Discussion Locked
Dr. Tom's Microsoft Networking Blog
0 helpful
212 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
blog root
212 replies
by tshinder
Core ISA Firewall and Tech Sites
- ISAServer.org: The biggest and best ISA firewall site
- MS ISA Firewall site: The Official ISA Firewall Site
- ISATools.org: Jim Harrison's unparalled ISA firewall automation site
- Amy Babinchak's SBS ISA Firewall Site: Leading Site for ISA on SBS info
by tshinder
Home and Office Pix
Untitled Photo |
Untitled Photo |
Untitled Photo |
Untitled Photo |
|||
Untitled Photo |
Untitled Photo |
Untitled Photo |
Untitled Photo |
|||
Untitled Photo |
Untitled Photo |
by tshinder
by tshinder
This is the first ISA Firewall
Blog Test
Tom
www.isaserver.org/shinder
Tom and Deb Shinder's Configuring
ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Jim Harrison's
www.isatools.org site is a godsend to ISA
firewall admins who need scripts to bolster the ISA firewall console's
limitations. Jim's site has been the mainstay and the only site on the Internet
to provide useful ISA firewall scripts. That is until now. Check out
Jason Fossen's www.isascripts.org site for a collection of
scripts that allow you to do a number of management tasks that can't be done in
the ISA firewall console.
Here's a list from Jason's Web
site (www.isascripts.org):
Update a Domain Name Set
with domains obtained from a local file or from an HTTP URL, such as for the
blacklisted domains of spammers, advertisers, pornographers, hate groups,
etc.
Update a Computer Set
object with subnets obtained from a local file or from an HTTP URL, such as for
bogon routes, unallocated routes, known attackers, unwanted countries,
etc.
Copies the HTTP
application-layer filter settings from one rule to another in the firewall
policy.
Functions for viewing,
resetting and acknowledging triggered alerts.
Add/remove individual
files from Web Proxy cache.
List alert definitions and
their properties.
View and
edit permitted outbound HTTPS/SSL tunnel ports (see KB283284).
Variety of functions for
viewing, creating, deleting and modifying Domain Name Set
objects.
Variety of
functions for viewing, creating, deleting and modifying Subnet
objects.
Variety of
functions for viewing, creating, deleting and modifying URL Set
objects.
Variety of
functions for querying sessions, server name, cache drives, and other
stuff.
Spreadsheet of names,
descriptions and hex numbers of ISA Server 2004 error, cache and response
codes.
Security template for ISA
Server firewalls for use with SECEDIT.EXE or the Security Configuration &
Analysis snap-in. Disables unneeded services, so make sure to make a
backup of your box and test the template on a non-production server
first!
HTH,
Tom
www.isaserver.org/shinder
Tom and Deb Shinder's Configuring
ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Heads up on the article series
I've put together on the exceptional level of security the ISA firewall's VPN
remote access server and VPN gateway provides your network. This article series
focuses on the differences between the conventional hardware firewall/VPN server
and the ISA firewall's unique VPN security model.
Check out the series
at:
Part 1: http://isaserver.org/tutorials/ISA-Firewall-Configure-Granular-Access-Controls-VPN-Part1.html
Part 2: http://isaserver.org/tutorials/ISA-Firewall-Configure-Granular-Access-Controls-VPN-Part2.html
Be sure to post on the
ISAServer.org forums at http://forums.isaserver.org with your
comments and questions.
Thanks!
Tom
www.isaserver.org/shinder
Tom and Deb Shinder's Configuring
ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Connectivity Verifier Properties dialog box appears on the bottom of this page. These are useful for determining whether or not vital services for proper ISA firewall function are available. In this example, the ISA firewall is a member of the domain (which is an ISA firewall best practice) so its critical that the ISA firewall be able to connect to AD domain controllers. You can then configure the verifier to trigger an Alert, which can then subsequently send an email message to your cell phone, email account, or pager.
by tshinder
I've seen a good number of requests for blocking MSN file transfers without needing to whack all access to MSN Messenger. No problem!
You can use the HTTP Security Filter to kill off those nasty file transfers while allowing them to continue chatting their hearts away. All you need to do is configure the HTTP Security Filter with a signature to block the following Host Header:
/x-msnmsgrp2p
Just another reason why the ISA firewall rocks, and Bluecoat SuX0rs.
Tom
www.isaserver.org/shinder
Tom and Deb Shinder's Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Heard some great news today
about an upcoming book titled Microsoft Small Business Server 2003
Unleased (http://www.amazon.com/exec/obidos/ASIN/0672328054/)
What's the news? Its that Amy Babinchak has authored two ISA
2004 chapters in this book!
Amy is the leading authority on
ISA firewall implementation on SBS 2003 SP1 deployments and she's authored
serveral articles on ISA firewalls on SBS over at www.isaserver.org. Her contributions to this
book will make it a great read and I'm looking forward to getting my copy when
the book is released.
Amy also runs the world's
leading site on ISA in SBS. Check out out at: http://isainsbs.blogspot.com/
HTH,
Tom
www.isaserver.org/shinder
Tom and Deb Shinder's Configuring
ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
From: USEast News Service [mailto:USEastNewsService@USEast.Net]
Sent: Thursday, August 18, 2005 12:05 PM
To: USEast News Service
Subject: Network Engines' Issues Prescriptive Security Alert and Recommendation Re: Zotob, Seven New Threats Uncovered
| Press Release | Source: Network Engines |
Network Engines' Issues Prescriptive Security Alert and Recommendation Re: Zotob, Seven New Threats Uncovered
Thursday August 18, 12:25 pm ET
CANTON, Mass.--(BUSINESS WIRE)--Aug. 18, 2005--Network Engines, a leading OEM appliance partner for Microsoft security solutions, in partnership with its NICE technology partners, has identified two more versions of Zotob. We are now tracking seven (7) Zotob permutations that are exploiting the PnP vulnerability. The worms are all based on versatile attack programs, known as bot software, which have added the ability to spread via a flaw in Microsoft's Windows Plug-and-Play functionality. Several bot programs had incorporated the code to exploit the flaw late last week, and starting with the Zotob worm, began adding the ability to automatically find and infect systems by last weekend. As of yesterday morning, at least 12 versions of bot software were using the exploit to spread. It is also important to note that not all PnP exploits are characterized as Zotob, and some may escape AV detection all together. Several new bots, including two based on IRCBot, three on Botzori, two variants of Esbot, a version of Bobax, and a version of Spybot may escape AV detection.
- Zotob.A
- Executable size: 22,528 bytes
- Executable Name: botzor.exe
- Ports: TCP - 445,8080,33333
- Aliases: Zotob.A (F-Secure), W32/Zotob.worm (McAfee), W32/Zotob-A
(Sophos), WORM_ZOTOB.A (Trend)
Other details - Opens FTP server on port 33333, copies 2pac.txt and haha.exe to the system directory, adds itself to the run and run services in the registry. Modifies the hosts file to prevent updating of antivirus and security programs from updating.
- Zotob.B
- Executable size: 27,648 bytes
- Executable Name: csm.exe
- Ports: TCP - 445,8080,33333
- Aliases: Zotob.B (F-Secure) W32/Zotob.worm.b (McAfee) W32/Zotob-B
(Sophos) WORM_ZOTOB.B (Trend Micro)
Other details - Opens FTP server on port 33333, copies 2pac.txt and haha.exe to the system directory, adds itself to the run and run services in the registry. Modifies the hosts file to prevent updating of antivirus and security programs from updating.
- Zotob.C
- Executable size: 41,984 bytes
- Executable Name: per.exe
- Ports: TCP - 445,8080,33333
- Other details - Mass-mailing worm uses a predefined list of
recipient names appending the domain names that it gathers from an infected computer. Contains its own SMTP engine to email to the addresses that it finds. Opens FTP server on port 33333, adds itself to the run and run services in the registry. Modifies the hosts file to prevent updating of antivirus and security programs from updating.
- Zotob.D
- Executable size: 51,326 bytes
- Executable name: windrg32.exe
- Ports: TCP - 6667,1117,445
- Other details - Opens FTP server on port 11173, attempts to end a
variety of processes, Modifies the registry and deletes a variety of registry entries, and deletes a variety of files from the system and program files directories, adds itself to the run and run services in the registry. Modifies the hosts file to prevent updating of antivirus and security programs from updating.
- Zotob.E
- Executable size: 10,366 bytes
- Executable Name: wintbp.exe
- Ports: TCP - 8594,8080,445, UDP - 69
- Aliases: WORM_RBOT.CBQ (Trend Micro)
- Other details - Opens TFTP server on port UDP 69, Connects to IRC
server at 72.20.27.115 on TCP port 8080 to listen for update instructions, adds itself to the run in the registry.
- Zotob.F
- Executable size: 10,878 bytes
- Executable name: wintbpx.exe
- Ports: TCP - 445
- Other details - Opens multiple TCP ports. Connects to IRC server
at 72.20.41.139 to listen for update instructions, adds itself to the run in the registry, creates a file named %Temp%\(NUMBER) which if successful contains TFTP scripts to download additional files.
- Zotob.G
- Executable size: 73,728 bytes
- Executable name: windrg32.exe
- Ports: TCP - 445,6667,1171
- Aliases: W32.Drudebot.A
- Other details - Attempts to connect IRC servers on port 6667,
Opens a TFTP server on port 1171, attempts to end a variety of processes. Modifies the registry and deletes a variety of registry entries, and deletes a variety of files from the system and program files directories, adds itself to the run and run services in the registry, creates a file named %Temp%\(NUMBER) which if successful contains TFTP scripts to download additional files. Modifies the hosts file to prevent updating of antivirus and security programs from updating.
Zytob exploits MS05-039 by generate random IP addresses to which they try to connect through port 445, searching for vulnerable computers. When a computer is found, they will send instructions to download a copy of the worm by TFTP. Once installed on a system, the worm modifies a registry key to ensure its execution on every system startup, and initializes a backdoor component made available through IRC, and awaiting orders in a specified channel. The intent is to allow a remote attacker to take control of the system. It only spreads to systems having operating systems Windows 2000, XP and Windows Server 2003
RECOMMENDATION:
1. Disable TCP/IP Port 445 - Among the new ports introduced in Windows 2000, Windows XP and Windows Server 2003, is port 445. TCP Port 445 is often exposed to the Internet because the Microsoft-DS Service uses port 445 for resource sharing on Windows 2000, XP, 2003, and other samba based connections. It is difficult to describe the usage of Port 445 in simple terms. Essentially it is used by the Server Message Block (SMB) protocol for file sharing. It is also used for NetBIOS Services over TCPIP, described as NBT. When file sharing is required and NBT is enabled, a connection to the remote computer is tried simultaneously on both port 139 and 445. If there is a response from port 445, it continues its SMB session on port 445 only. If there is no response from port 445, it will continue its SMB session on port 139 if that responded. If there is no response from either of the ports, the session will fail.
Many viruses have targeted port 445 and it is not commonly used. For this reason we recommend you secure it by blocking inbound TCP port 445 scans at the NS Series security appliance. On a small percentage of networks disabling port 445 may block access to some network devices. If this occurs it is possible to Rollback or Unsecure this setting.
Block Inbound 445 Traffic - Inbound scans are typically systems which are trying to connect to file shares that might be available on your system and hence these should be blocked. While most of this traffic is the result of worms or viruses that can use open file shares to propagate, port 445 traffic can also be the result of malicious users attempt to connect to your computer. Once connected they can download, upload or even delete or edit files on the connected file share. If you use open file shares (including sharing of printers, etc) on your local network (LAN), then you should configure the NS Series security appliance such that your local file shares are not accessible from the Internet. Connecting to open file shares is likely the easiest and most common hack on the Internet and yet one of the most effective for malicious activities like identity theft or installing RATs (Remote Access Trojans) to take control of systems remotely for example.
Benefit When Secure: Disabling port 445 gives greater protection against virus attack.
Important: Disabling Port 445 may block access to other computers, printers or devices on a network.
2. Block TCP/445 egress whenever possible to detect infected systems leaving your network.
3. Ensure all systems have NULL session disabled to block the current threats - Null sessions are un-authenticated connections (not using a username or password.) to an NT or 2000 system. Windows NT and 2000 systems are vulnerable to syntax exploits that can expose hidden interprocess communications shares to the Internet. For example: C:\>net use \\192.168.###.###\IPC$ "" /u:"" The preceding syntax connects to the hidden interprocess communications "share' (IPC$) at IP address 192.168.###.### as the built-in anonymous user (/u:"") with a null ("") password. If successful, the intruder now has an open channel over which to attempt various techniques which allow him/her to gather as much information as possible from the target i.e. network information, shares, users, groups, registry keys, and so on. Null session connections, or anonymous logons, can be the single most devastating network foothold sought by intruders.
Null sessions require access to TCP 139 (and/or 445 on Win 2000). The most prudent way to eliminate them is to filter TCP and UDP ports 139 and 445 at all perimeter NS Series security appliances.
(Note: Some server roles require NULL functionality, including Exchange and SQL servers).
4. If Null Sessions are required - Organizations that require the use of NULL sessions should keep those servers properly patched or block port 139 at the NS Series security appliance.
5. Do not rely on TCP/33333 FTP service detection - Configuring intrusion detection systems to monitor for outbound TCP 3333 service establishment is effective for detecting compromised systems infected with Zytob variants A-C. However replying of port 3333 service detection will not identify all potential compromised systems as port 3333 is not used consistently in the latest bot variants. It is necessary to configure service detection policies for all phone home permutations (see worm profiles described above).
6. Ensure AV signatures are up-to-date - The most likely scenario is that the bot would use the Plug and Play vulnerability to compromise a remote user's laptop. Once inside the perimeter, that infected device will scan for unpatched systems, which the bot could then attack using other exploits. It is imperative that AV signatures are up-to-date to mitigate as much of this risk as possible.
