Discussion Locked
Dr. Tom's Microsoft Networking Blog
0 helpful
212 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
This is page 2 of the discussion. Read the opening post
212 replies
by tshinder
"Stupid is as stupid does, sir" -- Forrest Gump to Lt. Dan
What am I talking about?
Read this little flight from reality snippet from page 3 of the Implementing WSUS with ISA Server 2004 to Manage Remote Clients guide that you can download from http://www.microsoft.com/downloads/details.aspx?FamilyID=ab72eb03-09cf-4cfb-9af5-1a7dc9c80bc9&DisplayLang=en :
"Note: This figure does not show any other firewalls used on the Contoso network. It is recommended that the ISA 2004 Server be installed behind another firewall device. Depending on security needs a second firewall may also be installed between the Internet Accessible Network and the Internal Network"
You know, I don't know if its the air, the water, pot, ecstasy, space base (http://parentingteens.about.com/cs/cocainecrack/l/blsldiccrack.htm), ghost buster (http://parentingteens.about.com/cs/cocainecrack/l/blsldiccrack.htm), roofies (http://www.urban75.com/Drugs/rohypnol.html) or a combination of the above, but there has to be something that causes people of otherwise average intelligence to act like they've just left Icepick Freeman's office (http://en.wikipedia.org/wiki/Walter_Freeman)
Listen up and listen up good. Print out the following and tape it to your bathroom mirror and recite it five times each morning:
===================Print Below This Line==========================
FACT:
You do NOT need another firewall in front of the ISA firewall. Its is NOT recommended to have another firewall in front of the ISA firewall. Its is also NOT recommended that you not put another firewall in front of the ISA firewall. The only people who recommend putting another firewall in front of the ISA firewall are sales reps from Cisco, Juniper, Sonicwall and other firewall vendors.
===================Print Above This Line==========================
Is that so hard to understand? Its really simple. Its not rocket science, its not even medical science. If you have a problem with any of the concepts implicit or explicit in this FACT please post to the discussion link so that you can be disabused of you delusional thinking.
Discuss this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000008
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
I was going
through my treasure trove today and found an article I did on using ISA
firewalls for Microsoft Exchange Server way back in October of 2004. This is a
great article on how to integrate ISA firewalls into your corporate network. I
highlights the ISA firewall's flexibility as a front-end firewall, back-end
firewall, or only firewall on your network. Definitely worth a
read.
Check out
Protecting Microsoft Exchange with ISA Server 2004 Firewalls at
http://www.msexchange.org/articles/2004protectexch.html
Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000009
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Did you know that
there is a ton of cool articles on how to configure the ISA firewall to block
attacks that you might have inadvertantly allowed? Yes, in the best of all
possible worlds, Dr. Pangloss would tell you that application of the Principle
of Least Priviledge would make preventative measures configuration a spurious
effort.
Unfortunately, for
technicial, political or moral reasons, its not always possible to properly
deploy a well-designed least privilege firewall policy. If you're in this
position, then you'll need to get good information on how to configure the ISA
firewall with strong preventative measures.
Check out the
Preventative Measures page at http://www.microsoft.com/isaserver/support/prevent/default.mspx for
more information.
Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000009
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Ben, an
ISAserver.org member posts on the ISAserver.org message boards some cool
information on getting a true silent instllation of Firewall client
application:
| Ben13 Junior Member Member # 33974 |
 posted November03, 2005 10:17 AM    
Hello all, Been Many of you may know or read here that you can \\%isaserver%\MSPCLNT\SETUP.EXE /v"/qb+/r:n" Well Basically the Sorry if this is already well know, I looked forever and only take |
| Ben13 Junior Member Member # 33974 |
posted November 04, 2005 09:12 AM
No problem, glad to I'm surprised it hadn't been posted because I did see Anyway here are the other parameters Display Unattended mode - progress bar only Restart Logging There are also I hope everyone finds at least take care, |
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Are you
experiencing slow downloads through the ISA firewall for HTTP downloads? Try
this:
1. Configure the
browsers to be Web proxy clients
2. Configure the
browsers to use HTTP 1.1 through proxy connections
Discuss
this post at: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=48;t=000009
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
by tshinder
Do you have problems with MSDE logging on your ISA
firewalls, in that the MSDE mssql process takes up what appears to you to be
"too much" memory? If you're uncomfortable with MSDE using the amount of memory
its currently using, then check out the below for how to tune the amount of
memory used by this process.
