network
adapter environment.
SecureNAT clients. SecureNAT
clients use ISA Server as a router to the Internet, and SecureNAT client
requests are handled by the Firewall service. Because the Firewall service is
not available in a single network adapter configuration, such requests are not
supported.
Virtual private networking.
Site-to-site virtual private networks (VPNs), and remote access VPNs are not
supported in a single network adapter scenario.As Mr. T would
say: "I pity the fool who deploys a unihomed ISA firewall"DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-09-2005/m_2001999425/tm.htmHTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Network Engines and Websense to Host Launch Party at InfoSecurity 2005 to Celebrate New Joint Product Offering
Press Release Source: Network Engines Network Engines and Websense to Host Launch Party at
InfoSecurity 2005 to Celebrate New Joint Product Offering
Tuesday December 6, 9:28 am ETLaunch Party Celebrates
the Release of Network Engines NS Series Integrated with Websense Web Security
SuiteCANTON, Mass.–(BUSINESS WIRE)–Dec. 6, 2005–Network Engines and
Websense will host a launch party during the InfoSecurity 2005 Conference in New
York City to celebrate the release of the Network Engines NS Series security
appliance powered by Microsoft ISA Server 2004 integrated with Websense Web
Security Suite(TM). This joint offering signals an emerging trend of security
vendors working closely together early in the development and manufacturing
process to give end customers a fully integrated, on-box solution that reduces
total cost of ownership, while greatly automating security tasks.WHAT: A launch party hosted by Network Engines and Websense. Food and drinks will be served. WHEN: December 7th, 5:30 - 7:30 p.m. WHERE: Microsoft Corporate Offices, NYC Belvedere Castle Conference Room 1290 Avenue of the Americas, 6th Floor WHO: Executives from Network Engines, Websense and Microsoft will be in attendance, as well as VARs, customers, prospects, industry analysts and media DON'T MISS: Demonstrations of Network Engines NS Series products at Booth # 524 at the Jacob Javits Convention Center at InfoSecurity 2005 from December 6 - 8, 2005. RSVP: http://www.networkengines.com/infosecnyNetwork Engines – THE Appliance Company
Network Engines appliances are designed to ease the deployment, enhance
manageability, and increase security of mission critical software applications.
Our heritage of providing technology products and services tailored to
supporting the entire lifecycle of our customers appliances has made us the
appliance partner of choice for software market leaders. Founded in 1997,
Network Engines is headquartered in Canton, Massachusetts and trades on the
NASDAQ exchange under the symbol NENG. For more information about the Company’s
products and services visit: http://www.networkengines.comContact:
Network Engines Joni Moore, 508-308-7900 joni.moore@networkengines.com
Source: Network
Engines
-
Creating Multiple Security Perimeters with a Multihomed ISA Firewall Part 2: Defining the Goals and Configuring the ISA Firewall Networks and Network Rules with Specific Attention to the Front-end Exchange Server
In part 1 of this article series on configuring a
multihomed ISA firewall to support multiple DMZ segments, we went over DMZ
design principles and discussed the different types of DMZs the ISA firewall can
support. We also went over in detail the differences between authenticated
access and anonymous DMZ segments, and how we can securely place a front-end
Exchange Server on an authenticated access DMZ while removing the front-end
Exchange Server from the same security zone on which the back-end Exchange
Server lies.In this, part two of the series, we?ll define
our example network and the access controls we?ll create to allow communications
through the ISA firewall. Get all the details at:
http://www.isaserver.org/tutorials/Creating-Multiple-Security-Perimeters-Multihomed-ISA-Firewall-Part2.htmlDISCUSS THIS
POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-09-2005/m_2001999425/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
10 things you can do to become an Outlook Web Access (OWA) power user
Takeaway:
OWA enables
users with Exchange accounts to manage their e-mail from almost any computer
that has a Web browser, but they don’t always take advantage of OWA’s full
functionality. Here are some tips for getting more mileage out of OWA features.
Description:
Because the OWA interface is similar to
the Outlook client interface, it’s fairly easy to figure out how to handle basic
tasks. But OWA actually offers more options and shortcuts than most users
realize. Dr. Thomas
Shinder put together these recommendations
for tapping into some of OWA’s less obvious functionality. For example, he
offers handy hotkeys for saving time on things like sending, saving, and
deleting messages, spell-checking, and marking messages as unread. Other tips
explain how to:- Use built-in searching on column header sorting
- Speed up OWA connections over slow lines
- Get an Agenda view using a secret URL
- Automatically include your signature in new
messages
Download these
tips at: http://techrepublic.com.com/5138-10877-5983909.html?tag=searchDISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-09-2005/m_2001999425/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**+power+user&referrer=)
- Use built-in searching on column header sorting
-
Microsoft Internet Security and Acceleration (ISA) Server 2004 Best Practices Analyzer Tool
The ISA Server
Best Practices Analyzer is a diagnostic tool that automatically performs
specific tests on configuration data collected on the local ISA Server 2004
computer from the ISA Server hierarchy of administration COM objects, Windows
Management Instrumentation (WMI) classes, the system registry, files on disk,
and the Domain Name System (DNS) settings.The resulting report details
critical configuration issues, potential problems, and information about the
local computer. By following the recommendations of the tool, administrators can
achieve greater performance, scalability, reliability, and uptime.Download the ISA firewall BPA at: http://www.microsoft.com/downloads/details.aspx?FamilyID=D22EC2B9-4CD3-4BB6-91EC-0829E5F84063&displaylang=enHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**+Server+2004+Best+Practices+Analyzer+Tool&referrer=)
-
Basic ISA 2004 Troubleshooting
Amy Babinchak
presents an easy to read an insightful article on how to the use the ISA
firewall’s new integrated firewall log viewer and log filtering feature set to
troubleshoot common ISA firewall connectivity issues. This is a great article
that fills a gap in the current ISA firewall documentation on the Web today. A
must read.Also, if you
haven’t been there yet, check out Amy’s Blog ISA in SBS — yes, it’s
secure at http://isainsbs.blogspot.com/DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-09-2005/m_2001999425/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Creating Multiple Security Perimeters with a Multihomed ISA Firewall Part 3: Certificate Naming Conventions and DNS Infrastructure Design
In this, part 3 of the series, we will go over
the often misunderstood areas of certificate naming conventions and DNS
infrastructure required to support the configuration. This is an area of common
confusion, so pay very close attention to the concepts discussed in this
article. Once you understand the concepts and issues related to a proper
certificate naming infrastructure, you?ll never again have to wonder why your
secure Web and Server Publishing Rules don?t work correctly.Check it
out at: http://www.isaserver.org/tutorials/Creating-Multiple-Security-Perimeters-Multihomed-ISA-Firewall-Part3.htmlDISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-16-2005/m_2002000621/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
10 ways to secure your Windows-based SMTP relays
10 ways to secure your Windows-based SMTP
relaysTakeaway:
You can
mitigate some of the security risks inherent in connecting to and from anonymous
SMTP servers by using inbound and outbound SMTP relays. Here are 10 ways to
reduce the risks.Description:
Organizations hosting their own mail
services must accept incoming connections from anonymous SMTP servers on the
Internet. In addition, outbound mail must allow connections to SMTP servers of
unknown security configuration. Dr. Thomas
Shinder has assembled a list of
recommendations that will help reduce the attendant security risks. For example,
he suggests that you:- Disable anonymous and authenticated relay at the
server level - Use different SMTP relays for inbound and
outbound mail - Enable logging for the SMTP service
- Use SSL and authentication for end-user
relays
Join the discussion of this download.HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
- Disable anonymous and authenticated relay at the
-
Reminder to install your SQL Updates for ISA Firewall MSDE Logging
An ISAserver.org
Web boards member reminded me about MDSE logging and the need to install SQL
updates. In fact, immediately after installing the ISA firewall (which you
should do when the ISA firewall machine is not connected to the Internet) you
should do the following:- Get Updates from
the MSDE and Office Web Components - Get the ISA
firewall application updates - Analyze the ISA
firewall’s security configuration using the Microsoft Baseline
Security Analyzer - Harden the ISA
firewall using the ISA Server Security Hardening
Guide - Put a recurring
appointment in your Outloook Calendar to repeat these steps once a
month
For more
information and links, check out the ISA Firewall Security Update
Center at:DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-16-2005/m_2002000621/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
- Get Updates from
-
Whale To Bundle ISA 2004
A free service from USEast Network Services
Visit the USEast BLOG to find more news about appliances, Microsoft, security and lots of other subjects.
Whale To Bundle ISA 2004December 14, 2005 ? by Stuart J. Johnston
Microsoft and Whale Communications announced a partnership that enables Whale to sell an integrated solution that combines Microsoft?s Internet Security and Acceleration (ISA) Server 2004 with the smaller firm?s Intelligent Application Gateway product.
Whale?s products are designed to reinforce the functionality of enterprise applications and software infrastructure by managing access and enabling a flexible balance between security and functionality.
The deal will provide a solution that delivers support for IPSec VPN, SSL VPN, endpoint security and application security components in a single secure appliance, according to a statement by the two companies.
?We?ve been focused on providing secure access to Exchange, but there are other applications that need security,? said Roger Pilc, CEO of Fort Lee, N.J.-based Whale. The company will begin shipping the bundled systems by the end of the year, Pilc added. Whale?s offering starts at $15,000.
Stuart J. Johnston has covered technology, especially Microsoft, since February 1988 for InfoWorld, Computerworld, Information Week, and PC World, as well as for Enterprise Developer, XML & Web Services, and .NET magazines. Contact him at stuartj1@mindspring.com. You can contact Stuart about Whale To Bundle ISA 2004 at stuartj1@mindspring.com.
-
Interesting explanation of Web proxy chaining errors with on-box Third party proxy apps
Ran into this
interesting explanation today on Web proxy chaining errors you see when you have
third party on-box Web proxy software installed on the ISA firewall (for
example, Websense or SurfControl):=============================Traffic Is in a Proxy Chain Loop
Problem: You are running a third-party
proxy application on the same computer as ISA Server, with the following
settings:? Clients make Web requests to ISA Server (port
8080).? ISA Server has a Web chaining rule configured,
to direct traffic upstream to the second Web Proxy application on an
alternative port (for example, port 8082).The client receives a 12206 error: ISA Server
detected a proxy chain loop.Cause: ISA Server receives a Web request
on port 8080 and redirects it to port 8082. The third-party proxy application
receives the request on port 8082, and sends it to port 80 as an HTTP
request.ISA Server intercepts the traffic on port 80 as a
transparent proxy request, and passes it to the Web Proxy filter. This causes
traffic to be directed upstream again, causing a proxy chain loop. This is
detected when ISA Server receives the request for the third time, and returns an
error.Solution: Possible workarounds include
the following:? The preferred workaround method (to preserve
authentication settings) is as follows:? Add a new protocol for outbound TCP port
80. Disable the Web Proxy filter from this
protocol.? Add an allow rule from the Local Host
network to the External network for the new protocol, and set it as
the first rule.? Add a deny rule from the Local Host
network to the External network for HTTP, and set it as the second
rule.? Disable all system policy rules that
apply to HTTP.? The other workaround is to disconnect the Web
Proxy filter from HTTP, as described in Appendix A: Disable the Web Proxy Filter later in this document. The disadvantage of this
workaround is that outbound HTTP requests from SecureNAT and Firewall
clients will then go directly to the Web server instead of being
redirected to the Web Proxy filter. Such requests will not be served from
the cache, and HTTP application layer filtering will not be
applied.This solution works because of the way in which ISA
Server processes traffic. Traffic arrives on a particular port, and this port
matches specific protocols. ISA Server gathers all the rules that apply to the
specific protocols, and processes all these rules up to the first deny rule. The
traffic is then passed to the filters registered for the resultant rules. The
second rule (denying access) allows port 80 traffic to pass, without going
through the filter. Note that this workaround will not work if the Web browser
on the ISA Server computer has Web Proxy settings specified. Web requests from
the browser will be blocked by the second rule.=============================DISCUSS THIS
POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-31-2005/m_2002001800/tm.htmHTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John
Galt?**
-
Are You Prompted to Insert the ISA 2004 Install Disk When You Try to Install the ISA Firewall?