7. Patch! - Zotob can be virulent, and while the bot variants make use of the Plug and Play vulnerability, it also includes code for exploiting other Windows' bugs, including 2004's LSASS vulnerability, the one that Sasser exploited. That means some of the new bots can infect not only Windows 2000 PCs, but other unpatched Windows machines. Therefore it is necessary to patch all systems to current levels in order to prevent future variants that exploit other MS vulnerabilities.
About Network Engines
Network Engines is a leading developer and manufacturer of security and storage appliances. The Company works with its software partners to develop storage and security networking appliances for mission critical applications. Network Engines is headquartered in Canton, Massachusetts and trades on the NASDAQ exchange under the symbol NENG. For more information about the company's products and services, visit www.networkengines.com.
Contact:
Network Engines, Inc.
Media contact:
Joni Moore, 508-308-7900
joni.moore@networkengines.com
or
Technical contact:
Kyle Quest, Kyle.Quest@networkengines.com
Lead Security Systems Architect
CISSP, GCIA (Certified Intrusion Analyst)
by tshinder
A ton of cool tools were released July 20th that you might want to know about. Here they are:
| CacheDir Tool for ISA Server 2004 View real-time cache contents, save cache content to a file, and mark obsolete items that should not be served from the cache. NOTE: Be careful with this one if you're running the ISA perfmon counters while running the this tools. I will make your counters zero out and give you the impression that your Web cache is empty. Just restart the firewall service and all will be normal again. Released July 20, 2005
|
| ISACertTool for ISAServer 2004 Enterprise Edition Deploy certificates required to authenticate communications between ISA Server array members and the Configuration Storage server in a number of ISA Server deployment scenarios. NOTE: This tool is helpful when trying to attempt the egregious process of deploying ISA 2004 EE in a workgroup scenario. My advice is to bag the workgroup scenario and join the ISA firewalls to the domain. You actually improve your overall level of security when the ISA firewalls are domain members. Released July 20, 2005
|
| MSDEToText Tool for ISA Server 2004 Display the contents of your Microsoft Data Engine (MSDE) Firewall and Web Proxy logs on-screen, or write log contents to a text file. TOM: We've been waiting for this since ISA 2004 SE released in May of 2004. Better late than never! Released July 20, 2005
|
| Remote Access Quarantine Tool for ISA Server 2004 Use this tool to prepare ISA Server installed on a computer running Windows Server 2003 as an RQS listener component for VPN quarantine control. TOM: Useful if you're not running Windows Server 2003 Service Pack 1 Released July 20, 2005
|
| RemoveAllNLBSettings Tool for ISA Server 2004 Enterprise Edition Save time removing Network Load Balancing (NLB) settings with this tool. TOM: Saving time is an understatement :-) Get this tool if you're running ISA 2004 EE firewall arrays and using NLB. Released July 20, 2005 |
HTH,
Tom
www.isaserver.org/shinder
Tom and Deb Shinder's Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Heads up
folks!
Jim Harrison's ISATools.org (www.isatools.org) site will be down for a few
days as Jim changes ISP.
I'll post when it comes back
online.
Thanks!
Tom
www.isaserver.org/shinder
Tom and Deb Shinder's Configuring
ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
One thing that will never cease to amaze me are the number of enterprise admins who think the ISA firewall is "Proxy X.X".
Why do they do this?
They've duped their hapless CIOs into spending hundreds of thousands of dollars on overhyped packet filtering devices with a FIREWALL sticker slapped on them and there's no way these guys are going to bring in an ISA firewall and deploy the lower cost ISA firewall solution because they'll have a lot of 'splaining to do when asked why they spent $15,000 for a box that does much less and is likely less secure than a $5,000 ISA firewall.
Since no one wants to be in that uncomfortable position, these enterprise admins bring in the ISA firewall and call it a Proxy Server. Yea, OK, sure, that's right. Its a Proxy Server, and we all know that Proxy Servers don't cost as much as firewalls. This ploy works and the guys who got their clocks cleaned by packet filter firewall vendors can save face, and their jobs.
So here is my advice to Microsoft on how they can make more money by providing less:
- Create a Web proxy only version of the ISA firewall. Market it as ISA Web Proxy Server Edition
- Create a Firewall and VPN Server/Gateway version. Market it as ISA Firewall Edition
- Create a Firewall, VPN Server and Web Proxy version (like today's version of ISA). Market it as ISA Enhanced Firewall Edition
Now here's how Microsoft can cash in. Since the enterprise guys seem to have more dollars than sense, charge four times as much for the Web Proxy Server Edition. This will work because a lot of information challanged companies are using simple Web proxy devices like Bluecoat and paying an insane premium for them. The ISA firewall's Web proxy filter capabilities are far and above superior to those provided by Bluecoat, so Microsoft would have no problem with upping the ante on the Web Proxy Server Edition, even though there is less product than the full version of ISA being offered.
The ISA Firewall Edition could go for about half the price its going for now, and the ISA Enhanced Fireall Edition would go for the current price.
The final breakdown, based on today's pricing would work out something like this:
ISA Web Proxy Server Edition = $5995.00
ISA Firewall Edition = $795.00
ISA Enhanced Firewall Edition = $1495.00
I think this will work. You're selling into a market that refers to outbound access as egress filtering -- so they're prime P.T. Barnum candidates:
"This way to the egress..........."
That's all for now!
Tom
www.isaserver.org/shinder
Tom and Deb Shinder's Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Do you get
irritated by seeing entries for Unidentified IP Traffic in your
log files and reports? Me too.
Its easy to reduce
the amount of traffic seen by the ISA firewall as unidentified. All you need to
do is create Protocol Definitions for the protocols that aren't included in the
default list of Protocol Definitions.
For example,
create a Protocol Definition for TCP Outbound 8080 and name it
Web Proxy Client. Now all the traffic from the Web Proxy client
to the Web Proxy filter on the ISA firewall will be seen as Web Proxy
Client traffic. Create another Protocol Definition for TCP
Outbound 1745 and name it Firewall Client Control. Now
all the Firewall Client Control Protocol traffic will appear as Firewall
Client Control.
Do the same thing
for other common protocols that you identify in the ISA firewall's log files.
Now you'll see a lot less Unidentified IP Traffic in your
logs.
HTH,
Tom
www.isaserver.org/shinder
Tom and Deb Shinder's Configuring
ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
| Author | Topic: Link to User Agent Strings | |
|
You can use these User Agent Strings in the ISA firewall's HTTP Security Filter.
HTH,
Tom
www.isaserver.org/shinder
Tom and Deb Shinder's Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
The ISA firewall's Web Publishing Wizards make it very easy to publish secure Web sites to the Internet. While the Wizards do most of the heavy lifting, one thing they don't do very well is setting up the Certificate Infrastructure and explaining the proper naming conventions for the certificates and how the certificate naming infrastructure relates to the settings on your Web Publishing Rules.
If you're trying to publish a secure Web site but getting hung up on the certificates, then check out this excellent article on the www.microsoft.com/isaserver site:
Troubleshooting SSL Certificates in ISA Server 2004 Publishing
http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/tscerts.mspx
Tom
www.isaserver.org/shinder
Tom and Deb Shinder's Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Quick note
to let you all know that Jim Harrison is up and running again and www.isatools.org is once again online.
The Management
greatly appreciates your patience :-)
Tom
www.isaserver.org
Tom and Deb Shinder's
Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
When you ask a
question regarding ISA client types, you need to understand that there are three
types of ISA clients:
SecureNAT
Client
Web Proxy
Client
Firewall
Client
The
SecureNAT client does not require client software installation
or configuration.
The Web
Proxy client requires that the Web browser be configured to use the ISA
firewall as its Web proxy device. You do not need to install any client
software
The
Firewall client is a Winsock Proxy client (similar to a SOCKS
client but infinitely better) that provides transparent
application proxy services to the ISA firewall's Firewall Service. The Firewall
client software must be installed and configured.
MORAL OF THE
STORY:
Do not
refer to "ISA Client Software". Be specific regarding the client type you're
using.
HTH,
Tom
www.isaserver.org
Tom and Deb Shinder's
Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Jim Harrison has
finally relented to numerous requests for a online photograph. While he wasn't
willing to share a current photo, he did send us a baby
picture:
http://www.msfirewall.org/images/jimmyjoebobalooba.jpg
Tom
www.isaserver.org
Tom and Deb Shinder's
Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
When a URL Set or Domain Name Set is configured, the client receives an HTTP 407 error for each domain that is restricted. As a result, the client browser is prompted for authentication. If the destination that is set is restricted to a domain that contains multiple links to other domains, an authentication dialog box appears for each unauthorized link. This is a real PITA. While the fix for this was a no-brainer in ISA Server 2000, for some reason we need to be scripting gurus to figure out how to do the same thing with the 2004 ISA firewall.
Well, I'm no scirpting guru and fortunately I don't have to be! Tristan Kington (affectionately known as Tristank) has a solution for us! Just check out the vb script below. All you need to do is replace the ISA firewall Network names in bold with the ISA firewall Network name for which you want to configure the ReturnDeniedIfAuthenticated setting for Web proxy clients. Just copy and paste the stuff between the double lines to a text file, name it something.vbs and run it from the command line as cscript something.vbs.
Check out Tristan's original description of the problem over at http://blogs.technet.com/tristank/archive/2004/11/01/250312.aspx
=================================
' Standard Disclaimer:
' This script is purely for example purposes
' and should not be used by anyone, ever.
' It's designed for use with CSCRIPT, not WSCRIPT. So don't just double-click it unless you
' really enjoy being bombarded with dialog boxen.
' TristanK
' We want to reset the internal network listener
TheOnlyOneOfInterest = "Internal"
' True = Enabled, False = Disabled (default)
setting = True
found = 0
set root = CreateObject("FPC.Root")
set firewall = root.GetContainingArray
set networks = firewall.NetworkConfiguration.Networks
for each network in networks
'Wscript.echo network.name
if TheOnlyOneOfInterest = network.name then
found = found + 1
Wscript.echo "Found network: " + network.name
network.WebListenerProperties.ReturnAuthRequiredIfAuthUserDenied = setting
' this is pure bumf- feel free to comment it out if you don't want to be prompted
' the Wscript.stdin.readline line requires the latest version of the VBScript/WSH components
Wscript.echo "Property Set - press Enter to Save the change."
' Wscript.stdin.readline
Wscript.echo "Please wait..."
' Commit the configuration change
network.WebListenerProperties.Save
end if
next
if found = 0 then
Wscript.echo "Target network was not found."
else
Wscript.echo "Done."
end if
=================================
Tom
www.isaserver.org
Tom and Deb Shinder's Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Some people have
asked me offline why I don't enable comments in my blog. The main reason is this
blog is meant to share info tidbits and interesting news and views on the ISA
firewall, not as a comprehensive meeting space and clearinghouse for ISA
firewall information. The best thing about using a blog is that I can post to it
using email, which is more efficient than the process I have to use to post News
items on the www.isaserver.org Web site.
This blog is also a lot more relaxed and informal than the material I put on the
ISAServer.org site, as I want to keep the www.isaserver.org Web site going as one of
the most professional tech Web sites on the Internet today
(IMHO).
That doesn't mean
I don't want to hear from you! If you have questions about anything covered in
my blog, start a discussion with a post on the ISAServer.org forums over at http://forums.isaserver.org and then
send me an email to tshinder@isaserver.org with the
link to the discussion. This allows me to answer your question and enable all
the other members of the ISAServer.org community to benefit from our
discussion.
Thanks!
Tom
www.isaserver.org
Tom and Deb Shinder's Configuring ISA Server
2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
ISA Firewall Sites
- ISAServer.org: The biggest and best ISA firewall site
- MS ISA Firewall site: The Official ISA Firewall Site
- ISATools.org: Jim Harrison's unparalled ISA firewall automation site
- Amy Babinchak's SBS ISA Firewall Site: Leading Site for ISA on SBS info
by tshinder
"I have an ISA
firewall in the DMZ"
What does this
mean?
Does the ISA
firewall have an external interface connected to the Internet and an internal
interface connected to the DMZ?
Does the ISA
firewall have an external interface connected to a DMZ and an internal interface
connected to the private corporate network?
Does the ISA
firewall have an external interface in an anonymous access DMZ and an internal
interface in an authenticated access DMZ?
Does the ISA
firewall have 9 NICs, with 5 of them in DMZs and 4 in private corporate
networks?
OR,
is it the most dreaded
possibility:
Does
the single-NIC (caponized) ISA firewall have its only, solitary interface
in a DMZ segment between two "firewalls" (invariably souped up routers with a
FIREWALL sticker on their bezels)
MORAL OF
THE STORY:
Tell us about the
relevent network topology. "In the DMZ" means as much as "open a port" (cf. http://www.tacteam.net/openport.htm)
HTH,
Tom
www.isaserver.org
Tom and Deb Shinder's Configuring ISA Server
2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Stefaan Pouseele, a redoubtable ISA firewall MVP comes back with a
trenchant comment regarding my post regarding the
ReturnDeniedIfAuthenticated issue:
=============================
Hi Tom,
In your blog (http://spaces.msn.com/members/drisa/Blog/) you wrote on
August 24 about solving the 'ReturnDeniedIfAuthenticated' problem in ISA
2004 Firewalls. I was a little bit astonished about your statement
"While the fix for this was a no-brainer in ISA Server 2000, for some
reason we need to be scripting gurus to figure out how to do the same
thing with the 2004 ISA firewall".
It's correct that in ISA Server 2000 the default behavior was that when
a destination set is configured, the client receives an HTTP 407 error
for each domain that is restricted. To get rid of this unwanted
authentication prompt, KB http://support.microsoft.com/?id=297324 gives
a solution by adding a registry value 'ReturnDeniedIfAuthenticated'.