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
You may experience high memory usage on an ISA Server 2004-based
computer that logs messages to an MSDE database
View
products that this article applies to.
| Article ID | : | 909636 |
| Last Review | : | November 10, 2005 |
| Revision | : | 1.1 |
SYMPTOMS
You may experience high memory usage on a Microsoft Internet
Security and Acceleration (ISA) Server 2004-based computer that is configured to
log messages to a Microsoft SQL Server Desktop Engine (MSDE) database.
CAUSE
Microsoft SQL Server uses the available physical memory to
optimize MSDE insertion and query processes. SQL Server is designed to release
physical memory as soon as there is a request for physical memory from other
processes that are running on the computer.
Note This behavior by
SQL Server does not affect the regular operation of other processes on the ISA
Server 2004-based computer.
STATUS
This behavior is by design.
MORE INFORMATION
Although this behavior does not affect the regular operation of
other processes, you may want to limit the amount of physical memory that is
allocated for SQL Server. To do this, follow these steps:
| 1. | Determine the maximum memory limit that is allocated for SQL Server. To do this, follow these steps:
|
||||
| 2. | Reduce the amount of physical memory that is allocated for SQL Server. To do this, follow these steps:
Note The optimum physical memory |
by tshinder
Here's a cool script put together by Networking-Guru that detects the nearest ISA firewall and automatically configures the Firewall client machine to use that ISA firewall. It also does dead firewall detection. Neat!
| Networking-Guru New Member 
Posts: 4 |
Hi, I put a script together which detect which ISA Server (or Array) is closest then sets the Firewall Client to use this Server(using FWCTOOL). The script can also detect whether the firewall has failed so with a bit more work it could be configured for failing over in the event of an outage.e.g. run at regular intervals It is currently a early version of the script, but worth publishing so it http://www.networking-guru.net/ any comments please feed back -- |
!["[Smile]"](http://forums.isaserver.org/image/smiles/smile.gif)
Discuss this post at: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htm
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Britestream Networks Announces ?Britestream Applied? Solution Set
Offering for Microsoft ISA Server 2004
New Solution
Delivers Enhanced SSL Performance and Fortified
Security
AUSTIN, Texas ? October 3, 2005 ?
Britestream Networks, the leading provider of hardware-based data privacy
solutions , today announced the enhancement of its Britestream Applied: Windows
Server System program by announcing the additional support of ISA Server 2004.
This extends Britestream ?s commitment to supporting the Window Server
Systems. With the Britestream solution installed, ISA can offer fortified
security to key Microsoft application servers like: Exchange, SharePoint Portal
Services and IIS.
SSL-based encryption has become the predominant method of providing privacy
and confidentiality for data in transit. However, implementing SSL in software
can leave applications vulnerable to attacks and require updates which can
negatively impact the performance of the server. With the Britestream Applied
Windows Server System Edition, SSL can be turned on by default in more server
applications for the secure transmission of data, both inside and outside the
network.
?This product offering is the next logical step in our Britestream Applied
program,? said Gordon Daugherty, CMO of Britestream. ?ISA 2004 represents a key
application security platform for Microsoft customers. We are very excited to be
able to enhance both the performance and security of the ISA Server.?
Collective Technologies headquartered in Austin, Texas is a Microsoft Gold
Certified partner and one of Britestream?s Gold Certified channel partners. They
were an integral part of the early evaluation program and they will be among the
first to integrate it into their service offerings.