If so, its likely
that you have the ISA firewall’s eval version installed on your computer. The
solution is to copy the contents of the full version CD onto your hard drive and
then run the install from there. Remember to delete those files when you’re
done.DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-31-2005/m_2002001800/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Firewall Client Share and MSDE Will Not Install on Your ISA Firewall
Are you getting
errors indicating that the Firewall Client Share and the MSDE database logging
components won’t install on your ISA firewall device? If so, the problem is that
the Server Service isn’t enabled on your ISA firewall. This might have been
disabled during a system hardening process by you or your ISA hardware firewall
vendor. Use the Services applet in the Administrative
Tools folder to re-enable the Service Service and give it another
try.DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-31-2005/m_2002001800/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Did Your Setup Fail While Registering Wspadmin.dll ?
If so, then you’ve
been a bad boy 🙂Why bad? Because
you didn’t do a clean install of the ISA firewall on a clean OS. I bet you had
ISA 2000, a pre-RTM version of ISA 2004, or perish the thought, the old Proxy
2.0 product installed on that server at one time. My advice to you is to crater
the box, install Windows Server 2003, and then install the ISA 2004 firewall.
However, if this isn’t an option for you, then try this:1.
Start Microsoft Windows
Explorer.2.
Remove the following folder if it
exists:%programfiles%:\Microsoft ISA Server
3.
Locate the %WINDIR%\System32 folder,
and then remove all the following files if they exist:? Cachctrs.h
? Cachctrs.ini
? Latui.dll
? Mspapi.dll
? Msfpc.dll
? Msfpcui.dll
? Msphlpr.dll
? Msplog.dll
? Mspmon.dll
? Mspmsg.dll
? Mspsec.dll
? Mspui.dll
? Pfctrs.h
? Pfctrs.ini
? Ratlib.dll
? Msfpcstg.dll
? W3papi.dll
? W3pctrs.h
? W3pctrs.ini
? W3pmib.dll
? Wspapi.dll
4.
Run the ISA Server 2004 Setup
program.DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-31-2005/m_2002001800/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John
Galt?**
-
Error: Firewall Service Cannot Start and Cannot Load Web Proxy Filter
I’ve seen this one
many times on the ISA firewall mailing list, Web boards and newsgroups. But I’ve
never seen it in any of my deployments.Why? Becuase I
always configure DNS correctly. Remember, you should configure the ISA firewall
with a DNS server on its internal interface only and configure
it to use an internal DNS server that can resolve both internal and external
names. Note that the internal DNS server doesn’t have to resolve external names
itself, it can use another DNS server to do those duties (yes Thor, I know if
your scenarios where you don’t want the internal DNS server doing external name
resolution, but that is a special case).Once you have the
ISA firewall configured to use the internal DNS server, make sure that the ISA
firewall’s name is registered in the DNS. The ISA firewall needs to be able to
resolve its own name. If not, you’ll see an error indicating that the Firewall
service cannot start and that the Web Proxy Filter cannot
load.DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-31-2005/m_2002001800/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Want to reuse your cache files?
Here’s a
good’in.You have a
gigantic Web cache built up and you need to reinstall your ISA firewall. You
don’t want to lose all that cached content. What to do? Try
this:1.
Before you begin the reinstallation process,
create a copy of the existing cache file, located in
<drive:>\urlcache\Dir1.cdat.2.
Reinstall the ISA firewall
software.3.
Reconfigure cache settings, the same way
they were previously configured.4.
Stop all the ISA Server services,
by entering
net stop fweng at a command
prompt.5.
Copy the Dir1.cdat file to
the \urlcache folder.6.
Restart the ISA firewall’s
services.DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-31-2005/m_2002001800/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John
Galt?**
-
Outstanding Thread on OpenVPN
There’s an
outstanding thread on using OpenVPN with the ISA firewall on the ISAserver.org
Web boards. Check it out at:HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
DNS Issues Lead to Spurious Blaming of ISA Firewall for Performance Problems
I ran into a
couple of network troubleshooting issues last week and thought I should write
them down before the issues get lost in the dustbin of history. Both these
issues are related to Internet performance, and ISA firewalls. As you know the
ISA firewall is often the "sin eater" for network problems, as inexperienced
network and firewall administrator attribute Internet performance problems to
the ISA firewall without investigating issues with their own network
infrastructure. I learned long ago that that 99.98% of the time its not an ISA
firewall issue, its a networking issue that involved some other component of the
network infrastructure.So now to my
problem. I found access to Web sites getting slower and slower over time. What I
mean by slow is that it took serveral seconds, or even minutes, for a Web site
to come up after clicking a link or clicking a button on my Internet Explorer
links bar. One big clue that I had that this was a name resolution issue was
that the browser would freeze for several seconds or longer while waiting for
the site to come up. What I specificially mean by "freeze" is that the links bar
button would stick in a "pushed in" configuration. This is a very common problem
amoung Web proxy clients configured to use the autoconfiguration script, so it
immediately clued me into that this was a DNS problem.But where was the
DNS problem? There are lots of DNS problems! The first thing I did was check
serveral nslookups on my client machines and more importantly,
on my ISA firewalls. The nslookups work fine, but I had to rerun them serveral
times in order to get a name resolution complete, as the first few attempts
indicated a time out.I then did a
NetMon trace on both the internal and external interface of the ISA firewall. I
found way too many DNS queries being done and long delays in DNS responses. I
mean tens of thousands of DNS querys (I traced over the course of about an hour
and used a 250MB buffer and capture filter).OK, so there are
too many DNS queries. Now what? Why are there so many DNS queries by hosts on a
network that is primarily Firewall and Web proxy clients? As you know, Firewall
and Web proxy clients don’t perform name resolution themselves and let the ISA
firewall do it for them. So the next step was to identify those hosts who were
asking for the DNS name resolution requests.The NetMon trace
and the log files on the ISA firewall only showed the IP address of the DNS
server on my network making the DNS queries, which makes sense, since all hosts
on my network segments use a specific DNS server to resolve Internet host names.
That is to say, the internal hosts on my networks are never configured to use an
external DNS server, they always use a dedicated DNS resolver on my internal
network.At this point I
had to answer the question "How do I figure out what host(s) are sending the DNS
queries to my internal DNS resolver". That was an easy one to answer: just do a
NetMon trace on the DNS resolver. So that’s what I did.The result was
very interesting. It showed that two of my inbound SMTP spam whacking relays
(inbound mail goes through four spam whacking/AV relays before hitting my
Exchange Server — I don’t like putting Antispam/AV software on my Exchange
Server because of the performance hit) were making thousands of requests for
MX records. Now I asked myself the question "why would these
relays make thousands of MX record requests"?The answer to that
question was becuase the SMTP relays were trying to resolve the MX domain names
of spammers, most of which are bogus. Since the Christmas season saw a big spike
in spam coming into my network, there was a large spike in the number of MX
requests for the NDRs. This lead to thousands of pending DNS requests on my DNS
resolver and was bogging the DNS server down, which lead to delays in name
resolution for all other outbound requests to the Internet.I "fixed" (I can’t
say I solved the problem) by remove the DNS server addresses from the NICs of
the SMTP spam whacking relays. This stopped the DNS query traffic for the MX
records, but also prevents the relays from updating their AV databases. The next
problem I’ll need to solve is how to more effectively handle these NDRs if at
all possible. Otherwise, I’ll have to schedule a netsh scripts to run to enable
the DNS settings for a set period of time and then disable them. A definite
kludge, but its all I can think of at this time.MORAL OF
THE STORY:Most admins would
blame the ISA firewall for slowing down their Internet connections. They would
have been wrong, as is most often the case. Through the thoughtful use of ISA
firewall logs and Network Monitor, I was able to determine that this was a DNS
issue, where the DNS problem was located, and came up with a "fix" for the
performance issue.DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
ISA Server Firewall Team Starts Blogging!
This is great
news! I’ve been waiting for a couple of years for the ISA firewall team to put
together a blog, where we can get the inside dope on what’s happening with the
ISA firewall, just like we can with the Windows Server and Exchange Team blogs.
We’ll my wish has finally come true! Check the out the ISA Server Product Team
Blog at:ISA Server
Product Team BlogDISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htmHTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
FW: [isalist] RE: FYI: Hex blog: Windows WMF Metafile Vulnerability HotFix
Here’s some good news from GFI. They have a new build of the GFI WebMon 3.0 which will catch the new WMF exploits.You can download a trial version now, test it out, and
if you decide you don’t want to buy it, you can still get coverage until
Microsoft comes out with a fix.Check out what David Farinic from GFI has to
say:
From: David Farinic [mailto:davidfa@gfi.com]
Sent: Monday, January 02, 2006 9:03 AM
To: [ISAserver.org
Discussion List]
Subject: [isalist] RE: FYI: Hex blog: Windows WMF
Metafile Vulnerability HotFixFor WebMon3
users:As there are more than
50 variants of this exploit in wild, we added wmf real file-type signature
checking so now you can block this filetype ?whatever? extension content type it
hides under.However you need to
update to build 20060102 or later version:ftp://ftp.gfisoftware.com/temp/Netmon/del/20060102/webmonitor3.exe
Handle with care as
this version is currently under testing and once proves bug free we will replace
version of WM3 on our main site.With Kind Regards
DavidFA.P.S: Please trust
info/email like this (about WM3 updates) only if they point to *.gfisoftware.com
or *.gfi.com domains for updates.DISCUSS THIS POST AT:
HTH,
Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Amy Babinchak Named ISA Firewall MVP
Got some great
news today!Amy Babinchak was
named ISA Server Firewall MVP today by Microsoft. Amy spends a lot of time on
the ISAServer.org messages boards and mailing list helping people with ISA
firewall problems, and she disguinshes hereself by being the foremost authority
on ISA installed on SBS. Amy also is singular in her position as the only person
activity invovled in the SBS community to contribute ISA on SBS articles to
ISAserver.org.Congratulations
Amy!Check out Amy’s
ISA on SBS blog site at:DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htmHTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Configure the HTTP Security Filter to Control the WMF Exploit
Jim Harrison comes to the rescue again with cutting edge information on
how to configure the ISA firewall’s HTTP Security Filter to protect against the
WMF exploit. I’m not going to go into the details of how to access the
configuration interface or how the filter works, since that’s all in the book.
🙂The filter settings
are:HTTP filter settings (you all know how to get
there). 1.
Extensions:
<choice>
Set "block
specified"
Add .wmf
Description="application/x-msmetafile"
</choice>
<choice>
Set "allow specified"
Remove
.wmf
</choice>
<notachoice>
Set "allow
all"
</notachoice>2. Signatures:
Name=WMF-1
Description="request file type
trigger"
Type="Request URL"
Signature=".wmf"Name=WMF-2
Description="response headers trigger"
Type="Response
Headers"
HTTP Header="content-type"
Signature="msmetafile"Name=WMF-3
Description="response body file type trigger"
Type="Response
Body"
Signature=".wmf"
Name=WMF-4
Description="response body file header
trigger"
Type="Response Body"
Signature="184Gmg"
WMF-4 is the kewl one because all binary files
are base-64 encoded when transferred over HTTP and FTP.
WMF files usually
incorporate a predefined header value that resolves to the Base-64 signature in
this definition.
It’s probably the same technique as the GFI filter, except
not as smart.DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htm
HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
http://tinyurl.com/3xqb7
Book:
MVP — ISA Firewalls
**Who is John
Galt?**
-
UPDATE: Configure the HTTP Security Filter to Control the WMF Exploit
Here’s an Update to the ISA Firewall’s HTTP
Security Filter configuration for protecting against the WMF exploits. Props to
Jim Harrison again!Updated:
HTTP
filter settings (you all know how to get there).1.