From my experience the default ISA 2004 behavior is that the client
receives an HTTP 502 error for each domain that is restricted. To be
really sure I tested it again with a simple web page with one external
image. I can confirm we have with ISA 2004 the opposite of the old
default behavior of ISA 2000. Therefore, nothing should be scripted at
all!
I digged a little bit further into Tristank's blog
(http://blogs.technet.com/tristank/archive/2004/11/01/250312.aspx) and
the title says "ISA 2004 does 502s rather than 407s if you're already
authenticated". So, I think you have only to change the
'ReturnAuthRequiredIfAuthUserDenied' property to true if you want that
the client receives an HTTP 407 error for each domain that is restricted
and therefore reverting back to the default behavior of ISA 2000.
Hopefully this clearup some confusion your blog could create.
Kindly,
Stefaan
MVP ISA Server
http://www.isaserver.org/Stefaan_Pouseele/
by tshinder
Stefaan Pouseele found this great piece of info on the ISA MSDN site. Check it out!
============================
Hi Tom,
Found on
http://msdn.microsoft.com/library/en-us/isasdk/isa/isa_server_2000_registry_
values.asp?frame=true
?
HKLM\SYSTEM\CurrentControlSet\Services\W3proxy\Parameters\ReturnDeniedIfAuth
enticated
This ISA Server 2000 registry value has been replaced in ISA Server 2004 by
the ReturnAuthRequiredIfAuthUserDenied property of the
FPCWebListenerProperties object, which indicates whether a Proxy
Authentication Required message should be returned when a user is
authenticated by the ISA Server Web proxy but is denied access by the rules.
By default, an access denied message is returned, and the user is not given
the option of authenticating with different credentials.
In the forward proxy scenario, when this property is set to True, a user
that is authenticated by the Web proxy but fails to pass the rules (for
example, because they deny access to this user) receives HTTP error 407
(Proxy Authentication Required) and can try again using different
credentials. If this property is set to False (the default value), the user
receives HTTP error 502 (Bad Gateway) with a resource denied error page and
is not prompted again for credentials when the Web proxy denies access for a
request. In the reverse proxy scenario, the corresponding HTTP errors are
401 (Unauthorized: Logon Failed) and 403 (Forbidden: Execute Access
Forbidden).
Kindly,
Stefaan
by tshinder
SITUATION: I have published OWA using forms-based authentication and it works great.
WISH: Now that OWA is working so great, I want to use the ISA firewall to publish my RPC/HTTP Web site
PROBLEM: RPC/HTTP publishing doesen't seem to work when OWA forms-based authentication is enabled
SOLUTION: Create a second Web listener and use that for RPC/HTTP publishing. The second Web listener must be on another IP address. The second Web listener must NOT use the same IP address as the OWA Web Listener.
BETTER SOLUTION: Get FlexAuth from www.collectivesoftware.com and then you'll be able to publish both the OWA site using forms-based authentication and the RPC/HTTP site without requiring a second IP address.
HTH,
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
|
||
|
![[Cool]](http://forums.isaserver.org/ubb/cool.gif)
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
In this article I?ll begin my trek through
the installation and configuration of SBS 2003 SP1. The installation is a clean
installation. I will not discuss upgrade scenarios in this series. While I
realize that this isn?t the most common deployment scenario, it allows me to
discuss the salient points of the CEICW and subsequent ISA firewall installation
and configuration.
Check it out
at:
http://isaserver.org/articles/2004sbsinstallpart2.html
Discuss it
at:
http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=46;t=000045
HTH,
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Have problems with
the SQLSERVER.EXE process sucking up all your memory? MSDE
getting you down? Jim Harrison serves up a fix for this problem
for those of you using MSDE logging on your ISA firewalls:
=========================
Found it:
1 - open a cmd window
2 - type the
following:
osql -E -S
%computername%\msfw
sp_configure
'show advanced options',1 reconfigure with
override
go
sp_configure 'max server
memory', nnnn reconfigure with override
(where nnnn is in
mb)
go
exit
3 - restart MSDE - note
that you'll also have to restart the ISA
Firewall service
manually.
..I'd recommend giving MSDE at least 1/3 physical RAM,
depending on how
much your system actually has.
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog:
http://spaces.msn.com/members/drisa/
Book:
http://tinyurl.com/3xqb7
MVP -- ISA
Firewalls
by tshinder
Of all the issues in ISA firewall networking, the
one that most commonly gets people hot under the collar is that of the split
DNS. I?ve never been able to figure out why barriers go up for a lot of folks
when you begin to talk about a split DNS.
Maybe it?s because they believe they need to
rename their internal network domains, or that they think there is an adverse
security impact, or maybe its just because DNS is so difficult to understand in
the first place, that the idea of further complicating the issue puts them over
the edge.
This is especially
true for SBS users. As I've mentioned in multiple articles, you
do not need to deploy a well designed split DNS to support your
SBS deployments. A well-designed split DNS deployment will only make
your deployment better. However, if you don't understand how DNS works, and
how split DNS infrastructures work, then you will do yourself a significant
disservice by attempting to deploy one. However, if you take the time to
understand how it works, test it in your lab, and then take the knowledge gained
from your study and testing, you'll wonder why you never used a split DNS
infrastructure.
There is a a lot
of concern that you need to change your AD domain name to support a well-design
split DNS infrastructure. Sure, you can simplify things by planning in advance
and using the same domain name for internal and external resources, but its
definitely NOT required. You can use .local, .idontunderstand,
.mssbsdnsguidanceiswhack, or whatever top-level domain you like for your AD
domain name. Remember, the key to a split DNS infrastructure is using different
DNS zones for external and internal clients. That's all.
Remember:
A split DNS infrastrucutre has NOTHING to do with your AD
domain
For a detailed
account of how things work, check out Supporting ISA Firewall Networks
Protecting Illegal Top-level Domains: You Need a Split DNS! at http://isaserver.org/tutorials/2004illegaltldsplitdns.html
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=45;t=000002
| teambawm Junior Member Member # 14641 |
 posted August31, 2005 05:53 AM   
Right after they became After much haggling with the client over implementing a Within a month, some pros from the outside did a great job After that Even Randy Bridges |
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
ISAserver.org Newsletter of August 2005
From: ISAserver.org [mailto:info@isaserver.org]
Sent: Wednesday, August 31, 2005 6:14 AM
To:
tshinder@hotmail.com
Subject: ISAserver.org - August 2005
Newsletter
|
by tshinder
From the Horse's mouth (Jim Harrison):
"Always perform a backup of your current configuration. Failure to do
so illustrates anything from blind faith to outright hubris. Luckily,
ISA 2004 makes this really simple. Once you've finished the policy
backup, you can simply install the RTM version over the existing trial.
Odds are, you won't even need the backup."
'nuf said.
HTH,
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Not too long ago I
wrote a two part series on the ISA firewall's incredible, one of a kind, VPN
server and gateway. If you didn't see it, check it out at:
http://isaserver.org/tutorials/ISA-Firewall-Configure-Granular-Access-Controls-VPN-Part1.html
and
http://isaserver.org/tutorials/Publishing-OWA-Site-Back-to-Back-ISA-Firewall-Part1.html
What I was trying
to communicate in that article series is that the ISA firewall's VPN server and
gateway enables you to perform fine-tuned user/group based access control over
VPN client access to resources on the corporate network and on the
Internet.
So, it came as
some surprize to me when someone what asking:
"This
looks pretty good, but don't I need the Firewall Client in order to authenticate
and get that strong user/group based access control and
logging?"
I guess I used too
many words and the message I was trying to communicate got lost in the flurry of
words I used to demonstrate the unique level of security the ISA firewall's VPN
server provides. Because if I were more effective at communicating what I was
trying to say, it would be clear that you do NOT need to use the
Firewall client to perform strong user/group based access controls on VPN
clients.
The reason for
this is that the VPN connection is always authenticated before it is
established. The ISA firewall then uses the user credentails from the log on.
This allows the ISA firewall to apply per user policies on VPN client
connections in the same way that the Firewall client enables you strong
user/group based access controls on outbound connections through the ISA
firewall. The clients on the internal networks use the Firewall client to
authenticate with the ISA firewall, and the VPN clients authenticate with the
ISA firewall during VPN connection establishment.
I hope this clears
up any misunderstandings and provides more ammo in your attempts to make your
ISA firewall the preferred VPN server and gateway platform on your corporate
network.
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
I seen a few posts
over the years from people having problems with installing the Firewall client.
I've never experienced one of these Firewall client installation problems, so I
never had much to contribute in terms of a solution. In fact, I didn't even know
where to start troubleshooting the problem.
Jim Harrison comes
to the plate again with a hot tip that will at least get us out of the starting
gate! Here's what he has to say about Firewall client
logging:
"Since the
FWC installs via an MSI, you can get some really detailed logging from the
install process. Re-run your installation as:
Msiexec /l*v:c:\fwc_i.log
/i:fullpathtofwc.msi
You'll get
a bit more detail that may help you sort out this
error."
As always, thanks
Jim!
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=30;t=001103#000001
| Number51 Junior Member Member # 30363 |
 posted August31, 2005 08:55 AM 
We have ISA 2004 Got the VPN But my two issues Something did catch my eye in this So i installed and setup Now my VPN is snappy, and I can access Very happy! |
You can find the
VPN Deployment Kit for the 2004 ISA firewall at:
http://www.microsoft.com/isaserver/techinfo/guidance/2004/configuration.mspx
You should also
check out the Deployment Kit for the 2000 ISA firewall. It contains a ton of
information you won't find anywhere else on the Web and is the most
comprehensive coverage of ISA VPN configuration on the Web:
http://isaserver.org/articles/isa2000vpndeploymentkit.html
HTH,
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Hey
folks,
Just a quick note
on what I think is the best way to help the New Orleans Hurricane victims. From
my long expereince with charitable organizations, I can say that one stands head
and shoulders above all others, and that's the Salvation Army.
The men and women
in the Salvation Army are heads-down, in the ditches, get their
hands dirty, warriors against the forces of disaster and human misery. They
don't waste money on the cocktail party circuit and the money you give them
won't go to swank cocktail parties, first class airline fair, or three martini
lunches. Your money will feed, clothe, and comfort people who
really need it now.
Check out: http://www.salvationarmyusa.org/USNSAHome.htm
For ways you can
give.
Thanks!
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
I knew out of the
starting gate that using ADAM for configuration storage was going to introduce
quite a bit of pain, because firewall admins tend not to be Directory Services
admins. The following account from Andre, what sought to change the account used
for CSS provides a glimpse into the issue:
| adenhaan Junior Member Member # 31587 |
posted September 04, 2005 02:40 PM
Initially I had The ISA 2004
I have my Step From ADAM helpfile: |
quote:
To enable a
workstation or domain user account as a service account,
you must
grant the Log on as a service right to the account that is used as the
ADAM service account.
So create
a domain account (example: Domain\ISAService) in AD, and assign it the
rights to run as a service on domain controllers -
where my
configuration storage server(s) are - using Default Domain Controller
Security Policy snapin :
Add user Domain\ISAService to "Logon as a
Service"
Using computer management, Services plugin, change the
logon account for ISASTGCTL to ISAService, and restart the service...
You will get the following messages in eventlog:
code:
Event Type: WarningEvent Source: ADAM [ISASTGCTRL] GeneralEvent Category: Service Control Event ID: 2538User: N/AComputer: DOMAINCONTROLLER1Description:The directory server has detected that the service account used to run this servicehas been changed. This directory server may experience problems starting up. Additional Data Old service account:DOMAINNAME\Administrator New service account:DOMAINNAME\ISAService User Action If service is experiencing problems starting up, verify that the new service account has full control over the database folder(s), full control over the service registry key, and that the VSSAccessControl registry key is updated appropriately.
Now this
is actually a usefull message, as it is pointing to fix the following
Step2 add ISAService account to VSSAccessControl
In
registry editor go to the following
key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl
Add
a REG_DWORD, with the name of the account (Domain\ISAService), and a
value(data) of 1
Step 3: Give ISAService account rights on
Registry
key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ADAM_ISASTGCTRL
Using
regedit, rightclick this Key, and select permissions. Add
DOMAIN\ISAService account with full permissions.
code:
Event Type: WarningEvent Source: ADAM [ISASTGCTRL] GeneralEvent Category: Security Event ID: 2521User: N/AComputer: DOMAINCONTROLLER1Description:Active Directory was unable to initialize auditing security system. It will run with auditing disabled. No security audits will be generated. Additional Data: Error value: 1314 A required privilege is not held by the client.
Step
4: Assign "Generate security audits" privilege to ISAService
account.
To fix the warning message 2521, with a little help from
ADAM helpfile:
To enable auditing for an ADAM instance running
under a service account other than the Network Service account,
you
must grant the Generate security audits right to the account that is used
as the ADAM service account.
Use "Default Domain Controller
Security Policy" snapin : Add user Domain\ISAService to "Generate security
audits" item.
code:
Event Type: ErrorEvent Source: ADAM [ISASTGCTRL] GeneralEvent Category: Internal Processing Event ID: 1003User: N/AComputer: DOMAINCONTROLLER1Description:Active Directory could not be initialized. The directory service cannot recover from this error. User Action Restore the local directory service from backup media. Additional Data Error value:-1032 JET_errFileAccessDenied, Cannot access file, the file is locked or in use
Step
5: Account needs full rights to ADAMData directory
Make sure
that this new account has full rights on the Directory where ADAM files
are stored
(Example: C:\Program Files\Microsoft ISA Server\ADAMdata)
Note : This directory does NOT inherit permissions from higher
levels, so assigning rights
to the complete drive or program files
directory will not work.