?We are very please d to be able to integrate this Britestream solution into
our Microsoft-based solution offerings,? said David Leonard , VP of the
Infrastructure Services Group at Collective Technologies. ?This represents a
critical security and performance enhancement for all ISA Server 2004 users.?
Security for ISA 2004
Adding the Britestream SSL security Network Interface Card (NIC) to an ISA
Server provides a simple way to add fortified security and to extend the
end-to-end secure connection to both remote and internal users. Britestream
securely stores the encryption keys and certificates within the tamper-resistant
chip. Only authenticated users can then gain access to the key.
Scalable Performance for ISA 2004
Very often ISA Server is used as an application firewall for high volume
transaction web sites or Exchange environments. SSL is often used as
the default method to secure transmissions from the browser or Outlook
client. The Britestream SSL security NIC offers 100% offload and
termination for this extremely processor intensive function. It completely
offloads the SSL termination and processing from ISA allowing it to do
its deep packet inspection of the data. Together,
Britestream and ISA Server offer superior security and performance, with no
penalty for simply activating SSL. IT administrators can choose among
Britestream?s supported advanced cryptographic functions, including RSA key
sizes of up to 4K and a variety of encryption algorithms.
Britestream Applied Windows Server System Edition is available now from
Britestream authorized channel partners. For more information please refer to
www.britestream.com.
About Britestream
Britestream
Networks provides SSL security NICs or ASICs that deliver a unique
combination of powerful simplicity, un-compromised performance and fortified
security. Delivered in an industry-standard Ethernet NIC, Britestream?s solution
eliminates the need for network integration and provides 100% CPU offload. With
sensitive information stored in hardware, Britestream solutions are
tamper-proof. From existing applications such as servers, load balancers,
firewalls, and content switches to fast-growing emerging applications such as
SSL VPNs, XML/Web Services, and secure e-mail gateways, Britestream?s board and
chip solutions remove all barriers and penalties of deploying data security. For
more information, visit: www.britestream.com.
Media Contact:
press@britestream.com
by tshinder
Takeaway:
ISA Server
2004 isn't just a multilayer filtering firewall and Web caching server, it's
also a secure remote access VPN server or gateway. Here's a look at some key
advantages that could make ISA Server the best VPN choice for your network.
Description:
Windows expert Dr. Thomas
Shinder created this list
that explains 10 key benefits of using ISA Server 2004 as your remote access VPN
server or VPN gateway. Here are just a few:
- Active Directory integration for user
authentication. The ISA firewall's VPN server enables you to leverage your
current Active Directory user database and group classifications to
authenticate with the VPN server. - RADIUS user mapping for non-Active
Directory users. The ISA firewall's VPN server allows you to map
non-Windows users to Windows accounts. When user mapping is enabled, you can
create and enforce any firewall policy rules that apply to
users. - Granular access control over what VPN
users can access on the corporate network. Unlike the typical hardware VPN
server, the ISA firewall's VPN server enables you to easily control what users
access once they connect to the corporate network through the VPN link. You
can use the ISA firewall's per-user/per-group access controls and extend those
to determine which resources users can access once
connected.
Check it out
at:
https://www.techrepublic.com.com/5138-1035-5953646.html?part=rss&tag=feed&subj=tr
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htm
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Hey folks, here's
a short tip sheet I did on how to secure your DNS servers. By no means is it
comprehensive, but it'll give a quick start on getting a secure DNS
configuration up and running faster than you might otherwise
:)
Takeaway:
DNS software is a favorite target of
hackers, which can lead to security problems. This PowerPoint presentation
explains some of the most effective ways to lock down DNS servers.
Description:
Without DNS, you can't resolve an
Internet address, and customers can't send e-mail to you or browse your Web
site. Unfortunately, DNS servers are also vulnerable to a multitude of attacks,
which can come in several forms. Dr. Thomas
Shinder put together a
list of 10 key tactics you can follow to help make DNS more secure,
including:
- Using DNS forwarders
- Disabling zone transfers
- Setting access controls on DNS registry entries
- Using DNS resolvers
We've turned the PDF version of his list into a PowerPoint presentation so the information can be
shared and discussed with your IT staff.