Extensions:
<choice>
Set "block
specified"
Add .emf
Description="application/x-msmetafile"
Add .wmf
Description="application/x-msmetafile"
</choice>
<choice>
Set "allow specified"
Remove .emf
Remove
.wmf
</choice>
<notachoice>
Set "allow
all"
</notachoice>2. Signatures:
Name=WMF-1
Description="request file type
trigger"
Type="Request URL"
Signature=".emf"Name=WMF-2
Description="request file type trigger"
Type="Request
URL"
Signature=".wmf"
Name=WMF-3
Description="response headers
trigger"
Type="Response Headers"
HTTP
Header="content-type"
Signature="msmetafile"
Name=WMF-4
Description="response body file type
trigger"
Type="Response Body"
Signature=".emf"Name=WMF-5
Description="response body file type trigger"
Type="Response
Body"
Signature=".wmf"
Name=WMF-6
Description="response body file header
trigger"
Type="Response Body"
Signature="184Gmg"WMF-6 is the kewl one because all binary files are
base-64 encoded when transferred over HTTP and FTP.
WMF files usually
incorporate a predefined header value that resolves to the Base-64 signature in
this definition.
It’s probably the same technique as the GFI filter, except
not as smart.DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htm
Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John
Galt?**
-
FW: Network Engines and Ingram Micro Enter into Distribution Agreement
a free
service from USEast Network Services
Visit the USEast BLOG to find more news
about appliances, Microsoft, security and lots of other
subjects.
Network Engines and Ingram Micro
Enter into Distribution Agreement
Wednesday January 4,
8:56 am ETIngram Micro Becomes First
North American Distributor of Network Engines NS Series Security
AppliancesCANTON, Mass.–(BUSINESS WIRE)–Jan. 4, 2006–Network Engines,
Inc., (NASDAQ-NENG), today announced it has signed a North American distribution
agreement with Ingram Micro Inc. (NYSE: IM – News), the world’s largest
technology distributor and a leading technology sales, marketing and logistics
company. Under the terms of the agreement, Ingram Micro will now offer its
reseller customers the entire family of Network Engines NS Series(TM) Security
Appliances.The NS Series, powered by Microsoft? Internet Security and Acceleration
Server 2004, is a family of multifunction application security appliances
designed for small and large enterprises. NS security appliances are developed
to add "defense-in-depth" protection and provide unparalleled application-layer
filtering inside the traditional perimeter firewall."We are pleased to add the world’s largest technology distributor to our
partner list, as Ingram Micro’s market reach and customer list are second to
none in the industry," said Vince Ardizzone, director America’s channel sales
for Network Engines. "This partnership announcement is also a strong endorsement
of the market’s need for an appliance version of ISA Server 2004.""Network Engines has achieved a category lead with the NS Series product line
because it provides an innovative way to help companies better manage security
threats," said Paul Bay, senior vice president, vendor management, Ingram Micro
North America. "Our clients are asking for more powerful, consolidated security
solutions. Network Engines addresses this trend by working closely with
Microsoft, to create a powerful, integrated out-of-the-box appliance. This makes
ease of deployment and management a reality for IT shops large and small."About Ingram Micro
As a vital link in the technology value chain, Ingram Micro creates sales and
profitability opportunities for vendors and resellers through unique marketing
programs, outsourced logistics services, technical support, financial services
and product aggregation and distribution. The company serves 100 countries and
is the only global IT distributor with operations in Asia. Visit http://www.ingrammicro.comNetwork Engines – THE Appliance Company
Network Engines appliances are designed to ease the deployment, enhance
manageability, and increase security of mission critical software applications.Our heritage of providing technology products and services tailored
supporting to the entire lifecycle of our customers appliances has made us the
appliance partner of choice for software market leaders.Founded in 1997, Network Engines is headquartered in Canton, Massachusetts
and trades on the NASDAQ exchange under the symbol NENG. For more information
about the Company’s products and services visit: http://www.networkengines.com.Safe Harbor for Forward-Looking Statements
Statements in this press release regarding Network Engines’ (the "Company")
future financial performance and any other statements about Network Engines’
management’s future expectations, beliefs, goals, plans or prospects constitute
forward-looking statements within the meaning of the Private Securities
Litigation Reform Act of 1995. The Company’s actual results could differ
materially from those stated or implied in forward-looking statements due to a
number of factors, including those factors contained in the Company’s most
recent annual report on Form 10-K for the year ended September 30, 2005 under
the section "Factors That May Affect Future Operating Results" as well as other
documents that may be filed by the Company from time to time with the Securities
and Exchange Commission. Forward-looking statements include statements regarding
the Company’s expectations, beliefs, intentions or strategies regarding the
future and can be identified by forward-looking words such as "anticipate,"
"believe," "could," "estimate," "expect," "intend," "may," "should," "will," and
"would" or similar words. The Company assumes no obligations to update the
information included in this press release.Network Engines and the Network Engines logo are trademarks of Network
Engines, Inc. All other registered and unregistered trademarks in this document
are the sole property of their respective owners.
-
Network Engines Attains Gold Certified Partner Status in Microsoft Partner Program
a free
service from USEast Network Services
Visit the USEast BLOG to find more news
about appliances, Microsoft, security and lots of other
subjects.
January 04, 2006
08:46 AM US Eastern Timezone
Network Engines Attains Gold Certified Partner
Status in Microsoft Partner Program; Network Engines Recognized for Innovation
and Skills in development of Microsoft Powered Appliances
CANTON,
Mass.–(BUSINESS WIRE)–Jan. 4, 2006–Network Engines, Inc. (NASDAQ:NENG), a
leading appliance partner for Microsoft security solutions, today announced it
has attained Gold Certified status in the Microsoft Partner Program with three
competencies; Independent Software Vendor (ISV)/ Software Solutions, Networking
Infrastructure Solutions and Advanced Infrastructure Solutions. As a Gold
Certified partner, Network Engines has demonstrated expertise with Microsoft
technologies and proven ability to meet customers’ needs. Microsoft Gold
Certified Partners receive a rich set of benefits, including access to marketing
programs, training and support resources, giving them a competitive advantage in
the marketplace."We are extremely pleased to have attained Gold Certified status in the
Microsoft Partner Program, allowing us to further promote our expertise and
relationship with Microsoft to our customer base," said Mike Riley, vice
president of marketing and corporate strategy at Network Engines. "This
distinction validates the market need for NEWS, our appliance management
software subsystem, that has been developed to ease the deployment and unify
configuration and management of Microsoft Windows server powered appliances.""Customers are looking for partner companies that can bridge the gap between
their business demands and technology capabilities. They need to trust in
someone that can act as an expert adviser for their long-term strategic
technology plans – Network Engine’s ongoing development of award winning
appliance solutions clearly demonstrates such a long-term strategic commitment.
Microsoft Gold Certified Partners, which have certified expertise and direct
training and support from Microsoft, can build a positive customer experience
with our technologies," said Allison Watson, vice president of the Worldwide
Partner Sales and Marketing Group at Microsoft Corp. "Today, Microsoft
recognizes Network Engines as a new Microsoft Gold Certified Partner for
demonstrating its expertise in providing customer satisfaction with Microsoft
products and technology."As one of the requirements for attaining Gold Certified Status, Network
Engines had to declare a Microsoft Competency. Microsoft Competencies are
designed to help differentiate a partner’s capabilities with specific Microsoft
technologies to customers looking for a particular type of solution. Each
competency has a unique set of requirements and benefits, formulated to
accurately represent the specific skills and services that partners bring to the
technology industry.The Microsoft Partner Program was launched in December 2003 and represents
Microsoft’s ongoing commitment to the success of partners worldwide. The program
offers a single, integrated partnering framework that recognizes partner
expertise, rewards the total impact that partners have in the technology
marketplace, and delivers more value to help partners’ businesses be successful.Network Engines – THE Appliance Company
Network Engines appliances are designed to ease the deployment, enhance
manageability, and increase security of mission critical software applications.Our heritage of providing technology products and services tailored
supporting to the entire lifecycle of our customers appliances has made us the
appliance partner of choice for software market leaders.Founded in 1997, Network Engines is headquartered in Canton, Massachusetts
and trades on the NASDAQ exchange under the symbol NENG. For more information
about the Company’s products and services visit: http://www.networkengines.com.Safe Harbor for Forward-Looking Statements
Statements in this press release regarding Network Engines’ (the "Company")
future financial performance and any other statements about Network Engines’
management’s future expectations, beliefs, goals, plans or prospects constitute
forward-looking statements within the meaning of the Private Securities
Litigation Reform Act of 1995. The Company’s actual results could differ
materially from those stated or implied in forward-looking statements due to a
number of factors, including those factors contained in the Company’s most
recent annual report on Form 10-K for the year ended September 30, 2005 under
the section "Factors That May Affect Future Operating Results" as well as other
documents that may be filed by the Company from time to time with the Securities
and Exchange Commission. Forward-looking statements include statements regarding
the Company’s expectations, beliefs, intentions or strategies regarding the
future and can be identified by forward-looking words such as "anticipate,"
"believe," "could," "estimate," "expect," "intend," "may," "should," "will," and
"would" or similar words. The Company assumes no obligations to update the
information included in this press release.Network Engines and the Network Engines logo are trademarks of Network
Engines, Inc. All other registered and unregistered trademarks in this document
are the sole property of their respective owners.
-
Beta Version of Script for ISA Firewalls to Block WMF Exploits
Jim Harrison has
published a beta version of a script that will configure your ISA firewall to
block many of the Web based vectors for WMF exploits.Check it out
at:DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htmHTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Microsoft Releases WMF Update Early
Just a quick note
to let you know that MS has released the update to correct the WMF situation
early. Check it out at:DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htmHTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
ISA Firewall Script to Migtigate WMF Exploit Finalized
Jim Harrison has
finalized his script that configures the ISA firewall to mitigate the threat of
the WMF exploit. You can download it from:DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htmHTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
ISA Firewall Script to Mitigate WMF Exploit Finalized
Jim Harrison has finalized his script that configures the ISA firewall to mitigate the threat of the WMF exploit. You can download it from:DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htmHTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Network Engines Appoints Gregory A. Shortell as President and CEO
From: USEast News Service
[mailto:NewsService@USEast.Net]
Sent: Monday, January 09, 2006 4:08
PM
To: USEast News Service
Subject: Network Engines Appoints
Gregory A. Shortell as President and CEO a free service from USEast Network
Services
Visit the USEast BLOG to find more news
about appliances, Microsoft, security and lots of other
subjects.
Network Engines Appoints Gregory A. Shortell as President and
CEOFormer Nokia Executive and Network Security Industry
Veteran to Lead Appliance CompanyCanton, MA ? January 9, 2006 ? Network Engines, Inc. (NASDAQ: NENG), a
leading provider of storage and security server appliance products and services,
today announced that Gregory A. Shortell has been appointed as president and
chief executive officer, effective immediately. Mr. Shortell is succeeding Mr.
John Curtis, who will continue with the company as vice president of OEM
business and assist in the leadership transition. Mr. Shortell was also
appointed to Network Engines? board of directors replacing Mr. Curtis.In his role as president and CEO, Mr. Shortell is responsible for leading the
company’s strategic direction while overseeing and managing day-to-day
operations. Mr. Shortell brings to Network Engines more than 20 years of
experience in executive management as well as global sales and marketing
operations. He has a proven track record of developing global indirect sales
channels and key partner relationships while increasing revenue and market share
in segments that include OEM component hardware and network security software
appliances.Mr. Shortell joins Network Engines from Nokia where he was the Senior Vice
President, Global Sales and Marketing. During his tenure there, he was credited
with developing Nokia?s enterprise delivery network of distribution and reseller
channels. While responsible for the global sales and marketing of Nokia?s
Enterprise Businesses Group, he expanded the business from $14 million in 1997
to more than $1 billion in 2004 by building sales and services in the network
security, appliance, connectivity and mobility segments.