Now If you start the ISASTGCTRL service
again, using the ISAService account, the following shows up in
eventlog:
code:
Event Type: ErrorEvent Source: ADAM [ISASTGCTRL] GeneralEvent Category: Internal Processing Event ID: 2536User: NT AUTHORITY\ANONYMOUS LOGONComputer: DOMAINCONTROLLER1Description:The directory server has failed to update the ADAM serviceConnectionPoint objectin the Active Directory. This operation will be retried. Additional Data SCP object DN:CN={401d891c-d654-454b-9f93-d744cb082bb6},CN=DOMAINCONTROLLER1,OU=Domain Controllers,DC=domainname,DC=com Error value:5 Access is denied. Server error:00002098: SecErr: DSID-03150A45, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0 Internal ID:339038f ADAM service account:DOMAINNAME\ISAService User Action If ADAM is running under a local service account, it will be unable to update the data in the Active Directory. Consider changing the ADAM service account to either NetworkService or a domain account. If ADAM is running under a domain user account, make sure this account has sufficient rightsto update the serviceConnectionPoint object. ServiceConnectionPoint object publication can be disabled for this instance by setting msDS-DisableForInstances attribute on the SCP publication configuration object.
Step
6:
To fix this, go into ADSI Edit and you will find a CN={GUID}
under your domain controllers.
Right click it to go into properties,
and on the security tab assign the ISAService account full rights to this
object .
Unfortunately we're not there yet....
The array
members now have difficulty connecting to the configuration server as you
will see in Monitoring Alerts,
and the following error in eventlog on
the array members:
code:
Event Type: WarningEvent Source: Microsoft ISA Server ControlEvent Category: NoneEvent ID: 21238User: N/AComputer: ARRAYMEMBER1Description:ISA Server cannot connect to the Configuration Storage server domaincontroller1.domainname.comfor one of the following reasons:- The Configuration Storage server is not available.- General networking or authentication issues.- A policy misconfiguration on the array.For information on resolving these issues, see "Troubleshooting installation and connectivity" in the ISA Server help or http://go.microsoft.com/fwlink/?LinkId=37487.--------------------------Event Type: ErrorEvent Source: KerberosEvent Category: NoneEvent ID: 4User: N/AComputer: ARRAYMEMBER1Description:The kerberos client received a KRB_AP_ERR_MODIFIED error from the serverhost/DOMAINCONTROLLER1.DOMAIN.COM. The target name used was ldap/DOMAINCONTROLLER1.DOMAIN.COM:2171. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in thetarget realm (DOMAIN.COM), and the client realm.Please contact your system administrator.
Step
7:
At this time I was pulling my hair out... trying to reboot
the servers, with no resolution.
It turned out that in the process, a
batchfile was created on the domaincontroller, as described in the chapter
"Administring Service Principal Names" in the ADAM
helpfile:
quote:
To register SPNs for
ADAM manually in Active Directory, use the dnsdomainname.bat script
file
that ADAM setup creates in the data directory of the ADAM
instance (Program Files\Microsoft ADAM\instancename\data),
where
dnsdomainname represents the name of the DNS domain in which the ADAM
instance resides.
Running
this batchfile did the trick, Members can connect to storage server and
all that was left is to execute steps 2,3,5, 7
on the other
Domaincontroller(s) that contain a replica configuration storage
server.
Phew... was a rocky ride, hope this info will help-out the
next person that wants to do this.
G'luck, Andre.
[
September 04, 2005, 03:26 PM: Message edited by: adenhaan ]
Posts: 4 |
Registered: Jul 2005 | IP: Logged
MORAL OF THE
STORY:
Nothing is easy,
and nothing is fast, esp. when it comes to dealing with ISE EE and
ADAM.
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
The Red Cross needs volunteers with system
administration, network engineering and information security (infosec) expertise
to assist in the design and implementation of a network of Internet kiosks.
These kiosks will be deployed to all of the Red Cross shelters to be used be
people displaced by the hurricane and flooding to report that they are alive and
to try to contact others.
Check out http://isc.sans.org/diary.php?date=2005-09-04 for
more info.
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Hey folks, here's
some GREAT News! One of the pieces they left out of the ISA SE and EE software
is the ability to easily import hundreds or thousands of site addresses
for blacklisting. Sure, you can cipher out a script and hope you get it right
and that it doesn't hork your configuration (I've always wondered by MS gets hot
under the collar regarding Registry Edits, but ignores the mortal dangers of
using scripts?).
Many thanks to
Maciej Rusinek for his hard work on this project. Check it out
Blacklists 2004 application at:
http://blacklists.w.interia.pl/index_b2004.htm
HTH,
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Jim Harrison ups the ante on the common ISA firewall malspeak "ISA client":
<peeve type="pet">
"ISA clients" is a misnomer - this is more accurately referred to as "ISA client request type", since any given ISA client can act as any
combination of the three, depending on how the client host is configured.
</peeve>
Say no more...
HTH,
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Unless you?ve been living under a rock for the last
two years, you know that if you have an Exchange Server, you?d be nuts
not to use an ISA firewall to protect it from Internet intruders. While there?s
a ton of great ISA firewall for Exchange docs out on both www.isaserver.org and www.microsoft.com/isaserver, Steven
Hope steps up to the plate with an exceptional effort. Steven has included a
wealth of information in this document, much of which was undocumented. He also
includes a great overview of the SMTP protocol verbs, with guidance on how and
when to use them with the ISA firewall?s SMTP application layer
inspection filter.
Check out Steve?s doc Application Layer Firewall protection for Exchange Server 2003 with ISA
Server 2004 at http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/firewall-exchange2003.mspx
HTH,
Tom
by tshinder
I see a few posts every week on problems with site to site VPN connections timing out when there is a short disruption in Internet connectivity or link disruption between the local and remote VPN termination points. One way you might be able to fix this is to change the default TCP and non-TCP timeout interval, which is 60 seconds by default.
Some people have had success with fixing the problem by increasing this timeout interval to something longer. You can do this by going to the following Registry Key:
HKeyLocalMachine\SYSTEM\CurrentControlSet\Services\Fweng\Parameters
Then add a new Reg_Dword Value: ConnectionTimeout
Add the number of seconds.
Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000002
HTH,
Tom
by tshinder
I often see questions from people who have problems with posting Word and other Office docs to their SPS sites after publishing them using an ISA firewall Web Publishing Rule. I?ve been meaning to test this from a location for quite a while, but never got around to it, and I use my SPS server for maintaining lists and accessing the library. Well, I finally got around to testing it during this week during my latest trip to the mother ship. I created a new Word 2003 doc and then tried to save it to my personal workspace. It worked with no problems at all. In fact, the experience was the same as it is when I?m on the Internal network.
So, we know it works and it works nicely. What I don?t know is why it isn?t working for these other folks, since I?ve never received the details of their configuration. However, if you want to make it work like mine, and have it work every time, just follow these simple ISA firewall best practices:
1. Use the same domain name for internal and external access
2. Create your split DNS infrastructure to support using the same domain name for internal and external access
3. Use symmetric bridging (SSL to SSL or HTTP to HTTP) ? props to Jim Harrison for sharing this elegant term with me.
If you follow those three ISA firewall best practices, your SPS deploying will work right the first time every time.
Discuss this post at:
http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000002
HTH,
Tom
+the+RIGHT+Way&referrer=){kind=small}
by tshinder
I've said it over and again, but its still worth repeating: you need an ISA firewall to provide secure remote access to your Exchange Servers. As Mr. T so eloquently stated "I pity the fool who doesn't use an ISA firewall to protect his Exchange Server organization".
A new playing in the ISA firewall protection for Exchange scene is Antigen. Microsoft recently aquired Antigen and the Antigen team is as sharp as tacks! Check out this week's Webcast on Secure Your Exchange Server with Antigen and ISA firewalls. You can register for the Webcast at:
http://msevents.microsoft.com/cui/WebCastEventDetails.aspx?EventID=1032280058&EventCategory=4&culture=en-US&CountryCode=US
HTH,
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Microsoft has updated their walkthough on publishing Outlook Web Access (OWA) sites using ISA firewalls.
This update includes key information on configuring the HTTP Security Filter for Outlook Mobile Access and Exchange ActiveSync. This is a nice walkthough (even though they forgot to add screen shots, I guess I'll need to rip this article and include a screenshot version on www.isaserver.org) and it provides even more evidence that "he who is with an Exchange Server, but without an ISA firewall, is lost".
Check out the Outlook Web Access Walk-though for ISA 2004 at:
http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/owa-walkthrough.mspx
HTH,
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Did you know that NLB is limited to 16 interfaces?
This means that ISA firewalls (Enterprise Edition) are limited to 16 physically attached networks that can be load balanced.
HTH,
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
OK, now that I have your attention, I want you to reflect on these observations. Indeed, at one time many thought the world was flat and long treatises were written on this fact. Not as many believed the Moon was made of green cheese. However, just about all of us believed there was a Santa Claus.
What does all this have to do with ISA firewalls? It has to do with the fourth fairy tale:
FAIRY TALE: "ISA firewalls on the edge should not be domain members"
Yes, you got it, and you got it right. Reports of workgroup based ISA firewall as being more secure are premature and incorrect.
ISA firewalls can and often should be domain members. In spite of the fact that many pointy haired highschool graduates with clipboards acting as compliance managers tell you that ISA firewalls should not be domain members, the fact is that they're living in a flat world, eating green Moon cheese and waiting for Santa Claus to give them a sleek new Stingray bike.
Those of us living in the world of facts and figures understand that domain member ISA firewalls end up being more secure, more manageable, and more flexible than the dreaded workgroup configuration ISA firewall.
Don't fall into the echo chamber of the canaille. Those guys who phantasmgorically believe that workgroup ISA firewalls represent the most secure configuration are still working on the classic animal husbandry problem of "which end eats".
Don't be like them -- be like us. We know which end eats.
HTH,
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
I've always been interested in the "echo chamber" effect when it comes to technical and scientific issues. You know how it goes. Someone does a study that gets reported in some obscure journal, then that guy's buddy writes a textbook that quotes the article as a source, then other textbooks get written that quote what this textbook said, accepting on faith that the original source was valid. Finally, some enterprising undergraduate student years later checks the original journal article and finds that its full of holes and the entire chain of reasoning based on the flawed article and developed over the decades in textbooks falls apart.
I thought of this today when I read this quote in a article regarding the placement of front-end Exchange Servers in perimeter networks. The original article can be found at: http://www.msexchange.org/tutorials/Dual-Pass-Through-Authentication-Exchange-2003-Front-EndBack-End.html
The relevant quote is:
Note:
It?s not recommended to place your FE Servers on a perimeter network; you should instead place any it on the internal network, and if possible publish the required Exchange services trough an ISA Server located on the perimeter network. In the past, it was popular to place the FE server on the perimeter network, and then open all required ports in the intranet firewall. Since the FE server needed to be able to communicate with both the Exchange BE servers as well as Global Catalog servers on the internal network, quite a few ports needed to be allowed through. I know an alternative is to configure IPSec, but this solution is a bit complex. Even though you may not have an ISA Server in your organization, you still should place the FE server on the internal network, and then open the required ports on the intranet firewall.
What's up with this? Just because the handful of ports required for intradomain communcations is open does not vitiate the validity of creating a authenticated access DMZ where the front-end Exchange Server should be published. Last time I looked, there are over 65,000 ports available, and to make a blanket statement that you shouldn't leverage the ISA firewall's superior security architecture to enhance security is misguided at best, and incompetent at worst.
Since I know the author is not incompetent, I suspect he is a victim of the Exchange product group's (and maybe the ISA PG's?) echo chamber. There are docs on the ms.com site foisting this illogic on busy, harried and sometimes hapless Exchange admins. This is a heads-up. Don't let the echo chamber effect wrest your logic from you!
I've completed to comprehensive series of documents on the value of putting the front-end Exchange Server in a authenticated DMZ segment and have included detailed, step by steps with screenshots on how to create the configuration. Stay tuned to www.isaserver.org for these article series.
Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000004
HTH,
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
In a former life I
had to do things like count the number of white blood cells (WBCs) in a
patient's urine as part of workup for UTI (urinary tract infection). There were
often times when there were so many WBCs in the patients urine that I gave up
counting the number of cells and put in my notes "TNC". TNC means "too numerous
to count".
There are a lot of
reasons to dislike Cisco. In fact, the the reasons are TNC. But if I had to pick
one, its their recent unrequited attempt to squash Michael Lynn's presentation
on a major security exploit (just one of the many, many security issues with
Cisco products, which never seem to get the grand attention that MS security
issues get).
Take a gander at
this video showing Cisco employees in their true form:
http://downloads.oreilly.com/make/cisco.mov
Many thanks to
Sunbelt Software's W2knews (www.w2knews.com) for the heads up on this
video
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
test
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
From the Blog of Steve Lamb at:
http://blogs.technet.com/steve_lamb/archive/2005/10/03/411873.aspx
=====================================
"The wait has been long as those of you who are familiar with the time
it
takes to achieve EAL4 approval will understand.
Common Criteria is an assessment/approval programme for the security
capability of software products as agreed by many governments around the
world (at least fifteen countries including the USA, UK, and Germany).
The levels range from 1 (least comprehensive) to 7 (most comprehensive).
EAL 4 is the highest mutually recognised level - above this each
government customer takes their own approach. I gather that most EAL 6
and 7 systems are in orbit - that somewhat reduces their attack surface!
The assessment was carried out by an independent testing laboratory
known as a CLEF - there's debate as to the meaning of the "L" in the
acronym (according to the two UK CLEF Managers!) the rest stands for
Commercial Evaluation Facility.
Few Firewalls have EAL4 certificates and those that do often require
specific hardware appliances to comply. Many Government customers
(defence being a good example) often mandate EAL4 compliance for any
network edge security software. Be aware that whilst EAL4 is a good
indicate of the quality of the software the CONFIGURATION/IMPLEMENTATION
BY YOU/YOUR SUPPLIER must match the requirements of your security policy
to have benefit.
ISA Standard Edition has EAL4+ which means that it was evaluated for at
least one higher level assurance requirement - in this case we added
"Flaw remediation" to the assessment criteria as welll as deeper
independent vulnerability assessment (AVA_VLA 3 instead of the required
AVA_VLA 2).