What do you think of using
PowerPoint as a vehicle for sharing this type of information? Join the
discussion of this download and let us know your opinion.
Download at: https://www.techrepublic.com.com/5138-1035-5931066.html
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htm
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
I've been telling you folks time and again that hardware
firewalls are not a security panacea, and in fact are often less secure than a
properly configured ISA firewall. Unfortunately, its hard for "network" guys to
appreciate this simple fact. The time is coming soon where CxOs are going to
realize that their "networking" guys are a major security risk to the data
you're trying to secure . The following article provides some a key fact
point that illustrates just the tip of the "hardware" security
illusion.
See
the link for the rest of the story.
(InfoWorld) - Virtual private
network products from a variety of vendors, including Cisco Systems Inc. and
Juniper Networks Inc. are vulnerable to a denial of service attack, thanks to a
bug that was recently discovered by researchers at Finland's University of
Oulu.
The flaw affects a component of the IPsec (Internet Protocol Security)
protocol used by VPN (virtual private network) software and hardware to securely
exchange data over the Internet. While there is some risk of affected VPN
systems being taken over by attackers, a more likely threat is a DOS (denial of
service) attack, in which machines would be forced to reset repeatedly, jamming
up networks and causing headaches for users.
"This issue is ... very important to you if you are using an IPsec VPN," said
security research center The SANS Institute in a statement posted to its Web
site. "While this is not as severe as remote code execution, it can still break
a business if critical network links are impacted."
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htm
Thomas
W Shinder, M.D.
Site:
www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Domain joined VPN client machines can use Group Policy refreshes to stay secure, but if users don't log on using the Log on via dial-up networking option in the log on dialog box, then they won't get the Group Policy updates and they won't get password change notifications either. This can create a potential security issue, since Group Policy is a pivotal part of your overall corporate security scheme. You can get around this issue for users who forget to log on correctly by using a post-connection script (which you can include in your CMAK profile) to runs the following line:
gpupdate.exe /force /wait:0
BTW -- do you know what the gpupdate switches are? I looked them up just for fun. You can amaze your friends at your next MCSE cocktail party with your knowledge of these switches and how to use them:
/Target:{Computer | User}
This switch can be used if you want to specify that only user or computer policy settings are updated. If you do not use any switch, by default, both user and computer policy settings are updated.
/Force
This switch reapplies all policy settings. By default, only the policy settings that have changed are applied.
/Wait:{value}
This switch enables you to set the number of seconds that you have to wait for any policy processing to finish. The default value is 600 seconds. The value, zero (0), means that you do not have to wait. The value, -1, means that you have to wait indefinitely. When the time limit is exceeded, the command prompt returns, but the policy processing continues.
/Logoff
This switch can cause your session to log off from the computer after the Group Policy settings have been updated. This behavior is required for those Group Policy client computer extensions that do not process policy on a background update cycle, but are able to process policy when a user logs on to the computer. Two examples of such behavior can be observed with the user-targeted Software Installation and Folder Redirection features. This switch does not have an effect if extensions have not been called that require you to log off from the computer.
/Boot
This switch can cause a restart of your computer after the Group Policy settings are updated. This behavior is required for those Group Policy client extensions that do not process policy on a background update cycle, but are able to process policy at Startup. An example of this behavior is observed with the computer-targeted Software Installation feature. This switch does not have an effect if extensions have not been called that require a restart of your computer.
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htm
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Here's a great post from the
securityfocus.com, focus-ms mailing list from an ISA firewall fan. Nick does a
great job describing the advantages of using an ISA firewall over "fry up your
own packet filter" alternatives.
-----Original Message-----
From: Nick
(last name and address withheld for security reasons)
Sent: Tuesday, November
15, 2005 5:36 PM
To: focus-ms@securityfocus.com
Subject: RE: ISA Server or
Firewall Appliance?