?Over the
past year, Network Engines has strengthened its OEM business and created a
foundation for its own branded security appliances,? said Fontaine Richardson,
lead director of Network Engines? board of directors. ?Greg?s experience in
strategic planning, sales and marketing operations, as well as appliance
industry knowledge makes him uniquely suited to lead the company into its next
phase of development. We would like to thank John Curtis for the
tremendous job he has done as CEO. The Board looks forward to working with Greg
to leverage the opportunities resident in our businesses and increase
shareholder value.??I am very excited to be given the opportunity to direct one of the
industry?s leading appliance companies, as I believe there is a significant
market opportunity for network appliances,? said Mr. Shortell, president and CEO
of Network Engines. ?Network Engines has a proven track record as a successful
OEM provider working with leading firms such as EMC and Nortel. Based on this
experience, we are presented with a unique opportunity to collaborate with our
partner Microsoft to bring security solutions to Microsoft business applications
and establish profitable growth for the company.?As vice president of OEM business, John Curtis will be responsible for
strengthening and expanding relationships with existing OEM partners as well as
expanding the OEM business. ?I am very proud of the progress our company
has made over the past four years and I am excited about the opportunity to
continue to grow our OEM business,? remarked Mr. Curtis.Prior to its purchase by Nokia in 1998, Mr. Shortell was the Managing
Director of International Operations at Ipsilon, where he established the
company?s sales, marketing and support organizations in both the EMEA and APAC
regions. Before joining Ipsilon, he served as Vice President, International at
Xyplex Corporation. While responsible for the management and development of the
International region for Xyplex, he led the corporation in growth, profitability
and sales productivity. Previously, as Vice President, International at Emulex
Corporation, he built an international operation for the company?s storage
networking solutions and significantly increased international sales over three
years. After receiving a B.S. from William Penn University and an M.B.A. from
Long Island University, Mr. Shortell completed a post graduate program with a
concentration in International Business at Oxford University, England, and
completed the Nokia Executive Management Development program at IMD in Lausanne,
Switzerland.Network Engines – THE Appliance Company
Network Engines
appliances are designed to ease the deployment, enhance manageability, and
increase security of mission critical software applications.Our heritage of providing technology products and services tailored
supporting to the entire lifecycle of our customers appliances has made us the
appliance partner of choice for software market leaders.Founded in 1997, Network Engines is headquartered in Canton, Massachusetts
and trades on the NASDAQ exchange under the symbol NENG. For more
information about the Company’s products and services visit: http://www.networkengines.com.
-
[isalist] RE: WMF Vulnerability Script – Update 1.2
Ok – thanx to all who reported.
V1.2 is on http://isatools.org/block_wmf.zip.
I’ve changed the WMF-4 and -5 signatures to use "content-disposition"
instead of "blank". This is what was causing the crashes in the HTTP
Filter. Not to worry; this has been fixed in SP2, which coincidentally
is why I didn’t see it.
Also, you should manually remove these filters (yes, all of them) from
any web publishing rule that is servicing RPC/HTTP traffic. It seems
that *any* filter definitions cause ISA to trash this traffic (*really*
secure, huh?).Also, since some folks have had crashing problems, I’ve created a script
to get you out of trouble faster. Unblock_wmf.vbs is your panic button
and is included in the package. It completely reverts the changes
wrought by block_wmf.vbs.Updated actions:
1. backs up your current config
2. examines Enterprise (EE) and all arrays
3. within each Enterprise policy and array, it examines all rules. If
the rule is:
– "allow"
– not "default"
– includes the Web Proxy filter
..it updates the HTTP Filter settings as:Extensions:
If "block specified"
Add .emf
Add .wmfIf "allow specified"
Remove .emf
Remove .wmfSignatures:
Name=WMF-1
Description=" request url ‘.emf’ file type trigger"
Type="Request URL"
Signature=".emf"Name=WMF-2
Description=" request url ‘.wmf’ file type trigger"
Type="Request URL"
Signature=".wmf"Name=WMF-3
Description=" response headers content-type trigger"
Type="Response Headers"
HTTP Header="content-type"
Signature="msmetafile"Name=WMF-4
Description=" response header ‘.emf’ file type trigger"
Type="Response Headers"
HTTP Header=" content-disposition "
Signature=".emf"Name=WMF-5
Desctiption=" response header ‘.wmf’ file type trigger"
Type="Response Headers"
HTTP Header="content-disposition"
Signature=".wmf"Name=WMF-6
Description=" response body ‘.emf’ file type trigger "
Type="Response Body"
Signature=".emf"Name=WMF-7
Description=" response body ‘.wmf’ file type trigger "
Type="Response Body"
Signature=".wmf"Name=WMF-8
Description=" response body base-64 file header trigger "
Type="Response Body"
Signature="184Gmg"——————————————–
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
——————————————–DISCUSS THIS POST AT:
http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-1
4-2006/m_2002002974/tm.htm
Thomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
New ISA Firewall MVPs
Hey folks,
I had no idea until today
how many new ISA firewall MVPs we have! Check
this out:Amy
Babinchak — Amy enters the ISA firewall space via SBS 2003 SP1. Amy is
the leading contributor of ISA firewall information on the SBS platform over at
http://www.isaserver.orgJason Fossen — new MVP and
he’s located here in my neck of the woods — Dallas, Texas. Jason runs the ISA
firewall scripting Web site http://www.isascripts.orgMoez
Mezghani — new MVP from North AfricaMartin Pavlis
— MVP from the Czech RepublicAlessandro Perilli
— MVP from Italy and the genius who taught me how to support four NICs
in a VMware virtual machine :))Meibo Zhang — a friend
of mine from China who has a tremendous Chinese language ISA firewall site at
http://www.isacn.orgHong Zhi Zhu — another new MVP from
China, Chong Qing. He’s active in the Windows IT Pro magazine web boards and has
written a number of articles on the ISA firewallHopefully one day all
the ISA firewall MVPs will be able to get together at the same time in the
Redmond world wide MVP conference.Welcome them to the
club!DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-14-2006/m_2002002974/tm.htm
Thanks!
TomThomas
W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP —
ISA Firewalls
**Who is John Galt?**
-
Collective Software Announces SIP Support for ISA Firewalls
LCS-Bridge:? SIP application filter
Get the most from your Microsoft? Live Communications Server 2005 deployment with Collective Software LCS-Bridge for ISA Server 2004. Here are some of the exciting features we are building into this powerful filtering solution:
- Enable secure collaboration across the firewall:
- Transfer files
- Share applications
- Whiteboard
- Secure SIP traffic before it enters the network:
- Pre-authenticate external users with ISA
- SIP protocol analysis
- Dynamic port control
More on LCS-Bridge:
We are currently seeking customers for an exclusive closed-beta program for LCS-Bridge. If you have an existing LCS 2005 and ISA 2004 deployment and would like to help us finalize the features of our filter, please let us know. Ask about becoming a Beta customer
Want to ask us a question, recommend a feature, or chat about real-time communication scenarios? Head over to our forum and speak your mind. LCS-Bridge discussion
?DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-14-2006/m_2002002974/tm.htm?HTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**?
- Enable secure collaboration across the firewall:
-
SBS Users and IDS
I get a good
number of questions from people asking what to do about port scan
warnings from their ISA firewalls. Its a good question, as there is a
general impression that port scans represent some sort of attack. The problem is
that the vast majority of ISA firewall admins, and especially those who use the
ISA firewall on SBS, do not understand the nature of port scans and how to
appropriately respond to them.?In most cases, you
can ignore port scans. Port scans are inevitiable and you will never stop them.
The good news is that you don’t need to stop them. However, for the trained
observer, certain types of ports scans, done in particiular patterns, can become
"interesting" from the technical and investigational point of view.
?The problem is
that it takes a trained eye to appreciate the "interesting" from the
"uninteresting" port scans, and the overwhelming majority of SBS admins and
consultants don’t have this training. The end result is that port scan IDS
warnings from the ISA firewall generate fear, uncertainty and doubt and lead the
hapless and uninformed to disable needed services, which leads to a self-imposed
DoS secondary to a non-existant threat.?For this reason,
I’d encourage all ISA on SBS users to disable the port scan IDS feature in the
ISA firewall console. However, if you’re interested in learning about intrusion
detection and how to separate the wheat from the chaff, then I highly recommend
the following books:?Network
Intrusion Detection by Stephen Northcutt http://www.amazon.com/gp/product/0735712654/qid=1137084489/sr=2-1/ref=pd_bbs_b_2_1/103-6999506-6655024?s=books&v=glance&n=283155?Inside
Network Perimeter Security: The Definitive Guide to Firewalls, Virtual Private
Networks (VPNs), Routers, and Intrusion Detection Systems by Stephen
Northcutt http://www.amazon.com/gp/product/0735712328/qid=1137084535/sr=1-5/ref=sr_1_5/103-6999506-6655024?s=books&v=glance&n=283155?The
Protocols (TCP/IP Illustrated, Volume 1) by W. Richard Stevens http://www.amazon.com/gp/product/0201633469/qid=1137084610/sr=2-1/ref=pd_bbs_b_2_1/103-6999506-6655024?s=books&v=glance&n=283155?Internetworking with TCP/IP Vol.1:
Principles, Protocols, and Architecture by Douglas E Comer http://www.amazon.com/gp/product/0130183806/qid=1137084682/sr=2-3/ref=pd_bbs_b_2_3/103-6999506-6655024?s=books&v=glance&n=283155?Once you’ve read
and re-read and digested and understand the contents of these books, you’ll be
ready to begin your quest in interpreting IDS issues, like port scan
reports. Until then, you’re better off just turning off port scan
alerts.?DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-14-2006/m_2002002974/tm.htm?HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**?
-
Product Review: GFI WebMonitor 3.0
There are a number of solutions on the market
today that plug into the ISA firewall?s Web proxy filter that enable you to
block dangerous downloads and non-work related Web sites. One of the slickest
and easiest to configure and manage solutions I?ve found so far is the GFI
WebMonitor 3.0.?Check out the
review at http://www.isaserver.org/articles/Product-Review-GFI-WebMonitor30.html?DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-14-2006/m_2002002974/tm.htm??HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**?
-
WSSRA Virtual Environments for Dev and Test
Hey folks,
?Here’s a real
goodin’.? The WSSRA Virtual Environments for Development and
Test doc will allow you to model your network using best practices on a
virtual machine platform. Here’s the official description from the MS
site:?Windows Server
System Reference Architecture Virtual Environments for Development and Test
(WSSRA-VE) can help large organizations and enterprises create environments for
development and testing that emulate their own production environments. The
guidance describes the architectural blueprint, planning considerations,
deployment practices, and operational considerations for creating and supporting
a virtualized instantiation of the Windows Server System Reference Architecture. It leverages the power of Virtual Server 2005 and automated
deployment and configuration tools to minimize the physical infrastructure and
logistical overhead necessary to deploy emulations of various data center
services.Like WSSRA itself, the WSSRA-VE is intended to aid users in
their own effort to model their operational environment and condense it to a
scale that can be representative of the infrastructure integration challenges
facing developers and testers of distributed, message-based applications and IT
services, and still be inexpensive and relatively economical to build and use
throughout a large-scale IT organization.WSSRA-VE consists of a set of guides that can be viewed here
or as part of a downloadable package. The guides are the following:? Introduction
? Blueprint
? Planning Guide
? Build Guide
? Operations Guide
The downloadable package also includes a WSSRA-VE Deployment
Kit that provides most of the configuration files and supporting documents used
to build instances of these virtualized environments.
Downlaod the WSSRA
VE for Dev and Test at: http://www.microsoft.com/technet/itsolutions/wssra/ve/default.mspx?DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-14-2006/m_2002002974/tm.htm?HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**?
-
Speaking of Port Scans!
Amy
Babinchak did some expert sleuthing for more information on how the ISA
firewall port scan IDS feature works and came up with a real beauty! The title
of the article is ISA Server Port Scan Alerts and although
Microsoft doesn’t attribute the author, I think you should know that our ISA
firewall Hero — Jim Harrison (http://www.isatools.org) is the author of that
article and its an article that’s well worth reading, for both ISA networking
pro’s and ISA/SBS consultants.?I guarantee you’ll
come out with a better understanding of port scans.?Where will you
find the link to the aritcle? I could tell you here, but since Amy found the
article, I’m going to send you to her site!?ISA in SBS
– yes, it’s secure http://isainsbs.blogspot.com/??DISCUSSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-14-2006/m_2002002974/tm.htm?HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**?