A complete list of Common Criteria evaluated products can be found by
clicking here
<http://www.commoncriteriaportal.org/public/consumer/index.php?menu=4>
The certification will be mentioned on Germany's BSI site following
their next update. It will be listed here
<http://www.bsi.bund.de/zertifiz/zert/aktuelle.htm>.
One last point - when assessing the value of a product's Common Criteria
certification inquire about the "target of evaluation" - this is a
definition of the functions and features to be assessed - some products
only go for assessment of a small subset of features."
================================
This should come as no surprize to ISA firewall admins. We know that the
ISA firewall provide a superior level of protection, not only for
Microsoft services, but for all services on the corporate network. And
while I doubt the used the ISA firewall in its most secure configuration
for testing, its great to get this imprimatur of security from a third
party organization. Follow my best security practices listed throughout
www.isaserver.org and you'll easily surpass the security in the tested
configuration.
HTH,
Tom
by tshinder
A couple of nice
tips from Jim Harrison come down the pike today:
============================
It may have gone overlooked in the
general melee of postings, but I had posted these before and thought them worth
reiterating?
Tired of the ISA sending
NetBT broadcasts when DNS lookups fail?
This setting:
HKLM\SystemCurrentControlSet\Services\NetBT\Parameters
NodeType, DWORD, 0x2
..will cure that.
By setting this to a value of 2,
You?re telling Windows to limit its name lookup efforts to defined DNS and WINS
servers.
As a result, Windows will no longer
wait for NetBT broadcasts to fail before reporting a name lookup
failure.
Can you say ?faster lookup responses
and therefore faster connections (or failures)?, boys and
girls?
(TOM's NOTE: The above setting configures the
ISA Firewall's NetBIOS Node Type. The suggested Node type is Peer Node or "P
node". Peer Node NetBIOS nodes use name resolution servers only and do not
failover to NetBIOS broadcasts for name resolution.)
- MS05-019 fixed an ICMP MTU
vulnerability that existed in Windows.
Because the ISA team was aware of
this issue before ISA 2004 shipped, they opted to give you a ?safe by default?
configuration since they had no idea if or when the Windows issue might be
fixed.
Unfortunately, it also has the
unfortunate side effect of limiting Windows to 576-byte packets on all
interfaces, reducing network efficiency
This setting:
HKLM\SystemCurrentControlSet\Services\Tcpip\Parameters
EnablePMTUDiscovery, DWORD, 0x0
..is what the ISA installer
creates.
This setting:
HKLM\SystemCurrentControlSet\Services\Tcpip\Parameters
EnablePMTUDiscovery, DWORD, 0x1
..is what will remove this
protection (or you can delete the ?EnablePMTUDiscovery? value).
(TOM'S NOTE: Small MTU values can cause
performance issues. If you find that you're not getting the bandwidth you
expect, then try increasing the MTU value).
Both settings require a machine
reboot to take effect.
Both settings will clean up your
network traffic a bit.
============================
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Here's the link for the real deal. Nice tool for checking your ISA CD integrity too!
http://www.microsoft.com/isaserver/techinfo/deployment/commoncrit.mspx
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Wisdom from Jim
Harrison regarding SecureNAT sessions in the ISA Firewall
Console:
A
SecureNAT session is not necessarily the same as SecureNAT clients. Application filter actions will create "SecureNAT" mappings because
ISA is actually making the connections to
the upstream server.
The correct math is:
SecureNAT client sessions == (Firewall sessions +
Web Proxy sessions) -SecureNAT
Mappings
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
It came up today on
the ISAserver.org mailing list that its possible to have cached content and it
not appear in Cachedir.exe.
Why?
Jim Harrison reminds
us that the Cachedir.exe utility only reads what's in the disk cache, and that
you need to restart the firewall service on the ISA firewall to get it flushed.
Of course, there's stuff in the in memory cache that might time out before you
get a chance to flush.
If you want to find
out what's actually cached and need to troubleshoot a specific site, then the
take home message is that NetMon is ALWAYS your best friend.
HTH,
Tom
--
Internal Virus Database is out-of-date.
Checked by AVG Anti-Virus.
Version: 7.0.344 / Virus Database: 267.11.0/103 - Release Date: 9/15/2005
&referrer=){kind=small}
by tshinder
My preferred
method of managing the ISA firewall is from a remote RDP console session. The
problem is that something in the terminal services component whacks out and says
I need a license server for remote desktop admin connections to the ISA
firewall. I don't think so. However, exhautive searches on this issue fail to
comes up with an answer on why this happens.
You can get around
this problem by using a console session rather than a typical remote desktop
client connection. For example, at the Run command
enter:
mstsc
/w:1024 /h:768 /console /v:amysbox:1234
The
/w: sets the width, the /h: sets the height,
and the /v: sets the IP address or name, with an alternate port
if you're using an alternate port for the RDP listener on the ISA
firewall.
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
I see more than my share of complaints over users being disconnected from published RDP servers after X period of time. The ISA firewall, being the "sin eater" (http://96.1911encyclopedia.org/S/SI/SIN_EATER.htm) of the network world, isn't the problem. In fact, from my own experience, 99% of the time a network issue is attributed to an ISA problem, its actually a problem with a horked client application or another network problem not related to ISA.
You can fix these disconnections to the RDP server by creating a Registry entry to support TCP keep-alives. Now when your users camp out on the line, they won't complain to you that they were disconnected:
You can enable the TCP keep-alives by opening the Registry on your published terminate server and navigating to HKEY_LOCAL_MACHINE\ SYSTEM\CurrentControlSet\Control\Terminal Server. Create a new key called KeepAliveEnable with a DWORD value of 1.
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Listened to an
interesting Podcast from the PSS boys over at:
http://blogs.technet.com/sbs/archive/2005/10/01/411830.aspx
They mentioned
some interesting issues with the ISA firewall's Connection Limits feature. They
said PSS has received a good number of calls on client unresponsiveness,
especially when connecting to SSL sites. This is interesting, because SSL
clients need to create a lot of connections to the Web server, so this *might*
be a reason for this finding. However, with a Connection Limit of 160, its hard
to believe that the average SSL visit would hit the wall. However, if things
made sense, we wouldn't need PSS :-)
If you're running
into strange SSL slowness issues, try disabling Connection Limits and bounce the
Firewall service and see what happens.
The PSS crew also
mentioned that you shouldn't run the Firewall client on the ISA firewall. But
you already knew that because you read the book.
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
As a follow up
from the Connection Limits mentioned earlier today, I should mention that
there's another connection limit issue that often gets blamed on the ISA
firewall, but has nothing to do with the ISA firewall. This is a TCP connection
limit imposed on Windows XP Service Pack 2 clients. This is a truly annoying
feature, almost on par with the Windows XP Service Pack 2 breakage of L2TP/IPSec
NAT traversal. At least the Windows XP PG came up with a Registry hack that
allows you to fix the Service Pack 2 bug that breaks NAT-T.
Unfortunately, if
you find that you're Windows XP Service Pack 2 client is not connecting as
quickly or reliably as it should, hold your horses and put blaming the ISA
firewall on the bottom of your blame list (this is a good general principle,
since the ISA firewall, unless misconfigured, probably isn't the problem).
Instead, you'll need to get a third party tool to fix this
problem.
Download the TCP
Connection Limit hork fix tool at:
http://www.lvllord.de/?url=tools#4226patch
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
As Screen Savers
fans know, G4 bought TechTV and killed the Screen Savers show. The show was
dying anyhow, because you could tell over time that the bimbo factor was taking
over and the tech was circling the drain.
The good news is
that there is a GREAT show now available for download or streaming. The show's
name is Digital Life TV and you can find it at www.digitallifetv.com.
Lots of good
hardware lessons and the reviews rock. Two fat thumbs up for this show. Check it
out.
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
There's been a lot
of tripe published in the last year regarding the imminent (if not immanent)
demise of the DMZ. If your gut told you that maybe these authors are trying to
grab headlines, among other things, then trust your gut. The DMZ isn't dead, its
alive and well and becoming more important with each passing
day.
What you need to
understand is that the concept of the DMZ is changing. A DMZ is no
longer the "party down" network segment where unauthenticated users from the
Internet have unlimited opportunities to investigate exploits in your published
services. Now a DMZ is defined as a security zone, and each
security zone has an edge where you need a device, like an ISA
firewall, to perform access controls.
Learn more about
network security zones and how to protect them using ISA firewalls over
at:
http://www.isaserver.org/tutorials/Configure-ISA-2004-Network-Services-Segment-Perimeter-Firewall-Part1.html
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
One thing that drives me crazy, which shouldn't drive me crazy, is when people call the ISA firewall ISA Server. Now, this is a pretty strange thing to have driving me crazy, since ISA Server is the actual name of the product.
The truth is, its not the name of the product that drives me to my wits end -- its what the name does to normally rationale people when the deploy the ISA firewall product. They figure since its ISA Server, then its OK to make the ISA firewall a file server, Web server, FTP server, Exchange Server, SharePoint Server and even an eDonkey server.
People think that since "Server" is in the name of the product, it stands to reason that we should using the ISA firewall as just one other server service to make part of the server consolidation plan.
If I were the marketing boss over at MS, I would try to bend Heaven and Earth to obliterate Server completely from the name of the product. Can it be done? You bet! How about MOM? MOM is Microsoft Operations Manager. I don't know of anyone who calls it "Microsoft Operations Manager Server".
So, as the imaginary boss of the ISA firewall maketing team, I would change the product name to Microsoft ISA Firewall. This allows us to keep the ISA brand name, removes the egregious and self-defeating (from a security standpoint) impression that firewalls are anything but a single purpose network security device, and reinforce the Firewall aspect of the ISA firewall product.
Some ABM security wankers might come back at me at say "but it is a server, running on the Windows Server platform". I'd say "so what, Cisco refers to the PIX product as a firewall server too, for example, check out http://www.cisco.com/en/US/products/sw/secursw/ps2120/prod_release_note09186a008008cff8.html".
More later,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
I'll never
understand some users. They get themselves out of bed in the morning, they can
read menus and order breakfast, they can dress themselves, operate complex heavy
machinary live SUVs, use MP3 players, fill out income tax forms and file them,
and even count to ten without having to resort to using their fingers or a
calculator.
Given this
objective evidence that users are sentient beings, what I don't understand is
why users should not have access to the Firewall client icon in the system tray.
I consider it vitally important that users have access to this icon, since they
will need to enable and disable at times to get things working. If you take it
away from them, then they'll call you at a moment's notice and never be able to
fix the problem themselves.
However, you might
work in a building that has lead paint, or perhaps your company is near an area
where there was a nuclear power plant accident, conditions that might lead
to your users not being as high on the food chain as they might otherwise
be. In that case, you might want to hide the Firewall client icon from
them.
How?
Create a software
restriction policy for the executable that is launched from the Firewall Client
icon (%ProgramFiles%\Microsoft Firewall Client
2004\FwcMgmt.exe). That all there is to it!
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
I see a lot of
requests for backing up the ISA firewall configuration. At first I thought this
was a marginal idea, because I've made it a habit of backing up my config each
time I make a change, so I always have delta backups available. However, I do
understand how the underpaid, overworked, and multitasking firewall
administrator can forget to make a backup and that could leave him in a
lurch.
The good news is
that an ISAserver.org member has come to the plate with a configuration backup
script! You'll need to schuedule it, but the script does the
rest.
Check it out
at:
http://www.rmbt.co.uk/isahowto.php
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
While not many people are using the VPN Quarantine feature that is part of the ISA firewall's feature set (something we expect to change radically in a few months), Chrigi from Switzerland points out an interesting issue when the VPN client has the Firewall client installed and how this intereferes with the remote access VPN client's notifier from communicating with the ISA firewall's rqs.exe listener.
| chrigi-ch Junior Member Member # 30615 |
posted October 12, 2005 03:11 AM 
Hey and hello after 3 month working with the Microsoft Hotline on that issue, here is the description and the solution: I hope this will help others from getting mad on this issue Chrigi-CH Posts: 21 | From: Zurich/Switzerland | Registered: Jun 2005 | IP: Logged |
Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000005
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Libor from Prague in the Czech Republic has come up with a method of publishing the RPC/HTTP proxy.
| <Libor> unregistered |
posted October 05, 2005 11:46 AM
There are many step-by-step guides on publishing an Exchange server for RPC over HTTPS on standard SSL port (443). I have, however, found none on configuring this on an alternate SSL port. I was asked whether this kind of publishing is possible, tested it and found it working. To make it even more interesting and useful I configured it with the listener available for forms-based authentication. If interested, check http://isaserver.webpark.cz/altrpcoverhttps/ for detailed description. Greetings IP: Logged |
Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000005
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
+using+an+Alernate+Port&referrer=){kind=small}
by tshinder
| Press Release | Source: Network Engines, Inc. |
Network Engines and Matrixforce Deploy NS6400 at Perry
Schools
Tuesday October 18, 10:18 am ET
New Solution Updates
Security Framework and Enables Parents Secure Access to Children's School
Records
CANTON, Mass.--(BUSINESS WIRE)--Oct. 18, 2005-- Network Engines,
Inc. (NASDAQ-NENG), a leading OEM appliance partner for Microsoft security
solutions, and Matrixforce, a leading Microsoft Gold Certified Solution Partner,
today announced the successful deployment of an NS6400 security appliance with
Surf Control's web filtering solution at Perry Public Schools.
Perry Public Schools, based in Perry, Oklahoma, serves 1,200 K-12 students in
a community of 6,000. In an effort to update the school's network security,
content filtering, and also create a solution to securely extend student records
to parents online, technology director Joel Hall engaged Oklahoma-based
Matrixforce earlier this year to assess the school's systems and recommend
enhancements.