-
Creating a Parallel ISA Firewall Configuration in a Netscreen DMZ
Over the years there have been a number of
questions about how to configure the ISA firewall in a ?hardware? firewall?s
?DMZ?. I have to admit that this question never made much sense to me, since I
couldn?t figure out why the fledgling ISA firewall admin would want to create
such a configuration. It seemed to be a simple affair to place the ISA firewall
either in parallel or in a back to back configuration with the ?hardware?
firewall in front of the ISA firewall, allowing the ISA firewall to provide its
superior level of protection nearest to the protected resources.?However, I
recently participated in a thread where the fellow asking the question clearly
stated his design goals and wanted to know how to best achieve them. You can
read that thread over at http://forums.isaserver.org/Where_to_put_my_ISA_with_Netscreen%3f%3f%3f/m_2002002953/tm.htm?To find out my
solution, check out: http://www.isaserver.org/tutorials/Creating-Parallel-ISA-Firewall-Configuration-Netscreen-DMZ.html??DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-21-2006/m_2002003855/tm.htm??HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**?
-
Securing Small Business Server 2003 using ISA Server 2004
Head’s up on a
Securing SBS 2003 with ISA 2004 course being offered as part of the MS partner
program. Registration is FREE!?Check out Amy
Babinchak’s blog over at http://isainsbs.blogspot.com/2006/01/free-securing-sbs-with-isa-training.html?for
details.?DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-21-2006/m_2002003855/tm.htm?HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**?
-
Least Privilege to User Accounts on Windows XP
A connection between a computer and
the Internet increases the level of risk from malicious software and external
attackers, and as old risks are managed, new ones are discovered or created.
?
A significant factor that increases
the risks from malicious software is the tendency to give users administrative
rights on their client computers. When a user or administrator logs on with
administrative rights, any programs that they run, such as browsers, e-mail
clients, and instant messaging programs, also have administrative rights. If
these programs activate malicious software, that malicious software can install
itself, manipulate services such as antivirus programs, and even hide from the
operating system.?
Malicious software poses numerous
threats to organizations, from intercepting a user’s logon credentials with a
keystroke logger to achieving complete control over a computer or an entire
network by using a rootkit. Malicious software can cause Web sites to become
inaccessible, destroy or corrupt data, and reformat hard
disks.?
A defense-in-depth strategy, with
overlapping layers of security, is the best way to counter these threats, and
the least-privileged user account (LUA) approach is an important part of that
defensive strategy. The LUA approach ensures that users follow the principle of
least privilege and always log on with limited user accounts. This strategy also
aims to limit the use of administrative credentials to administrators, and then
only for administrative tasks.?
For more info see the new Applying
the Principle of Least Privilege to User Accounts on Windows XP. http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/luawinxp.mspx#ELAA
?
DISCUSS THIS POST
AT:?http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-21-2006/m_2002003855/tm.htmHTH,
Tom
Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**?
-
Coming Soon: The ISAserver.org Readers’ Choice Awards – Vote for your favorite products!
Beginning in February 2006 ISAserver.org will
hold bi-monthly Readers? Choice polls, giving the ISAserver.org community the
opportunity to vote for the products they view as the very best in their
respective category.?The polls will be held on a bi-monthly basis
with?eighteen awards being announced in six different categories. Products
get awards for coming in?as the top rated product, first runner up and
second runner up.?Visitors to the site can cast their vote by selecting
their favorite product in the left-hand?bar.Below is a list of the ISAserver.org?Readers? Choice categories and the
month that visitors can submit their votes.- ISA Access Control – February 2006
- ISA Anti Virus – April 2006
- ISA Reporting – June 2006
- ISA Monitoring & Administration – August 2006
- ISA Content Security – October 2006
- ISA Hardware Appliances – December 2006
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-21-2006/m_2002003855/tm.htm?HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**?
-
Help Finding ISA Firewall Answers
Do you have
problems finding answers to your ISA firewall related questions? There’s a good
chance the answer to your question can be found somewhere on the Internet, but
where? The Microsoft ISA Server team posted a blog entry today with some good
tips and tricks on how to effectively navigate ISA content on the
Web.?Check it out on
the ISA Server Team Blog at https://blogs.technet.com/isablog/default.aspx?DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-21-2006/m_2002003855/tm.htm?HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**?
-
Corrent Launches UTM Appliance based on Microsoft ISA 2004 and Sybari Antigen
?A?free
service?from USEast Network Services?????
Visit the USEast BLOG to find more news
about appliances, Microsoft, security and lots of other
subjects.
?Press Release Source: Corrent Corp. Corrent Launches UTM Appliance with Intelligent I/O and
Hardware-Enforced DDoS Protection
Monday January 23,
8:01 am ETTEMPE, Ariz.–(BUSINESS WIRE)–Jan. 23, 2006–Corrent Corp., a
leading developer of hardware-accelerated security appliances, and an OEM
appliance partner for Microsoft security solutions, today announced the release
of the Corrent? SR325 security appliance, the first unified threat management
(UTM) appliance with intelligent I/O, inline VPN acceleration, and
hardware-enforced DDoS protection that is based on Microsoft Internet Security
& Acceleration (ISA) Server 2004 and Sybari Antigen software. The SR325 is
an "all-in-one" security appliance that offers comprehensive protection for
enterprise networks with security features, integration, and a level of
performance that far exceed server-based solutions."There is no lack of products for handling the escalating number of security
threats facing corporations each year, but deploying separate security
appliances and trying to get them to work together has created just another
impossible task for overworked IT managers," said Richard Takahashi, Corrent
president and CEO. "By combining our hardware acceleration technology with
Microsoft security software, we are able to deliver a single appliance that
offers comprehensive protection for both external and internal threats. Best of
all, because the appliance is based on Microsoft technology, it is easy to use
and integrates seamlessly with existing networks."For businesses with significant investments in Microsoft technology, the
Corrent SR325 is a smart choice as either a gateway device for the perimeter, or
as an internal firewall to add an extra layer of defense to protect valuable
assets such as Microsoft Exchange Server or other application servers. The SR325
offers a stateful inspection and application-layer firewall, intrusion detection
and prevention, VPN, Web caching and gateway antivirus protection for SMTP
traffic."Our customers appreciate the wide range of options provided by the
integration of Microsoft security solutions with OEM appliance partners like
Corrent," said Marcus Schmidt, senior product manager of the Enterprise Access
& Security Products division at Microsoft Corp. "UTM appliances are
attractive to many customers because the convenience and ease of installation of
a single appliance simplifies deployment and management."Corrent Intelligent I/O Technology
At the heart of the SR325 is an intelligent I/O subsystem consisting of three
dual-port intelligent Gigabit Ethernet cards, each with its own RISC-based
Corrent CR777 security processor and separate memory subsystem. These
intelligent I/O interfaces are capable of VPN acceleration, offloading packet
processing and using their integrated signature-matching engines to enhance
content inspection, such as virus detection. Because the I/O subsystem is
programmable, functions can be upgraded to keep pace with improvements to
Microsoft Windows Server and security software.Capable of more than 700 Mbps in VPN throughput and more than 1.5 Gbps in
firewall throughput, the SR325 offers one of the highest levels of performance
available in a Windows-based platform. Since even a small amount of VPN traffic
can have a negative effect on firewall performance, offloading VPN processing to
dedicated processors ensures that other network traffic can be processed at peak
rates.Defending Against DDoS Attacks
The intelligent I/O subsystem is also key to the SR325’s ability to provide
superior protection against Distributed Denial-of-Service attacks. While all
firewalls offer some protection against DDoS attacks, Corrent appliances are
unique in their ability to detect and mitigate attacks in hardware at the
network interfaces.DDoS attacks often originate from Internet worms within a corporation from
infected laptops or PCs. Since firewalls seldom restrict outgoing traffic, the
firewall can be choked by DDoS traffic, even if it is not the target of the
attack, and even if it takes no direct action to stop it. The surge in traffic
from an ongoing attack can send CPU utilization to 100 percent and prevent even
administrative access to the firewall at the same time the network becomes
bottlenecked. To prevent this situation, the intelligent network subsystems on
the SR325 monitor both traffic levels and CPU utilization, and when network
traffic exceeds a preset high-water mark, the network interfaces actively
throttle excess traffic while preserving bandwidth for secure traffic and
management control. With full access, the firewall administrator can then take
steps to identify the source of the attack, isolate infected machines and create
new rules to block the attack.The SR325 security appliance is a 2U rack-mountable unit powered by dual 3
GHz Intel Xeon processors. It comes standard with hot-swappable RAID drives and
power supplies. The hardware is protected by a 3-year warranty and the purchase
price includes the first year of software support.Price and Availability
Available for shipment beginning in February 2006, Corrent’s SR325 is priced
starting at $13,000 MSRP. Corrent products are distributed by Ingram Micro and
sold through a network of value-added resellers worldwide. Government customers
can purchase at substantial discounts directly through GSA Advantage, the
federal purchasing system.For more information about purchasing or about becoming a Corrent reseller,
please visit http://www.corrent.com.
-
Deploying SQL Server Logging with Windows Server 2003 Internet Authentication Service (IAS)
Provides a technical
overview of Internet Authentication Service (IAS) accounting and describes three
ways to deploy IAS SQL Server logging with Microsoft? SQL Server? 2000 and SQL
Server Desktop Engine (MSDE 2000).?Download this very useful doc at http://www.microsoft.com/downloads/details.aspx?FamilyID=ab63da81-11e7-4705-8c48-24e1d0bf8bc9&DisplayLang=en?DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-28-2006/m_2002004840/tm.htm?HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**?&referrer=)
-
Understand how ISA Server 2004’s firewall can help secure Exchange Web services
If you’re using Outlook Web Access to allow
remote users to access your Exchange server, you don’t want to expose your
network to outside attack at the same time. Here’s what you need to know about
how ISA Server 2004’s firewall may help.??DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-28-2006/m_2002004840/tm.htm?HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**?
-
Configuring the ISA firewall’s HTTP stateful inspection filter to protect OWA, OMA, and Exchange ActiveSync Web sites
When you start using Web applications like
Outlook Web Access for Exchange, you open your network up to new avenues of
attack. Here’s how you can defend your network using ISA Server
2004.?Learn all about it
at: http://techrepublic.com.com/5100-6350_11-6025401.html?tag=sc?DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-28-2006/m_2002004840/tm.htm?HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**?
-
Providing External users access to the ISA firewall’s Web proxy services
A popular request in the ISA firewall community is how to provide external users access to the ISA firewall’s Web proxy service. There are a number of reasons why you might want to publish the ISA firewall’s Web proxy listener to allow external users access to it.For example, suppose you have a company with a main office that uses an ISA firewall at the main office. This company has six branch offices with 10-30 computers located at each branch office. Because each branch office has so few users, corporate IT has decided to use a simple NAT device to provide Internet access for each branch office. The simple NAT devices do not support site to site VPN connections, so corporate IT cannot use site to site VPN connections to connect the branch offices to the main office and they do not want to allow remote access VPN connections from each individual host at each office because of the administrative overhead.
Learn more about the design and configuration at: http://techrepublic.com.com/5100-6350_11-5961196.html?tag=sc
?DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-28-2006/m_2002004840/tm.htm??HTH,TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**?
-
Interesting Study on Firewall Configuration Errors
Check out this
paper on A Quantitative Study of Firewall Configuration Errors
at http://www.eng.tau.ac.il/~yash/computer2004.pdf?I found it a
fascinating read because I wasn’t aware that anyone had ever tried to quantify
firewall configuration errors in a semi-controlled fashion. You should read the
paper for what it provides in terms of an approach to studying the problem, but
you should not accept the conclusions. The conclusions are invalided by the
fatally flawed definitions they use for defining a configuration
errors.?For example, they
include the following as configuration errors that would be patently incorrect
when deploying ISA firewalls in the correct context:?Allowing
NetBIOS to cross the firewall For an intranet firewall, you should
enable NetBIOS from one private segment to another. It would be a configuration
error only if you allowed NetBIOS to and from the Internet or other
significantly untrusted segment?Allowing
RPC Portmapper to cross the firewall This is true for most firewalls,
but not the ISA firewall. The reason for this is that the ISA firewall has a
sophisticated RPC application inspection filter that protects against RPC
exploits?These were the two
major errors. But overall a great read!?DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-28-2006/m_2002004840/tm.htm?HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**?
-
How to work around an issue with VPN clients and split DNS
"In
the past I have read a lot about VPN users having problems accessing internal
resources which are also published on the same ISA server. I had never fully
understood those problems because I had never experienced them myself. Recently
I was lucky to see the problem with my own eyes and investigate it further. Now,
I would like to share a nice workaround to that problem.…"?Read how
Stefaan Pouseele solves this problem at http://www.isaserver.org/tutorials/work-around-VPN-clients-split-DNS.html?DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-28-2006/m_2002004840/tm.htm??HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John
Galt?**?
-
Publishing Remote Desktop Web Connection Sites with the ISA Firewall Part 2: Creating the Web and Server Publishing Rules
In this article we?ll move?our attention to the details of the
configuration. Enabling remote access to remote desktop Web connections sites is
fairly straightforward: you need to create a Web Publishing Rule and one or more
RDP Server Publishing Rules, depending on how many RDP servers you want to make
available to external users.…?Check out
the detailed procedures at: http://www.isaserver.org/tutorials/Publishing-Remote-Desktop-Web-Connection-Sites-ISA-Firewall-Part2.html?DISCUSS THIS POST AT: http://forums.isaserver.org/Tom%26%2339%3bs_ISA_Firewall_Blog_Discussion/forumid_48/tt.htm?HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John
Galt?**?
-
Why Your ISA Firewall Web Proxy Logs MUST Contain Anonymous Entries
From Jim Harrison:Correct – all web clients do exactly that.
This is also why the logs will forever contain anonymous requests even
if all you allow are authenticated connections, because ISA will log
those denied anonymous requests.What you can’t tell from the logs is what happens after that in detail.
This requires a bit of Netmon (or Ethereal, if you swing that way)
sleuthing.Here’s the bouncing ball:
** Client, he say:
GET http://www.isaserver.org/ HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/x-shockwave-flash, application/vnd.ms-excel,
application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET
CLR 1.1.4322; InfoPath.1)
Host: http://www.isaserver.org
Proxy-Connection: Keep-Alive** ISA, she say:
HTTP/1.1 407 Proxy Authentication Required ( The ISA Server requires
authorization to fulfill the request. Access to the Web Proxy service is
denied. )
Via: 1.1 HEARTOFGOLD
Proxy-Authenticate: Negotiate
Proxy-Authenticate: Kerberos
Proxy-Authenticate: NTLM
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
Pragma: no-cache
Cache-Control: no-cache
Content-Type: text/html
Content-Length: 4113..note – the ISA in this case (as in yours, probably) logged this
request as anonymous and responded saying that it allowed three
authentication methods: Negotiate, Kerberos and NTLM. These are the
default auth methods for any ISA installation (including SBS).** Client, he say:
GET http://www.isaserver.org/ HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/x-shockwave-flash, application/vnd.ms-excel,
application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET
CLR 1.1.4322; InfoPath.1)
Host: http://www.isaserver.org
Proxy-Connection: Keep-Alive
Proxy-Authorization: NTLM
TlRMTVNTUAABAAAAB7IIogQABAAzAAAACwALACgAAAAFASgKAAAAD0ZPUkRQUkVGRUNUSE9N
RQ==Note that the client chose NTLM auth and passed the first part of the
handshake in Base-64 encoding. Not to worry, this isn’t like Basic,
which is base-64 encoded plain text; this is base-64 encoded encrypted
information. ISA also logs this request as anonymous.** ISA, she say:
HTTP/1.1 407 Proxy Authentication Required ( Access is denied. )
Via: 1.1 HEARTOFGOLD
Proxy-Authenticate: NTLM
TlRMTVNTUAACAAAACAAIADgAAAAFgomiWWcfZe6QNCsAAAAAAAAAALQAtABAAAAABQLODgAA
AA9IAE8ATQBFAAIACABIAE8ATQBFAAEAFgBIAEUAQQBSAFQATwBGAEcATwBMAEQABAAiAGgA
bwBtAGUALgBqAGEAbABvAGoAYQBzAGgALgBvAHIAZwADADoAaABlAGEAcgB0AG8AZgBnAG8A
bABkAC4AaABvAG0AZQAuAGoAYQBsAG8AagBhAHMAaAAuAG8AcgBnAAUAIgBoAG8AbQBlAC4A
agBhAGwAbwBqAGEAcwBoAC4AbwByAGcAAAAAAA==
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
Pragma: no-cache
Cache-Control: no-cache
Content-Type: text/html
Content-Length: 0Note that ISA also passed some NTLM data back to the client – this is
part and parcel to NTLM authentication even outside of HTTP** Client, he say:
GET http://www.isaserver.org/ HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/x-shockwave-flash, application/vnd.ms-excel,
application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;.NET
CLR 1.1.4322; InfoPath.1)
Host: http://www.isaserver.org
Proxy-Connection: Keep-Alive
Proxy-Authorization: NTLM
TlRMTVNTUAADAAAAGAAYAG4AAAAYABgAhgAAAAgACABIAAAACAAIAFAAAAAWABYAWAAAAAAA
AACeAAAABYKIogUBKAoAAAAPSABPAE0ARQBKAGkAbQBIAEYATwBSAEQAUABSAEUARgBFAEMA
VABunrbKxTfLxwAAAAAAAAAAAAAAAAAAAABNhP8BkKK3ZR1MXfC2h14+Q4IQaVlWRH8=Note that the client passes the remaining part of the NTLM handshake –
if ISA can resolve the credentials passed by the client during this
process, all will be FD&H.** ISA, she say:
HTTP/1.1 200 OK
Proxy-Connection: Keep-Alive
Connection: Keep-Alive
Content-Length: 40936
Via: 1.1 HEARTOFGOLD
Date: Fri, 27 Jan 2006 05:49:15 GMT
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: ASPSESSIONIDCCRRSRBC=EIBLFICAIMCPFBFCEKFFKBEA; path=/
Cache-control: privateThis is where access is allowed (200 response).
You should note that I haven’t included anything that may have been
passed in the HTTP body – it’s not important to this discussion and only
makes for an unweildy thread.——————————————–
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!Thomas W Shinder, M.D.
Site: http://www.isaserver.org <http://www.isaserver.org/>
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7 <http://tinyurl.com/3xqb7>
MVP — ISA Firewalls
**Who is John Galt?**
-
Ever Wonder Why Bandwidth Control Disappeared from ISA 2004
Here’s the skinny:Details follow:
1. BW controls in ISA 2000 didn’t do what everyone expected, although
they did do what they were designed to.2. Since the BW controls in ISA 2000 were a "non-standard mechanism",
they didn’t play well in the traffic control space3. there wasn’t time to build in an industry standard mechanism before
ISA 2004 shipped, so it hit the gates without anything.4. Branch Office Updates (coming to a download site RSN) adds Diffserv;
a mature, industry-standard traffic control mechanism.——————————————–
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
——————————————–
-
FW: [isalist] RE: Web Client Requests
Here’s some facinating information on why your WPAD and
autoconfiguration script might not work as you expected:I wish it were that simple…
It depends on how the app is configured and coded.For instance, while I was preparing my updated "ISA clients"
presentation for Black Hat (thanx for the invite, Tim!) last year, I
discovered that of all the "proxy-aware" browsers, only IE, FF and NS
actually requested *and* used the script properly.Windows Media Player for instance, makes a wpad request as:
GET /wpad.dat?Type=WMT
Needless to say, ISA dislikes this request and tells WMP to bugger off.
The second wpad request is more proper, but its clear from the list
comments that it doesn’t always play in the user-auth game properly (no
Dan; I still don’t have a good answer from them).The only way to know for certain what’s happening is to:
1. Use ISA active log queries
2. Crack open your fav net cap tool
..and watch the conversation..but you’re right; if it "gets" proxy auth at all, many apps don’t
"get" anything more than Basic or Digest if you’re *really* lucky.——————————————–
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
——————————————–—–Original Message—–
From: Thomas W Shinder [mailto:tshinder@tacteam.net]
Sent: Sunday, January 29, 2006 8:12 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Web Client RequestsHi Jim,
Just to make clear, IE negotiates with the Web proxy device.
In contrast, cr*pware like Realplayer and Java apps don’t negotiate.
Right?
TomThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls
**Who is John Galt?**
-
Jim Harrison on WinInet and WinHTTP
A rare lesson on the WinInet and WinHTTP interfaces by Jim Harrison:First, we’ll cover the bare basics of WinInet and WinHTTP.
You’ll have to put on your developer hat for this one, though cuz I’m
about to "background" you a bunch…First a couple of links from MSDN:
WinInet:
http://msdn.microsoft.com/library/en-us/wininet/wininet/portal.asp
WinHTTP:
http://msdn.microsoft.com/library/en-us/winhttp/http/winhttp_start_page.
aspThe most generic term that can be applied to either WinInet or WinHTTP
is "Internet library", since they both provide similar APIs for HTTP and
FTP-over-HTTP traffic. Unlike WinInet, WinHTTP has no support for
direct FTP communications; you *must* use a CERN proxy to access FTP
sites with WinHTTP; but enough of that…You’ll also hear wild rumors of other things such as XMLHTTP and
ServerXMLHTTP, but these are just wrappers around WinInet and WinHTTP,
respectively. By the same token, neither of them should be confused
with Winsock, which is another layer them and the actual TCP/IP stack.Basically, they all look sorta like this in the "grand scheme of things"
(look out, Alexandre; more ASCII art for ya):YourApplication.exe
| |
WinInet WinHTTP
|___________|
|
Winsock <—-> Firewall Client
|
TCP/IP
|
YaddaWinInet
– proxy configuration registry
Policy:
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet
Settings\ProxySettingsPerUser.
Default user:
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Interactive user:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
System:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet SettingsWhich one of the above locations is used depends on whether or not an
actual user account is in use (logged in or impersonated) and the
setting of the ProxySettingsPerUser value. If this is set to 0, then
only the System default proxy settings will be used by WinInet-based
applications. Note that the proxy configuration used by IE is the
default proxy configuration used by any other application that makes use
of WinInet *unless* they explicitly change them as described in
http://msdn.microsoft.com/library/en-us/wininet/wininet/setting_and_retr
ieving_internet_options.asp.Unfortunately, if they only change them for the current session, there’s
no way you can determine this except via netcap analysis.WinHTTP
– proxy config registry
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttpAs you can see (you can, can’t you?), WinHTTP proxy configuration is
simpler than WinInet because it uses only one location. The preferred
method of configuring WinHTTP proxy is via the use of ProxyCfg.exe, a
tool written specifically to handle this task. This KB addresses an
updated version of the tool:
http://support.microsoft.com/kb/830605/en-us. WinHTTP does (almost)
understand how to use the wpad script, but with limitations as outlined
here:
http://msdn.microsoft.com/library/en-us/winhttp/http/autoproxy_issues_in
_winhttp.asp.Using ProxyCfg, you have two options; direct or specific proxy. Note
that you don’t get to specify "auto-" or "config URL". What they don’t
tell you is that if there are no values stored here, WinHTTP will defer
to the WinInet settings, which is why OL2K3 usually seems to "obey" IE
configuration. If WinInet is configured for wpad, then WinHTTP will use
it, too.WPAD
While WinHTTP and WinInet both understand how to retrieve and consume
the wpad script, the calling application can also instruct both to use
either static proxy or wpad (called "autoproxy" by WinHTTP). To answer
your "SBS wpad" question, there is nothing special about the wpad
package I built for SBS; the package merely takes advantage of the fact
that this script is available via the Web Proxy listener as well as the
auto-configuration listener. IOW, nothing will change for this package
when SP2 hits the streets.GPO
..of course, GPO WinInet (IE) settings affect how and WinHTTP
applications behave as well…WTF?
The biggest question in anyone’s mind is less likely to be "what does
each do?", but more "how do I know when app <blah> is using one or the
other?", or "how do I control the behavior of app <blah>?", or even
"will you just get on with it?!?" This is a toughie.Determining library usage for app <blah>:
The simplest thing I can recommend is that you learn to use
winhttptracecfg. This tool enables you to configure WinHTTP tracing so
that you can not only determine what applications or services are using
WinHTTP, you can also see what they’re doing "on the wire".