Matrixforce quickly determined that Perry Schools needed Microsoft ISA Server
2004 and a new web filtering solution to replace its aging security software.
After reviewing several alternatives, Hall and Matrixforce chose the Network
Engines NS6400 security appliance, a hardened device powered by ISA Server 2004,
which is available with Surf Control Web Filtering pre-loaded.
"As the school's only network administrator, I have a lot of roles and
responsibilities. The last thing I needed was a bunch of new software that
increased my maintenance tasks," said Hall. "Therefore, it was a nice surprise
to add a single box to my network, which gives us the latest web filtering
capabilities compliant with Federal law, and runs a state-of-the-art DMZ that
can be extended to parents. Thanks to the automated update service provided by
Network Engines a great deal of my security routine is now automated, which
allows me to sleep better at night. I am now spending a lot of time working on
other more valuable tasks."
"The NS6400 is an incredible product, not only because of the ease of use and
ease of deployment features, but also because it provides significant cost
advantages," said Bob Gunn, Solution Engagement Manager at Matrixforce. "By
deploying the Network Engines' hardened version of ISA Server 2004 with Surf
Control's web filtering solution pre-configured, we believe that end customers
realize an immediate two-fold cost reduction when compared to installing and
maintaining each software package independently. Longer term, customers also
enjoy significant annual savings in maintenance costs."
"We are very pleased with the results after deploying the NS6400 at Perry
Public Schools. The savings in money and time are further proof that the NS
Series security appliances are the best alternative for deploying Microsoft ISA
Server 2004 in conjunction with solutions such as Surf Control," said Derek
Chueng, channel manager at Network Engines.
About Matrixforce
Matrixforce is a leading business support firm in the U. S. South Central
region, headquartered in Tulsa, Oklahoma and founded in 1978. Its mission is
providing superior computer support for customers to lower technology costs and
improve business performance. As a premier Microsoft Gold Certified Partner
(MGCP), Matrixforce specializes in implementing and supporting business systems
utilizing Microsoft Server System, Desktop, and integration products as well as
associated best-in-class hardware and software products.
Network Engines - THE Appliance Company
Network Engines appliances are designed to ease the deployment, enhance
manageability, and increase security of mission critical software applications.
Our heritage of providing technology products and services tailored to
supporting the entire lifecycle of our customers appliances has made us the
appliance partner of choice for software market leaders.
Founded in 1997, Network Engines is headquartered in Canton, Massachusetts
and trades on the NASDAQ exchange under the symbol NENG. For more information
about the Company's products and services visit: www.networkengines.com.
Safe Harbor for Forward-Looking Statements
Statements in this press release regarding Network Engines' (the "Company")
future financial performance and any other statements about Network Engines'
management's future expectations, beliefs, goals, plans or prospects constitute
forward-looking statements within the meaning of the Private Securities
Litigation Reform Act of 1995. The Company's actual results could differ
materially from those stated or implied in forward-looking statements due to a
number of factors, including those factors contained in the Company's most
recent annual report on Form 10-K for the year ended September 30, 2004 and the
most recent Form 10-Q for the quarter ended June 30, 2005 under the section
"Factors That May Affect Future Operating Results" as well as other documents
that may be filed by the Company from time to time with the Securities and
Exchange Commission. Forward-looking statements include statements regarding the
Company's expectations, beliefs, intentions or strategies regarding the future
and can be identified by forward-looking words such as "anticipate," "believe,"
"could," "estimate," "expect," "intend," "may," "should," "will," and "would" or
similar words. The Company assumes no obligations to update the information
included in this press release.
Network Engines and the Network Engines logo are trademarks of Network
Engines, Inc. All other registered and unregistered trademarks in this document
are the sole property of their respective owners.
Contact:
Network Engines, Inc.
Joni Moore, 508-308-7900
joni.moore@networkengines.com
by tshinder
I don't know
anything about the Sipura 2000 VoIP box and although the name of the device
indicates that it uses SIP, I don't know anything about how they've implemented
SIP for this device. As you know, SIP support for ISA is problematic. However,
there is some interesting news regarding ISA firewall support for this
device.
Note that the
instructions indicate that secondary protocols are required. This indicates that
the Firewall client must be installed on the box (clearly impossible) or that
you write an application filter for the device to support its protocols.
However, Nathan Rausch says it works, in the post listed below. I never argue
with success, but I wonder how exactly the device and the solution
work.
| Nathan Rausch Junior Member Member # 4625 |
posted October 01, 2005 05:17 PM
Hello, I've got 1a.) UDP | Recieve/Send | 5060-5061 (Primary) 2a.) UDP | Recieve/Send | Also, the Sipura can remain DHCP on my Internal LAN and Hope it helps Thanks, Nathan E. Rausch |
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Wow! Check out
this new White Paper by MS. We've been fielding a ton of questions on how to
make WSUS work with ISA firewalls and now MS steps up to the plate and delivers.
This is great stuff! One of the things that really impresses me about this paper
is that the WSUS group is taking up the approach to how-to documentation that I
pioneered with the ISA Deployment Kits. This paper has the detailed, step by
step instructions with screen shots, exactly what we want and
need!
Check out the
description of the White Paper, listed below:
"Today?s companies have a growing mobile
workforce. Keeping these assets up to date with current patches is extremely
important to ensure continued productivity and decreased security risk. Many
organizations are finding it more and more difficult to keep these mobile
devices patched as the need for VPN decreases as the number of applications
utilizing Internet protocols such as HTTP and HTTPS grows. Using Windows Server
Update Services (WSUS) in combination with Internet Security and Acceleration
Server 2004 (ISA 2004) organizations can extend their existing Intranet based
patch management to their growing number of mobile devices. The purpose of this
document is to detail the implementation planning and steps needed to create an
Internet based patch management solution using WSUS and ISA 2004."
Find it
at:
http://www.microsoft.com/downloads/details.aspx?familyid=ab72eb03-09cf-4cfb-9af5-1a7dc9c80bc9&displaylang=en
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
The latest version of GFI WebMonitor for ISA
Server, a utility for ISA server that allows for real time monitoring of web
sites being browsed by network users and the files they are downloading, has
just been launched! Version 3 now includes a real-time online adult content
filter, virus scanning and file type blocking capabilities and byte transfer
stats per user/per site.
Click here to download the new and improved GFI WebMonitor for ISA
Server!
The following is
excerpted from this Months ISAserver.org Newsletter. Subscribe to the newsletter
at http://www.isaserver.org/pages/newsletter.asp
Top Ten Clues Indicating a Consultant Shouldn't Be
Within Ten Parsecs of your ISA Firewall
By
Thomas W Shinder MD, MVP
I'm seeing a lot of requests on the ISAserver.org mailing
list and Web boards for expert consultant help in setting up ISA firewalls for
organizations of all sizes. This is great news, because it shows the word is
getting out that the ISA firewall is indeed ready for prime time and is an
enterprise grade firewall that works for any company, regardless of size.
As with all consultant situations, caveat emptor should be
the working phrase. There are some darned good ISA firewall consultants out
there, and there are some who figure that since they're the best Xbox guys on
the block, they might as well be highly paid firewall consultants. Seek the
former and run from the latter.
To help you folks currently in the market for an ISA
firewall consultant, I present my list of the top ten warning signs that your
firewall consultant might be off the reservation. If you hear the potential
consultant utter any of these phrases or ideas, run and not walk away.
1. Consultant
recommends that you "open a port"
You can't "open a port" on a firewall, because ports are
not bidirectional "holes" in some sort of digital pegboard. Even the least
powerful of real firewalls control traffic based on source and destination IP
address and source and destination port, and that's just for TCP and UDP
protocols. Implicit in the concept of "open a port" is that the device allows
all traffic to and from a particular host or network by default. The basic
firewall fact is that "open a port" means nothing to a firewall administrator
and if the consultant utters this phrase, you need to put your guard up. Accept
use of this phrase only if the firewall consultant says it only to condemn it.
2. Consultant
recommends a "hardware firewall"
All firewalls run software. Hardware is dumb and only does
what software tells it to do. A "hardware firewall", in terms of common usage,
means a dedicated firewall device that doesn't run on Windows. There are other
definitions of hardware firewalls, such as those having no fans, no hard disks,
or in general "no moving parts". The misconception is that "hardware firewalls"
are more secure than a firewall that runs on a hardened operating system.
Objective data and experience show that this is an illusion, and is strongly
promulgated by "hardware" firewall manufacturers. I don't blame the vendors for
spewing out this information, they're just trying to gain a competitive
advantage, but I do blame someone who claims to be a firewall expert if he
chooses to believe this canard. The fact is no correctly configured ISA firewall
has been successfully attacked to the extent that there was data loss. So-called
"hardware" firewall vendors cannot make this claim. If your consultant
recommends a "hardware" firewall for security reasons, you better look at the
guy with a jaundiced eye and check the phonebook for another consultant.
3. Consultant
calls a host-based or personal firewall a "software firewall"
As mentioned earlier, all firewalls run on software.
That's a fact and there's no way around it. Even "hardware" firewalls with no
moving parts have software included in memory. One of the most useful measures
for assessing consultant cluelessness is when they refer to host-based or
personal firewalls as "software firewalls" and low-cost NAT devices as "hardware
firewalls". This is a common error made in the consumer radio personality space,
and it creates no end of confusion in that space. However, profession firewall
consultants never refer to host-based or personal firewalls as "software
firewalls" because he knows that all firewalls require software instructions to
carry out their firewall duties.
4. Consultant
says you need to "poke a hole" or "create a pinhole" in the firewall
In the same way that you can't "open a port" on a
firewall, you can't "poke a hole" or "create a pinhole" in the firewall. Again,
a network firewall is not an electronic pegboard, where you can poke a hole in
one of the punch outs and allow "stuff" to flow in both directions. There is no
"stuff" that flows through such "hole pokes". Again, if someone thinks in terms
of poking holes in firewalls, it indicates that he doesn't understand how
firewalls work, and that should reflect on the consultant's lack of
understanding and skill set.
5. Consultant
refers to a NAT device as a "firewall"
There are a number of low cost devices on the market today
providing simple NAT services for SOHO and very small businesses and branch
offices. These unsophisticated devices are able to NAT outbound connections and
sometimes reverse NAT inbound connections. However, these devices do not perform
stateful packet and application layer inspection, do not enable strong
user/group based access control for protocols, sites, content and time of day,
and do not maintain comprehensive logging information about all connections
moving through and to the alleged firewall device. Firewall experts will call a
spade and spade, and a NAT device is neither a spade or a firewall. Consultants
who refer to them as firewalls are showing that they have a bad hand.
6. Consultant
recommends putting a Web or FTP server on the firewall
The network or perimeter firewall is a highly specialized
piece of security gear and everything possible should be done to reduce the
attack surface on the firewall. Any time you allow connections to services on
the firewall, you exponentially increase the risk related to an increased attack
surface, and if you enable connections from the Internet to services on the
firewall, then you've increased the attacker surface by many orders of
magnitude. Any firewall consultant that recommends running Web or FTP services
on the firewall should be run out of town on a rail or hung by his own petard,
or both.
7. Consultant
refers to the ISA firewall as a "proxy server" and recommends a single-NIC
configuration
The ISA firewall is a firewall, first, second and last.
Even if you try to harpoon the ISA firewall's network security model by
installing it in unihomed Web proxy only mode, it's still a firewall (albeit
providing firewall protection only for itself). The ISA firewall does include a
Web proxy filter that works with the ISA firewall's firewall services, but it's
a filter like any other filter. The ISA firewall also supports the Winsock proxy
client (Firewall client), which can remote Winsock connections directly to the
ISA firewall, but the ISA firewall is a firewall that supports these proxy
components, not a proxy server with firewall components. Therefore, be
suspicious of those who refer to the ISA firewall as a proxy server, since it
may indicate that they think the ISA firewall is something like Proxy Server
4.0, which is definitely not the case and indicates that the consultant may not
understand the ISA firewall's firewall architecture.
8. Consultant
creates "all open" Access Rules to the ISA firewall's Local Host Network
The ISA firewall's Local Host Network includes all IP
addresses bound to all interfaces on the ISA firewall. System Policy is the
primary method you should use when controlling traffic to and from the ISA
firewall itself. You should be very careful about allowing any traffic to and
from the ISA firewall itself, since any such traffic could have potentially
disastrous effects. If you ever see a consultant create or recommend a rule
allowing all traffic to or from the ISA firewall, you need to steer clear of
this consultant. There are no valid scenarios where all traffic should be
allowed to or from the ISA firewall. Any consultant who would create such a rule
shows that he doesn't appreciate the profound effects that such rules could have
not only on the ISA firewall, but on your entire network infrastructure.
9. Consultant
says that ISA firewall should not be on the Edge of the Network
I've spent a lot of time teaching ISA firewall admins that
the ISA firewall can and should be used as an edge firewall, and that it is
designed to be an edge firewall. After installation is complete, the ISA
firewall is a network brick and no one is going to get past that brick until you
create rules making is possible. No one is going to break through the ISA
firewall. For this reason, you should be completely at ease with putting the ISA
firewall at the edge of the network. Give a wide berth to the consultant who
recommends putting a "hardware" firewall in front of the ISA firewall, if the
recommendation is made because "he doesn't trust" the ISA firewall on the edge.
In fact, you should not trust the consultant. Stop him before he harms your
network security.
10. Consultant
recommends against using the Firewall and Web proxy client configuration
You can significantly increase the overall level of
security the ISA firewall can provide your network if you deploy both the
Firewall and Web proxy client configurations throughout your network, as
appropriate. Any ISA firewall consultant who doesn't push for such
configurations demonstrates a impressive lack of knowledge about the outrageous
security advantages these client configurations represent. If the consultant
says "I prefer the SecureNAT client because it provides all the security you
need", then you need to lock your checkbook away in a safe place, call security,
and have the consultant escorted swiftly, but considerately, out the door.