Instructions for use of this tool are found here:
http://msdn.microsoft.com/library/en-us/winhttp/http/winhttptracecfg_exe
__a_trace_configuration_tool.asp. My fav cmd-line is: Winhttptracecfg
-e 1 -l c:\<TestName>. This enables WinHTTP tracing and configures it
to write to a file on C:\ with a filename starting with <TestName>, so
that I have an idea what I was about when this file was written. If
this file gets created when I run my app, then I know it’s using
WinHTTP; otherwise, it’s using WinInet or custom code (ew). The only
way you can see if an app is using WinInet is to either ask the
developers or sun it under a debugger and watch the system calls. By
default, WinHTTP tracing adds to the filename so that you know what
process was being logged and the date/time of the start of the logging,
as: "WinMedia-wmplayer.exe-1236.10.27.05.660-01.29.2006.LOG". Since
WinHTTP tracing creates a file "per-process", it’s sometimes fun to
enable WinHTTP tracing to see what things are happening on your system
that you don’t even know about. Just remember to disable it or it’ll
run forever.How do I control how app <blah> behaves?
This is the real problem isn’t it? How can I make app (1) act as a web
proxy client, but app (2) act as a SecureNET client, and app (3) act as
a Firewall Client, all the while allowing app (4) to take nudie pictures
of me while my webcam is broken (did I really say that out loud)?.
Unfortunately, there isn’t a "one size fits all" answer because:
– Not all applications are proxy-aware
– Not all applications allow you any form of control over their behavior
– Not all applications allow you the same level of control
– Not all applications behave the same when configured as <blah>
– Not all application developers have a freakin’ clue how to write code
that behaves properlyIn general follow these guidelines:
– use WinInet settings first – both WinInet and WinHTTP use these by
default
– use wpad whenever possible; if the applications can properly consume
it, you get one-stop shopping for your proxy config
– use system-level settings and disable per-user settings. This can
help keep the users from buggering themselves (unless app (4) is in
use).
– use proxycfg only when you’ve positively determined that the settings
you created for app (1) don’t’ adversely affect apps (2) through (4)
(especially (4)).Next entry in the thread == Java app.
——————————————–
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
——————————————–
-
The Problem with Java Apps and a Bonus on Local Host Networks
More from Jim Harrison on why Java Apps are broken (not the ISA
firewall) and issues related to horked apps that sent requests to the
Local Host Network ID:Part II – IE, 127/8 and Java apps…
Let’s break these down into their component parts.
** IE and the 127/8 problem:
IPv4 address notation is referred to as "dotted-decimal" because of the
periods separating the IP octet values. Another form of "dotted"
address notation is "fully-qualified domain name", or FQDN, which also
uses periods to separate the heirachical entites
(host.subdomain.domain.tld).
In the absence of specific instructions, IE will drop into "Rainman
mode" and treat an IP address as a "FQDN" due to the the presence of a
"." in the address. Note the caveat "in the absence of". This is where
Stefaan and I were bouncing the ball around this morning. If your next
question is "what the hell do you mean by ‘specific instructions’?",
then one example might be "go take a long walk on a short pier.", but
what you’re probably looking for is something more along the lines of:
1. configure the IE host machine with a proper domain suffix
..and
2. configure IE to use wpad (or config URL) and populate the web proxy
local IPs list
..or
3. configure IE to "use a proxy" and populate the "bypass" list
.. IE will be able to determine that 127/8 is indeed local and behave
properly.All of the above will help IE sort out the difference between "remote"
and "local" and form its connection properly. As Stefaan pointed out,
IE needs to be instructed on the environment where it operates and the
above options work toward this goal.** Java apps:
Of all things causing ISA admins to accelerate the depletion of their
mind-altering substance stores, it has to be Java apps written by
developers who either don’t understand how to use the features of the
host environment or just don’t care to try. In nearly all cases, it
boils down to three problems:
– the app doesn’t understand how to use a CERN proxy
– the app doesn’t understand how to authenticate to a CERN proxy
– the app doesn’t support the chosen auth methods of the CERN proxy
adminThis is where the fun begins, because the IE configuration absolutely
affects how the "child apps" within it operate. If IE is not handling
the applet request properly, all hell breaks loose. By the same token,
if the Java applet can’t authenticate using the auth set offered by the
proxy, the ice cream melts away here, too.In general, the answer to the Java app failing to auth using anything
but basic can be solved by applying the latest Sun JRE from
http://java.sun.com/j2se/1.5.0/download.jsp.If this doesn’t help, the app is effectively broken and needs a rewrite.
In the interim, you *must either allow Basic auth or anonymous access
for this app. Tom and others have handled both of these admirably
(generally?) on isaserver.org articles…——————————————–
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
——————————————–
-
WSUS Support for ISA Firewall Updates (Service Pack 2 and above)
From the WSUS newsgroups:
"Hi WSUS
Admins:
Just a heads up on the next new product category you will be seeing
in? WSUS
synchronization options.? Look for the addition of ISA
(Internet Security
and Acceleration Server) product family – and ISA
2004.? There will be WSUS
update support for this product in the near
term, estimated to be within the
next month.thanks –
BobbieBobbie Harder
Program Manager, WSUS
MicrosoftThis
posting is provided "As Is" with no warranties, and confers no rights.
Use of
included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htmDISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_02-5-2006/m_2002005670/tm.htm
HTH,
Tom
Thomas W Shinder, M.D.
Site:
http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP —
ISA Firewalls
**Who is John Galt?**&referrer=)
-
Security Update Horks Outlook 2002/2003
A security or
operating system update available through the Windows Update Site seems to
prevent Outlook 2002/2003 from starting. You won’t notice anything until you
restart your computer. I’ve been trying to figure out which fix broke Outlook,
but you don’t have the option of removing the fixes in the
Add/Remove Programs applet.?If you run into
the same problem, make sure that you send the error information to Microsoft.
Even better, you should call PSS and demand they do something about
this.?DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_02-5-2006/m_2002005670/tm.htm?HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls?
-
FW: Scripts
Jason Fossen, ISA
firewall MVP, has created a great script based on Stefaan Pouseele’s article on
controlling DNS settings for VPN clients connecting to networks with a well
designed split DNS infrastructure. Check it out!?J.F. Starting Member
?Posts: 29
Joined: 28.Nov.2005
Status: offline Great article!?
This could drive an admin insane!I borrowed the article’s idea
and wrote a script to manage the DNS binding order with some more
flexibility (with credit to Stefaan in the script).? The script works
on both local and remote machines and can show the current binding order,
move the WAN connection first, move the WAN connection last, or toggle the
WAN connection first-or-last to be the opposite of whatever its current
position is.? It’s named "ISA_DNS_Binding_Order.vbs" and can be
downloaded from http://www.ISAscripts.org.Thanks for the tip!
?? Cheers,
????? JF?HTH,Tom?DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_02-5-2006/m_2002005670/tm.htm?Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/Thomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls?
-
Bluecoat Dupes ISAserver.org to Promote False Claims Regarding the ISA Firewall
If you subscribe to the ISAserver.org
newsletter, you might have noticed that Bluecoat bought some advertising space
in the newsletter. I don’t have content control over the advertising, and I
wasn’t even aware of the ad placement until a couple of hours before it was
published. However, even if I were aware, I wouldn’t want to censor a sponsor
who is willing to buy ad space to share his message with potential customers. In
fact, I was impressed by how creative and aggressive they were in their attempt
to obtain competitive information in their war against the ISA firewall.
Competition is good and ends up benefiting the customer.What does NOT
benefit the customer what I strongly believe to be false, misleading and
fraudulent claims and information. Check out this video advertised in the
ISAserver.org newsletter:http://www.bluecoat.com/downloads/isawebcast.wmv
The introduction is benign enough and provides basic marketing
information about Web proxy servers, covering the security and access control
advantages proxy devices can provide. However, when they get into a discussion
of the so-called weaknesses of the ISA firewall, they are blatently,
incontrovertably, and irreconcilably wrong. Their incorrect and in my opinion
false claims would be laughable if it didn’t generate even more anger than
humor. Anger from what I apprehend to be Bluecoat’s explicit lies and false
information regarding the ISA firewall’s weaknesses vis a vis the Bluecoat
proxy.For knowledgable ISA firewall admins, you’ll be as shocked as I
am. If you’re a fledgling or part time ISA firewall admin, the (from my
interpretation) prevarications won’t be as clear. I promise to provide you the
facts, with full technical detail, that counters each of their false assertions,
either in the next newsletter, in a full fledged article, or a detailed blog
post. I would hate for any of our readers who downloaded the Bluecoat video in
good faith, and listened to it in good faith, to be taken advantage of because
of what appears to me to be an attempt by one of our advertisers to parlay a
potential customer’s ignorance about the ISA firewall platform into a potential
sale.Please take this as my formal apology to all ISAserver.org members
and ISA firewall fans for providing Bluecoat a venue for peddling what I believe
to be false and deceptive advertising. We work very hard to run a clean, ethical
and professional shop, and in my opinion, Bluecoat hurt our credibility. Its a
true lose/lose situation, as Bluecoat doesn’t need to use what I interpret as
misrepresentations of ISA firewall product in order to demonstrate its own
strengths and thus, in my opinion, sullied their own reputation as a credible
vendor. They have a quality product that can stand on its own without making
what strongly appear to me to be false claims regarding weaknesses in the ISA
firewall product.Tom
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_02-5-2006/m_2002005670/tm.htm
Thomas
W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP —
ISA Firewalls
-
ISA Firewall SP2 Alternate Tracing Registry Entries
spouseele
Moderator
?Posts: 10977
Joined: 31.May2001
From: Belgium
Status: offline Hey guys, I’ve installed SP2 on 3 boxes so far without problems. Just be aware that the new tracing function requires 800 Mbyte extra space on the C drive (default installation). For more info, check out
http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/sp2.mspx.If you want to relocate the ISA tracing files, do the following (thanks to Jim Harrison):
A) Add the following registry value under HKLM/Software/Microsoft/ISATracing
Value name == AlternateTracingFile
Value type == String Value
Value data == FullPathToTracingFile.bin
?
B)?Add the following registry value under HKLM/Software/Microsoft/ISATracing
Value name == UseAlternateTracingFile
Value type == DWORD Value
Value data == FFFFFFFF (hex)
?
C) From a cmd window, type: logman stop isa -etw & logman start isa -etw?
Note: If "UseAlternateTracingFile" = 0, "AlternateTracingFile" is ignored. If "UseAlternateTracingFile" = FFFFFFFF, "AlternateTracingFile" is used (if valid and permissions allow).?
HTH,
Stefaan< Message edited by spouseele — 5.Feb.2006 1:27:41 PM >
??DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_02-5-2006/m_2002005670/tm.htm?HTH,Tom
http://www.isaserver.org/shinder
Tom and Deb Shinder’s Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP — ISA Firewalls?
-
ISA Server 2006 Beta Live Now!
What is ISA Server 2006?
ISA Server 2006 is the integrated edge security gateway that helps protect your IT environment from Internet-based threats while enabling your users to be more productive with secure, anytime, anywhere access to Microsoft applications and data. ISA Server 2006 helps you Secure your Microsoft application infrastructure, Streamline your network and Safeguard your IT environment. ISA Server 2006 will be available in two versions: Standard Edition and Enterprise Edition.
http://www.microsoft.com/isaserver/2006/default.mspx
?
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_02-5-2006/m_2002005670/tm.htmThomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls?
-
Websense, Microsoft and Network Engines Work Together to Offer Customers NS Series Web Security Appliances
Press Release Source: Websense, Inc. Websense, Microsoft and Network Engines Work Together to Offer
Customers NS Series Web Security Appliances
Thursday
February 9, 12:30 pm ETNS Series Appliances
Combine Award-Winning Security Solutions With Websense(R) Web Security
SuiteCANTON, Mass. and SAN DIEGO, Feb. 9 /PRNewswire-FirstCall/ —
Websense, Inc. (Nasdaq: WBSN – News), the world’s leading
provider of employee internet management solutions, and Network Engines, Inc.
(Nasdaq: NENG – News), a leading security
appliance vendor, today announced they will work together with Microsoft Corp.
to offer customers an innovative worldwide program designed to provide demand
generation, upgrade programs, and channel enablement for Websense? Web Security
Suite(TM) and Microsoft Internet Security & Acceleration (ISA) Server
software integrated with the Network Engines NS Series Security Appliances.
Available now, the NS Series (NS6400 and NS8400) is a family of multi-functional
security appliances designed to help customers meet stringent security
requirements and regulatory compliance mandates.The program focuses on several components for distribution and sales of the
security solutions, including:* Demand Generation: Marketing activities focused on new customer acquisition through educational promotions increasing the awareness of securing enterprises from web-based threats. * Upgrade Programs: Promotional programs identifying proxy replacement opportunities and upgrading legacy platforms within enterprises. * Channel Enablement: Recruiting, training and developing new channel partners and resellers with regard to the technology and value of the joint solution."Customers have asked us to provide a comprehensive solution to their growing
Web security needs," said David Feldman, senior product manager of the Security,
Access and Solutions Division at Microsoft Corp. "We’ve come together to offer
an innovative solution that builds on the combination of strengths from ISA
Server and the NS Series appliance integrated with Websense Web Security Suite,
which gives customers ease of use and the necessary components to better secure
their organization’s infrastructure.""It is important that our customers understand the powerful Web security
features that are offered when combining the NS Series Appliances, Microsoft ISA
Server and Websense," said Steve Kelley, director of strategic alliances for
Websense, Inc. "Websense continues to expand the Websense Web Security Suite to
protect our customers from a wide spectrum of internet threats and malicious
code. Our work with Microsoft and Network Engines to bring an innovative
solution to market illustrates our cooperation and desire to educate and provide
our customers with the industry’s most comprehensive web security technology.""By working with companies like Microsoft, Websense and Network Engines, we
have the resources to offer our customers highly effective, advanced technology
that provides a solid foundation for their internet security needs," said Larry
Dannemiller, president of Texas based Business Security Solutions. "This
integrated program creates higher visibility for the combined NS Series,
Websense, and Microsoft products and its effectiveness as a web security
solution, which is not only positive for us, but for our customers as well."Microsoft and Network Engines are founding members of the Websense Web
Security Ecosystem(TM) — a comprehensive ecosystem of world-class security and
networking technology providers to enable easy deployment and integration of
Websense solutions in enterprise environments. The Websense Web Security
Ecosystem incorporates vendors from leading security and networking markets,
including: network access control, internet gateways, certified appliance
platforms, security event management, and identity management. The Websense Web
Security Ecosystem provides interoperability of joint solutions to ensure
seamless integration in enterprise environments.Websense web security software helps protect organizations and employees from
an increasing number of internal and external online threats such as spyware,
Trojan horses, web-borne worms and crimeware. For more information on the
Network Engines integration please visit: http://www.websense.com/global/en/Partners/
or http://www.networkengines.com. For
customers who would like more information on the joint solution please contact
nssales@networkengines.com or sales@websense.com. Channel partners can
request information at partner@websense.com. Websense Security
Labs(TM) offers free email security updates as new internet threats are
discovered and is available at http://www.websensesecuritylabs.com.MEDIA CONTACT: Ronnie Manning Websense, Inc. 858 320 9274 rmanning@websense.com Joni Moore Network Engines, Inc. 508-308-7900 joni.moore@networkengines.com
-
Check out Tom Barlett’s ISA Firewall Blog
Visit Tom Bartlett’s?BLOG, Access Denied: The
Business of Security?at http://blogs.technet.com/accessdenied/?Tom is a Microsoft Employee and has tremendous
insight into how to deploy and secure an ISA firewall infrastructure. His blog
is a Must Read.??HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls?
-
Steve Moffat’s ISAServer.bm Blog Site Now Online
Steve Moffat is a
past master of the ISA firewall and now has a Web and blog site up to share his
wit and wisdom.?You can find Steve’s
new ISA firewall site at http://www.isastuff.mine.nu/??DISCUSS THIS
POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_02-5-2006/m_2002005670/tm.htm??HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls?
-
Download the NEW Cachedir Tool for ISA SP2
If you enjoy using
the ISA firewall’s Cachedir tool to manage the ISA firewall’s Web cache, then
you’ll need to update your tool for ISA firewall’s running 2004 SP2 or 2006.
?Use CacheDir.exe to view real-time cache contents,
save information about the current cache contents to a file, and mark obsolete
items that should not be served from the cache.?The CacheDir Tool accesses information about
the contents of the ISA Server 2004 cache. You can use this tool to view the
current (real-time) contents of the cache, to create a file that lists the
contents of the cache at a particular time, and to mark items as obsolete so
that they will not be served from the
cache.?Download the
Cachedir tool at: http://www.microsoft.com/downloads/details.aspx?FamilyId=88117626-D72C-4CC8-A15F-C1FBDBCFF688&displaylang=en?DISCUSS THIS
POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_02-5-2006/m_2002005670/tm.htm??HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls?
-
Heads up on ISA 2004 SP2 Http Filter
Heads up on an ISA
firewall SP2 HTTP Security Filter
issue:—–Original Message—–
From: Jim
Harrison [mailto:Jim@isatools.org]
Sent:
Monday, February 13, 2006 1:51 PM
To: [ISAserver.org Discussion
List]
Subject: [isalist] RE: ISA 2004 SP2 Http FilterOk –
if you or your customers / family / friends / pets? / household gadgets
have installed ISA Server 2004 SP2 and are experiencing this "502 http filter
blocked" response for sites that work without SP2, please call PSS and
provide:
– ISAInfo (http://isatools.org/isainfo/isainfo.zip)
– network captures at the ISA external interfaceWe’re
trying to assess the scope of the problem and we can’t do that without hard
data.——————————————————-
??
Jim Harrison
?? MCP(NT4, W2K), A+, Network+, PCG
??
http://isaserver.org/Jim_Harrison/
?? http://isatools.org
??
Read the help / books /
articles!
——————————————————-DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_02-5-2006/m_2002005670/tm.htmHTH,
Thomas W Shinder, M.D.
Site: http://www.isaserver.org
Blog:
http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP —
ISA Firewalls
-
ISA 2006 Forum Now Up on ISAserver.org Web Boards
We’ve put up an ISA
2006 forum up on the ISAserver.org Web boards over at http://forums.isaserver.org/forumid_8003/tt.htm?Come on over early
and often with your questions about ISA 2006 Standard and Enterprise
Editions!?Thanks!?DISCUSS THIS
POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_02-21-2006/m_2002007532/tm.htm?HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls?
-
Using a Commercial Web Site Certificate to Publish Outlook Web Access (OWA) Part 2 Now Available!
In part 1 of this series on how to use commercial Web site certificate to
publish your corporate OWA site, I went over the basics of SSL to SSL bridging
and how the ISA firewall brings a much higher level of security to your OWA
remote access solution compared to a conventional ?hardware? firewalls. After
making the security advantages of the ISA firewall abundantly clear, we then
went over the reasons why you would want to use a commercial Web site
certificate instead of a privately generated certificate. We finished up by
providing the roadmap for the overall commercial Web site certificate OWA
publishing solution presented in this series.In this part 2 of our four part series, we’ll go
over the following procedures: Create a Web site certificate request on the OWA
Server; Obtain the Web site certificate from the commercial certificate
authority; Install the Commercial Web Site Certificate and CA Certificates on
the OWA Site.?Check out the
details at: http://www.isaserver.org/tutorials/Using-Commercial-Web-Site-Certificate-Publish-Outlook-Web-Access-Part2.html?DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_02-21-2006/m_2002007532/tm.htm?HTH,TomThomas W Shinder,
M.D.
Site: http://www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP — ISA Firewalls?+Part+2+Now+Available!&referrer=)
-
Network Engines Joins Microsoft’s SecureIT Alliance
A?free
service?from USEast Network Services?????
Visit the USEast BLOG to find more news
about appliances, Microsoft, security and lots of other
subjects.
?Press Release Source: Network Engines, Inc. Network Engines Joins Microsoft’s SecureIT
Alliance
Tuesday February 14, 8:30 am ETCANTON, Mass.–(BUSINESS WIRE)–Feb. 14, 2006–Network Engines,
Inc. (NASDAQ: NENG – News), a leading appliance
partner for Microsoft security solutions, today announced it has joined
Microsoft’s SecureIT Alliance. Microsoft’s SecureIT Alliance has been
established to help ensure partners can efficiently integrate their solutions
with the Microsoft platform to deliver ongoing security solutions for customers.Network Engines NS Series family of integrated security appliances is powered
by Microsoft’s Internet Security and Acceleration (ISA) Server 2004. Network
Engines continues to integrate the NS Series with other leading security
solutions such as Websense Security Suite with a goal to provide end users with
highly integrated security appliance solutions, delivering maximum protection
while reducing the complexity of deployment and management tasks."We are pleased to have Network Engines in the SecureIT Alliance, as the
company has already proven its deep commitment to collaborating with Microsoft
and our ISV partners," said Bruce Burns, senior director, strategic relations
group at Microsoft."It’s exciting to see so many industry leaders working together to solve
common IT security problems, and so focused on meeting the needs of our shared
customers," said Mike Riley, vice president of marketing and corporate strategy
for Network Engines. "The SecureIT Alliance will bolster the levels of
integration and protection solutions available, with members benefiting from
improved knowledge of integrating on the Microsoft platform and server assets."About the Microsoft SecureIT Alliance
Technology is but one way that Microsoft is working to address the security
challenge. The company is also working collaboratively with security partners,
law enforcement and policymakers in the industry. The SecureIT Alliance is
comprised of a group of security partners that are working together to develop
security solutions for the Microsoft platform. The SecureIT Alliance expands the
security and Internet safety partnerships Microsoft has with other industry
leaders and governments, including the Virus Information Alliance and the Global
Infrastructure Alliance for Internet Safety. More information on the SecureIT
Alliance can be found at http://www.secureitalliance.org.Network Engines – THE Appliance Company
Network Engines appliances are designed to ease the deployment, enhance
manageability, and increase security of mission critical software applications.Our heritage of providing technology products and services tailored
supporting to the entire lifecycle of our customers appliances has made us the
appliance partner of choice for software market leaders.Founded in 1997, Network Engines is headquartered in Canton, Massachusetts
and trades on the NASDAQ exchange under the symbol NENG. For more information
about the Company’s products and services visit: http://www.networkengines.com.
-
BitDefender for MS ISA Servers
?free service?from USEast
Network Services?????
Visit the USEast BLOG to find more news
about appliances, Microsoft, security and lots of other
subjects.
BitDefender for MS ISA Servers
As content entering or
leaving your company must meet security policies, it is crucial to choose
the appropriate protection for each network level, especially for the
gateway level. The World Wide Web has become an entry point for malicious
content, through file transfers or simple browsing.BitDefender
for MS ISA Servers offers antivirus protection for web traffic, including
protection for data received through webmail. BitDefender for MS ISA
Servers integrates with the firewall and the web cache server, Microsoft
ISA Server, through two application (ISAPI) filters offering antivirus
protection for the HTTP, FTP and FTP through HTTP traffic.BitDefender for MS ISA Servers is compatible with BitDefender for
Mail Servers (WIN SMTP Proxy) which offers antivirus and antispam
protection for SMTP traffic.Certified Antivirus
Engines
BitDefender for MS ISA Servers ensures antivirus protection
by incorporating the BitDefender antivirus engines, certified by ICSA
Labs, Checkmark, CheckVir, Virus Bulletin and TUV.Integrated
with Microsoft ISA 2004 Server and Microsoft ISA 2000
Server
BitDefender for MS ISA Servers seamlessly integrates with
Microsoft ISA 2004 Server and with Microsoft ISA 2000 Server through two
application filters, an HTTP and an FTP filter.HTTP and FTP
Filters
The HTTP and FTP filters are application (ISAPI) filters
that scan all HTTP and FTP requests for viruses. Depending on the rules
set by the content filter and on the scanning results, requests are
forwarded to the ISA Web Proxy.Filter
Management
BitDefender for MS ISA Servers offers administrators
policy controls for virus protection and the ability to set specific
filtering rules for specific groups of IP addresses across multiple scan
types, improving the flexibility of the scanning and configuration
process.
-
posted August