=======================
Quote of the Month - "I've never thought of the IRS and
network security together before. I don't think I want to, makes my brain panic"
- Amy Babinchak responding to Tom Shinder's observations on dealing with painful
issues
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Many ISA firewall
adminstrators find that when they deploy a back to back ISA firewall topology,
their former high performance ISA firewall solution went from Corvette to Prius.
The reason for
this is related to DNS name resolution issues. The problem only takes place when
the back-end ISA firewall is configured to use an internal DNS server that can't
resolve Internet DNS host names. If this problem sounds familar, then check
out:
You
experience slow Web browsing performance on internal client computers that use
Internet Security and Acceleration Server to manage Web requests at http://support.microsoft.com/Default.aspx?id=839510
Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000006
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Need some help for
hapless users who are challanged with disabling and enabling the Web proxy and
Firewall client settings on their computers when they're on the road? Yes,
sometimes you need to disable the Web proxy client config and sometimes you need
to disable the Firewall client config to test and get things working when on the
road. Unfortunately, not all hotels are running ISA firewalls
:)
Well, here's some
good news for you! Tim Trace has put together a nice little solution that allows
you one-click access to configuring these client settings. Check this
out:
| timtrace Senior Member Member # 3094 |
 postedSeptember 14, 2005 10:23 PM
Greetings, I've ConfigMe! is a small All of the Login scripts or SMS Click here to If you're going Best regards, Tim == [ September 14, 2005, 10:24 PM: Message Posts: 80 | |
http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=27;t=000412#000001
Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000006
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
The SecureNAT client was designed to support hosts that cannot be configured as Web proxy or Firewall clients, or for network servers. The SecureNAT client was not designed to support fear, mistrust, or misunderstanding of the Firewall and Web proxy client configurations.
The only circumstances when you should configure a host as only a SecureNAT client is when:
- The host does not support the Firewall client software, or
- The machine is a server.
Only Windows operating systems support the Firewall client software, so all non-Windows machine may require SecureNAT configuration. However, if the non-Windows operating systems only require Web proxy access, then configure them only as Web proxy clients only. Almost all operating systems support the Web proxy client configuration. Servers should not have logged on users, therefore, there is no reason to configure them as Web proxy or Firewall clients, in addition to the fact that you should not install the Firewall client on servers.
Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000006
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Did you know that
the ISA firewall supports using wildcard certificates for SSL Web Publishing
Rules? You bet! Check out http://isaserver.org/tutorials/2004wildcardcert.html for
details.
One thing to watch
out for when using Wildcard certs is that while you can use them to publish
multiple sites that belong to the same second-level domain, you
can't use wildcard certs on the Web sites
themselves.
For example,
suppose you want to publish to Web sites:
owa.msfirewall.org
rpc.msfirewall.org
You can create a
wildcard certificate with the common/subject name
*.msfirewall.org and bind that to the Web listener publishing
the sites. However, you can not use that same certificate on
the Web site, because the redirect entry in the Web Publishing Rule must be
the exact name.
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
The URLScan
utility is a tool that helps you control what types of communications are
allowed to an IIS Web server. While this tool is extremely helpful in locking
down your Web servers, you can easily DoS yourself before any hacker gets a
chance if you use it incorrectly or do not have information regarding the
implications of your configuration decisions.
URLScan is
especially problematic when you want to protect an Exchange 2003 Server
published to the Internet. Make one wrong move and BANG! something's broken and
you're up ship's creek without a paddle (notice the Great
Discretion?).
The good news is
that MS has come out with a great doc entitled Fine-tuning and known issues when
you use the Urlscan utility in an Exchange 2003 environment located at http://support.microsoft.com/kb/823175/
If URLScan has
horked your Exchange configuration, this article is the place to start and
probably end -- that's how good the info in here is.
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
FTP is a bad
protocol. Just plain bad. Any firewall admin worth his salt knows of the
problems firewalls have with dealing with this unruly protocol. The ISA firewall
is no exception.
With this in mind,
I was still surprised to see that the Firewall client has a problem with FTP
active (PORT) mode transfers. I learned about this in
KB884580 at http://support.microsoft.com/default.aspx?scid=kb;en-us;884580.
Here's the
configuration you need to see the effects:
| ? | The ISA Server 2004 Firewall Client program is installed and enabled. |
| ? |
The Enable folder view for FTP sites check box is selected in Internet Explorer. When this check box |
| ? |
The Use Passive FTP check box is not selected in Internet Explorer. |
The end result of
these options is FTP requests are NOT handled by the ISA
firewall's Web proxy filter.
Another important
observation is that the command line ftp.exe client is not broken by the Firewall
client. Why? Because the command line ftp.exe FTP client does not call Windows
Sockets and thus isn't handled by the Firewall client. The SecureNAT client
configuration handles ftp.exe
client connections.
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
+Mode+FTP+Connections+through+the+ISA+Firewall%3f&referrer=){kind=small}
by tshinder
I've seen a number of people complaining of site to site VPN connections failing between ISA firewalls at local and remote locations. The common observation is that the connection fails and then there is no way to reconnect except for bouncing the VPN gateways. That's not good.
Something that is good is that there is a hotfix for this problem. Note that the fix is only for ISA firewalls acting as VPN gateways running on Windows Server 2003. If you have this problem on Windows 2000, then you're outta luck :-\
Check out the hotfix info here http://support.microsoft.com/default.aspx?scid=kb;en-us;888090 and give your friendly PSS engineer a call.
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
You've heard
these:
"I can't get my
game/warez app/P2P app/slimeware/sludgeware/non-RFCware/customware to work when
its behind the ISA firewall but when I move the computer in front of the
firewall it works fine -- what's wrong with ISA"
"I could connect
to the site when I was using my [fill in the name of your favorite NAT
device that has firewall scrawled on the box] but when I installed the ISA
firewall it doesn't work any more -- what wrong with ISA"
"Everything worked
before I installed the ISA firewall. Now no one can connect to the
Internet"
Yes indeed, its
all true. And its all good too. The following is not a viable definition for a
firewall:
A network
device providing universal access to all sites, using any protocol, at any time
of day to any user making a connection request through that device without any
technical knowledge required by the firewall
operator/administrator
Seems like common
sense, doesn't it? You bet. That's why drivel like this https://www.techrepublic.com.com/5254-6257-0.html?forumID=99&threadID=181286&messageID=1869990&id=4224622 drives
me up the wall. What's worse, Dr. Johansson is a
world-renowned security specialist. And adding insult to this
injury is that he's configuring the ISA firewall on SBS (which is a security
compromise by definition) and referring to the ISA firewall's configuration
interface as firewall configuration by cartoon.
I could go on with
a long-winded rant, but this type of calumny (there are no cartoon's and the
templates are meant to be used as very basic configuration starters, not for
full fledged firewall administration and policy customization) is especially
disappointing from a Microsoft employee. Its disappointing because the
overwhelming majority of Microsoft employees are extremely perspicacious and
don't denigrate the company's products unless the product really deserves it,
and even then, they do it in a well considered and circumspect
manner.
The ISA firewall
product has enough problems getting traction in the marketplace without having
to deal with what looks like an enemy within. I'm sure this is
not the case, but it smells like it and that's what
chaps my hide.
I also remove four
social credits from TechRepublic's account for highlighting this post as a
featured blog entry. TechRepublic has historically been very supportive of the
ISA firewall and has a lot of information on their sites on how to use the ISA
firewall intelligently to secure network resources. I know that choosing to
feature this ill-considered post was not representative of an overarching
editorial position for TechRepublic/TechProGuild, but its saddening
nonetheless.
Now back to
fighting the good fight!
Thanks!
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Well, I got caught
with my pants down today regarding my post on the FTP/Firewall client issue. I
figured that since the KB article mentioned in the post was dated
September 29 2005, that this was a new issue. However, ISA
firewall MVP Stefaan Pouseele points out the error in my
ways:
| spouseele Senior Member Member # 4220 |
posted October 24, 2005 03:30 PM
Hi Tom, I think However, check out http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=20;t=002693 HTH, Stefaan |
![[Wink]](http://forums.isaserver.org/ubb/wink.gif)
Thanks!
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
If you find that
your having problems with uploading files and creating foldings to your
published SharePoint document library, try disabling the Verify
Normalization feature in the HTTP Security Filter's Properties dialog
box.
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
One problem we have in this business is a lack of precision in our professional terminology. There are a lot of reasons for this, which isn't something we need to go into here. But one of the problems with this imprecision is that misunderstanding of terminology can have an adverse effect on implementing techologies in a production environment.
For example, the ISA firewall supports the concept of an ISA firewall Network. Each NIC on an ISA firewall becomes the "root" of an ISA firewall Network. An ISA firewall Network can include a group of addresses, or even an entire network ID. This is actually the most typical usage and configuration for ISA firewall Networks -- to enter all addresses in all network IDs behind a specific interface as part of the same ISA firewall Network.
So what's the problem? The ISA firewall is a layer three and above firewall. It doesn't give a hoot about what's happening at layer 2. The problems come in when ISA firewall admins ask questions that include phrases like:
"I have three VLANs connected to my ISA firewall, what's the best way to configure things"
or
"Computers on one of my VLANs can't connect to hosts on another VLAN. What should I do in my ISA firewall Policy to fix this problem?
FACT: The ISA firewall doesn't care about your VLANs. While it will support 801.1q VLAN tagging, the ISA firewall just sees each VLAN virtual ethernet segment as a physical interface; the ISA firewall is blissfully unaware of the layer 2 workings.
What is a VLAN? Here's some help:
www.angelfire.com/anime3/internet/network.htm
www.wi-lan.com/technology/glossary.htm
community.roxen.com/developers/idocs/rfc/rfc4026.html
authors.phptr.com/morris/glossary.html
www.ventusnetworks.com/glossary/v.html
www.ru.ac.za/library/theses/2003/halse/ft/html/glossary.html
www.nationaldatamux.com/G80001.htm
www.hscgroup.co.uk/v.html
www.dsltechie.com/glossary/glossary.htm
en.wikipedia.org/wiki/VLAN
Now that you know that VLANs and Nework ID and physical Ethernet segments are not the same thing, you'll be able to ask the right questions, which will get your the right answer.
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
From: USEast News Service [mailto:USEastNewsService@USEast.Net]
Sent: Wednesday, October 26, 2005 1:42 PM
To: USEast News Service
Subject: Microsoft, Nokia Team On Security Appliance
Microsoft, Nokia Team On Security Appliance
By Paula Rooney,
0:46 PM EDT Wed. Oct. 26, 2005
Microsoft and Nokia, archrivals in the mobile phone operating-system space, are partnering on a Unified Threat Management security appliance, channel sources said.
The companies plan to offer a UTM appliance that would act as a gateway for secure VPN access to network-based applications from remote locations or mobile devices such as smart phones, according to source familiar with the vendors? plans. For example, the appliance would monitor e-mail, Web and application traffic between a company?s internal network and the Internet to detect, block and prevent various security threats, the sources said, adding that the product would support Microsoft and non-Microsoft environments.
The planned product would be a special-purpose, integrated software and hardware package with a unified management framework, the sources said. It?s designed to eliminate the need for customers to install and support multiple products to defend against Internet-based attacks.
Plans call for the appliance to be targeted at companies with 100 to 1,000 employees and carry a price of $2,500 to $4,500, sources said. It would support 100 Mbit-per-second bandwidth to external networks and more than 100 VPN connections.
Solution providers said such a security appliance would be a universal VPN solution.
"The box would unify ISA and protocol/traffic monitoring," said Phil Ernst, president and CTO of Convergence Technology Consulting, Bowie, Md. "They are attempting to compete in the space with what is being termed a universal VPN. Citrix introduced this with Citrix Access Gateway, which was the Net6 product."
The planned appliance is designed to be easy to install and maintain and would use Microsoft security technology to integrate with Windows Active Directory and Exchange, sources said. The product also would employ Nokia hardware and other Nokia technology to work well in non-Microsoft environments or mixed environments.
In September, Nokia launched a software solution called Nokia Business Center that delivers business applications and mobile e-mail to smart phones and business-optimized mobile devices.
Mirosoft and Nokia are in discussions with partners about the viability of such security appliance, so it?s unclear when--and if--the product would go to market. Still, such an offering would help Microsoft compete in the hot security market plus give partners a familiar Windows-based tool to use, even though it could be a tough sell, solution providers say.
"Nokia has substantial experience in marketing hardware security appliances that use software from partners such as Check Point. However, these appliances have traditionally been Unix-based," said Alex Zaltsman, managing director at Exigent, Morristown, N.J. "A VPN and network monitoring appliance that runs Microsoft's operating system is a good idea but may lead to some level of pushback from security-conscious administrators who typically prefer to separate those two functions."
"If they stick with the UTM functionality without VPN, I think it could be a great product," Zaltsman added. "It may be a hit with Windows administrators, who are already familiar with the user interface of Windows software.?
Some partners expressed surprise that Microsoft is collaborating on the appliance with Nokia, a competitor in the mobile OS arena.
"An appliance would be a good thing, basically a special-purpose firewall with more features," said Robert Tedesco, CTO of Resolute, a Microsoft Business Solutions partner in Bellevue, Wash. "For some customers, the only way to get sick is from the network. This would be good, but Nokia and Microsoft have not been the best of friends over phone OS wars.
Simon Chan, director of business development at Iteration2, an Irvine, Calif.-based solution provider, said he expects Microsoft and Nokia to remain fierce rivals on the mobile phone front. He also noted that Microsoft is pairing with rivals in several other markets.
"It's interesting that Nokia and Microsoft are teaming together, but not surprising anymore with Microsoft working with RIM and Palm," Chan said. "It would help Nokia in getting a foothold in that enterprise e-mail market, where Exchange obviously is the leader. It shows how Microsoft's different product groups really are very independent organizations.?
Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000007
by tshinder
In your Web
Publishing Expeditions, you might have found that wildcard certs work just fine
for Web Publishing OWA sites, but when you try to publish the OMA and Exchange
ActiveSync sites, all heck breaks loose. The problem is apparently related to
issues with root certificate checking on the Windows Mobile 2003 client. Now, I
haven't confirmed that this is a problem, because I haven't deployed wildcard
certs to support Windows Mobile clients yet. But here's some advice from Rob
Marlbrough on the www.isaserver.org
message boards that might be of some use to you:
| Rob Marlbrough WebWizards.Net Junior Member Member # 33837 |
posted October 26, 2005 07:51 PM
It's easy to use I For more details http://www.petri.co.il/temporarily_disable_root_certificates_checking_in_windows_mobile_ppc.htm and http://www.petri.co.il/adding_root_certificates_to_windows_mobile_2003_ppc.htm
-------------------- Web |
![[Razz]](http://forums.isaserver.org/ubb/tongue.gif)
Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000007
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Hardware firewall guys always remind me of doctors in the early and mid
20th century who recommended smoking to cure such ills as neuresthenia
and the vapors. Why? Because like the docs of yore, they somehow came to
believe in a superstition based on "common sense". The bromide goes
that so-called hardware firewalls are more secure than a "software
firewall" like the ISA firewall, and an ISA firewall could never be as
secure. Its so funny I forget to laugh.
The problem is the joke's on them. The hardware firewall guys are going
to end up with their day of reckoning in the not too distant future, as
the following indicates:
--Cisco Customers Unaccustomed to Updates
(20 October 2005)
Cisco CSO John Stewart says that because Cisco customers are
unaccustomed to updating their network hardware operating system on a
regular basis, many are still running old versions of the company's
Internetwork Operating System (IOS). Mr. Stewart says Cisco has not
adopted automatic patching because its customers do not want it. He
hopes that the outcome of an unexpected vulnerability disclosure earlier
this year will be that Cisco IOS users upgrade to the latest version to
protect their systems.
http://www.zdnet.com.au/news/security/print.htm?TYPE=story&AT=39217949-2
000061744t-10000005c
[Editor's Note (Pescatore): The issue is more that it has been really,
really painful to update IOS. It isn't a patch action, it is a shut
down and reload the OS action, which is very disruptive to the network
and very manpower intensive. While the best solution is always better
software development processes to reduce vulnerabilities, software
vendors (and switch vendors ship a lot of software) have to invest a lot
to make the patch process easier and faster for their customers.
Microsoft learned this back during the worms of 2001 and now most
enterprises can patch Windows much, much faster with much less pain.]
------------------------------------------------------------------------
---
=========================
Discuss this post at:
http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000007
by tshinder
View a Demo on Network Access
View this demo to learn about the value provided by
Microsoft networking technologies. Find out about the different services
available through Windows Server 2003 and ISA 2004.
This is a nicely
done Flash demo for exectives to help them see the advantages of using the ISA
firewall as their remote access VPN server.
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
You might have
seen this one. You've published a Web server and occasionally, for no apparent
reason, the ISA firewall's HTTP Security Filter whacks access to content that it
shouldn't. You get a 500 Internal Server Error and can't figure
out what the problem is. You might have even seen this problem when trying to
access PDF files located on published Web servers (not directly related to PDF,
but that's another story).
The solution might
be that you need to change how the ISA firewall handles compressed content for a
publishing rule. The ISA firewall allows you to make a choice: speed up access
and allow compressed content to pass without application layer inspection, or
slow things down a bit, and provide secure access for non-compressed content and
deny compressed content (which cannot be inspected by the ISA firewall at this
time).
Victoare, and ISAserver.org member,
has a helpful script to allow you to set whether or not you want to support
compressed content on a per Web Publishing Rule basis:
| Victoare Junior Member Member # 30382 |
posted May 25, 2005 05:11 AM
Hi! so, here it is: (i call it ' Define the constant ' Create the root ' confirm function function Info(sText) ' Declare the other ' Get references to the array object and the policy rules For Each rule In rules rules.save [ May -------------------- Posts: 1 | From: |
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Network Engines Wins as Best Firewall in Redmond Magazine Editor's Choice Awards 2005
NS Series Security Appliances now available with Websense Security Suite, winner in the IDS/IPS category
CANTON, Mass.--(BUSINESS WIRE)--Nov. 1, 2005-- Network Engines, Inc. (NASDAQ-NENG), a leading OEM appliance partner for Microsoft security solutions, today announced that it has won a prestigious Redmond Magazine Editor's Choice Award for Best Firewall.
"We choose Network Engines NS Series because of the products enterprise-class functionality, outstanding ease of use and its ability to manage software updates," said Joern Wettern, Redmond Magazine editor. "I was impressed with the usability, especially for smaller company's branch offices that need enterprise-level firewall protection, but don't have extensive experience in configuring firewalls. It's an ingenious customization of turning an existing product (Microsoft ISA Server 2004 running on Windows Server 2003) into a true appliance. At the same time, it shields an administrator from tasks that are not part of the firewall, such as operating system configuration and software updates."
"Network Engines is honored to receive this year's Editor's Choice Award from Redmond Magazine," said Mike Riley, vice president of marketing and corporate strategy at Network Engines. "Having introduced the NS Series just a year ago - and new models as recently as this week - this is exceptional reinforcement that we are meeting the market's needs, and continue to remain a step ahead of other vendors."
Riley added that it was particularly gratifying to learn that the Websense Security Suite won in the category for best Intrusion Detection System/Intrusion Prevention System: "We have worked closely with Websense to integrate their Security suite into our family of security appliances and announced availability of the combined solution earlier this week. Our goal is to enable customers to deploy a single, cost effective solution that provides comprehensive defense in depth protection for core Microsoft applications including Exchange(TM), SharePoint Portal server, and IIS Webserver."
The NS Series is a family of security appliances powered by Microsoft ISA Server 2004 and Network Engine's NEWS(TM) appliance management technology. These security appliances maximize defense-in-depth for core Microsoft infrastructure applications, and leverage the power of market leading web security capabilities from Websense.
Network Engines - THE Appliance Company
Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008
by tshinder
|Off Topic|
Like most responsible people in the business, I believe in the right of a copyright holder to be paid for his work. However, one place where the right stops is when the rights holder decides to install a Rookit on my computer.
This is a facinating and exceptionally well written account of how Sony is using Rookits to compromise the security of your Computers when you buy some of their copy protected music CDs. My concern now is whether Sony has deployed other rootkit technology in their products outside that included with CDs. This could be a major blow to Sony's Desktop and laptop business, if Rootkit installation compromises all Sony out of box computing products.
Mark's Sysinternals Blog: Sony, Rootkits and Digital Rights Management Gone Too Far: http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html
Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
|Off Topic|
Looks like F-Secure has come to the rescue. They have a Rootkit remover for the Sony spyware/rootkit ware.
Check it out at:
F-Secure : News from the Lab: http://www.f-secure.com/weblog/
Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008
UPDATE: It appears I was too hasty. F-Secure only detects the Sony Rookit -- it will not remove it.
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
The story is getting
deeper. This article on ZDNet indicates that the firm that created the Rootkit
compromise included with some versions of Sony CD DRM technology worked with
Symantec to create this potentiall illegal malware:
Sony CD protection sparks security concerns | Tech
News on ZDNet: http://news.zdnet.com/2100-1009_22-5926657.html
Discuss this
entry at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John
Galt?**
by tshinder
Question: Why do I have problems with TFTP?
Answer: TFTP is a complex protocol and is not friendly to "open a port"
mindset firewall admins.
Details:
TFTP is trivial file transfer protocol. It is less complex than than the
FTP application protocol and is designed to be used for booting diskless
systems like X terminals, diskless workstations, and routers.
TFTP does not support authentication; the TFTP client simply to the
server and requests a file and does not include an authentication header
in the protocol specification. If the server can service the request,
the server gives the client the file.
There's no reason to allow TFTP across your edge firewalls. However, if
you use the ISA firewall as a increase your network security by using it
as a perimeter firewall solution you can use the TFTP built in protocol
definition in Access Rules.
TFTP uses UDP as its transport. TFTP servers listen on port 69 for the
initial client-to-server packet to establish the TFTP session, then use
a port above 1023 for all further packets during that session. Clients
use ports above 1023. Notice that dynamic ports are negotiated, which
makes TFTP a complex protocol and thus unfriendly to "open a port"
firewall admins.
Simple stateful packet inspection "hardware" firewalls often have
difficulty supporting TFTP because the responses do not match what the
simple stateful packet inspection firewall understands. Simple packet
inspection firewalls considered a response to be valid only if its
source and destination are reversed from a recently received packet and
that information is stored in the simple packet inspection firewall's
state table. With TFTP, the response packet has a destination that
matches a recent source, however, the source is new. And unlike the FTP
protocol where this is port negotiation with information about the
negotation carried in the FTP application layer data, TFTP does not
negotiate such ports and assumes a clear, routed path between source and
destination.
For this reason, make sure there is a route relationship between the
source and destination network and you use the built in TFTP Protocol
Definition included in the ISA firewall. Do not used this Protocol
Definition for Server Publishing Rules and do not publish the TFTP
protocol.
RECOMMENDATION:
Avoid the use of TFTP in all secure environments.
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Talk about a
public relations SNAFU!
Sony releases a
decloaker for their music CD DRM rootkit, but all it does is act as a
"decloaker" -- it won't enable you to remove the malware.
Get this, if you
want to remove the Rootkit from your computer, you have to call Sony
customer support.
Now, that's a
twist -- I wonder if spyware writers will try this trick themselves. Offering to
remove their rootkits if you call them at a evanescent VoIP address bought with
a stolen credit card -- at which time they will Phish you since you'll believe
you're talking to a real person.
Some companies
have more dollars than sense.
Check it out
at:
http://news.zdnet.com/2100-1009_22-5928608.html
Discuss this
post at:
http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008
HTH,
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Life has to be
getting rough for the "hardware" firewall folks. The image of a "device
inviolate" continues to crumble around their feet. The number of exploits
against hardware firewalls, especially against Cisco devices, is accelerating
and there's no evidence that it'll slow down in our lifetimes.
This makes sense.
Just as the Windows large installed base made it a tasty target for Internet
scumbags, the Cisco attack surface is even more tasty, because in spite of the
communal illusion, Cisco is not a security company -- its a networking
company.
Check this
out:
http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1140183,00.html?track=NL-102&ad=533036
Now, you can
become part of the solution by bringing in ISA firewalls to shore up security
weaknesses hardware firewalls bring to your organization. You don't have to
white-box it either. You can use ISA "hardware" firewall appliances to get the
same level of support and management control you have with your soon to be
former "hardware" firewall solution.
Check out the
Microsoft ISA Hardware Firewall page at:
http://www.microsoft.com/isaserver/hardware/default.mspx
Check out the
ISAserver.org hardware firewall page at:
http://isaserver.org/hardware/ISA-Appliances/
Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
A quick reminder
to all ISA firewall admins that there are two places you can go to get scripts
to help manage your ISA firewalls.
First, there's the
premiere ISA firewall scripts site run by the ISA Firewall Grand Master
Jim Harrison. Jim's site www.isatools.org is the
authoritative site for ISA firewall scripts.
A new player in
the ISA firewall script space is Jason Fossen. Jason is a
Dallas native (like your's truly) and has come up with an awfully nice ISA
firewall scripts site. Jason's site is www.isascripts.org. If you haven't
been there yet, you should make it a point to going there in the near future.
And I won't even hold it against him that he works for SANS
;-)
Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
If so, make sure
that the Cisco CSS is not sending keepalive packets to the ISA firewall's
external interface. The ISA firewall, by default, does not allow inbound PING
requests. If you require this functionality, you can create an access rule that
allows outbound PING from the source Network to the IP address on the external
interface of the ISA firewall.
Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Talk about a
Pandora's box. Sony used unethical and questionably legal means to protect some
of their music CDs. Now other people of questionable ethics are making hay of
it.
Check out this
securityfocus article on how cheaters are using the Sony Rootkit to steal from
Blizzard entertainment:
http://www.securityfocus.com/brief/34
Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Talk about a Pandora's box. Sony used unethical and questionably legal means to protect some of their music CDs. Now other people of questionable ethics are making hay of it.
Check out this securityfocus article on how cheaters are using the Sony Rootkit to steal from Blizzard entertainment:
http://www.securityfocus.com/brief/34
Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Did you know that
almost all your ISA firewall configuration questions have already been answered?
Well, almost all
of them. Yes, its true! The answers to your ISA firewall configuration, branch
office, VPN, and Exchange Server publishing questions are all contained within
some ground-breaking documents called ISA 2004 Deployment
Kits.
I know, its sounds
to good to be true. Don't take my word for it. Check them out
at:
http://www.microsoft.com/isaserver/techinfo/guidance/2004/configuration.mspx
Let me know what
you think of them and if you have any questions.
Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
I see the question
come up too often. It goes something like this:
"I have five
IP addresses I want to put on my external interface, but I only have four NICs
in my computer. Do I have to install more NICs to get all these IP addresses on
my ISA firewall"?
The answer is
NO.
You can bind
multiple IP addresses to the external interface of the ISA firewall. As long as
all these IP addresses are part of the same ISA firewall Network (typically part
of the default External Network, but this is not required) and the same Network
ID (do NOT confused network IDs with VLANs - do NOT let Cisco marketers drive
you understanding of TCP/IP networking) then you can bind them to the same
NIC.
Just open the
Properties dialog box of the external interface and open the
TCP/IP Properties dialog box from there. Then click the
Advanced button and add more IP addresses.
Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
Trending After Hours posts
Sort by Trending
0 helpful
2 replies
0 helpful
10 replies
0 helpful
3 replies
Discussion
Hello everyone
0 helpful
3 replies
Discussion Locked
Designing Websites for Clear Mobile Viewing
0 helpful
1 reply