I've been using ISA 2004 on a box that's been facing
the internet since it's
was released as a public beta. I've run other
firewall "appliances" as well
as both m0n0wall and pfSense (pfSense is a
variant of m0n0wall optimized for
use on standard PC hardware) and I've
really found it to have the best
featureset. I also read an article on
Network Computing or Windows Magazine
that put ISA2004 as one of the fastest
firewalls, almost achieving "full"
1000Base-TX speeds.
I think ISA's
real redemption comes from the hardware that it runs on,
standard (sometimes
cheap) PC components. If you get a power surge on an
Ethernet card
(because only in the engineer's dreamworld does the Ethernet
cable get it's
on surge arrestor) and blow the card, there's a $20
replacement at the local
computer store. On the other hand, you have the
sleek, integrated units
that you have to throw away or RMA if something gets
zapped, and you won't be
able to troubleshoot it to the same degree you'd be
able to troubleshoot an
ISA server.
Personally, I was able to configure the ISA2004 box to do
just about
everything, once I understood how the rules worked. I've got
setup to
demand dial a PPPoE connection, it also handles the site-to-site
VPN, which
was a PPTP connection at first, but then IPsec after the remote
site got a
sonicwall Pro 330 (which is no where near as configurable,
IMO). The only
real issues I've had with it are more related to
windows, rather than ISA
(compared to a cisco 2600, windows' routing table
leaves something to be
desired).
m0n0wall is a nice package if you're
planning to use something like a PC
Engines' WRAP or a Soekris single-board
computer (WRAPs are limited to about
45Mbps throughput, soekris is
substantially more powerful). pfSense was
forked from the m0n0wall
source and developed specifically to run on
standard PC hardware, it's SMP
aware so there's a benefit if you need a
really fast firewall. PfSense
has a lot of features, but I don't think
they'll all ever be as mature as the
features that ISA has, which has more
features than I have explored.
I
don't know how helpful I've been, but I figured I'd speak up since
I've
worked with a few different types of firewalls (I work for an
ISP).
==========================
==========================
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htm
HTH,
Thomas W Shinder, M.D.
Site:
www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP --
ISA Firewalls
**Who is John Galt?**
by tshinder
Here's somebody talking about the ISA firewall's upcoming Service Pack 2. The ISA firewall's Service Pack 2 is going to be more than just some fixes and tuneups. This Service Pack will include some all new features, such as:
- Support for compressed HTTP content, which will significantly speed up your OWA access and branch office user experience when they're accessing Web content at the main office.
- BITS caching, which will allow the ISA firewall to cache byte range requests. What's this mean? It means that when one client on the network requests content from the Windows or Microsoft Update Site, the content will be held in the ISA firewall's Web cache and the next client to make a request for the same content will get it from the cache. The BITS feature is a killer upgrade which will save you megabucks in bandwidth costs for branch offices that do not have WSUS servers on site
- The HTTP QoS feature is a bit a of red herring -- I won't tell you about this yet, but don't get your hopes up if you're looking for Internet bandwidth shaping and quotas.
As for ISA Server 2006, all I can tell you is I know nothink! ;)
===================================
http://bink.nu/Article5376.bink
This article is written by Raymond Comvalius a Security Consultant from the Netherlands is also attending the MS IT Forum and is guest contribituer to the IT Forum coverage on Bink.nu.
Microsoft is currently in the final stages of beta testing ISA Server 2004 SP2. Besides a couple of bug fixes, SP2 will contain the following new features:
? HTTP compression
? BITS caching
? HTTP QoS
The service pack is ought to be out in January 2006. This means that ISA Server 2004 Enterprise Edition has never seen a SP1. SP1 has been the service pack for ISA Server Standard Edition only.
The next version of ISA Server, codename Wolvereen and currently planned as ISA Server 2006, is planned for release in the second half of 2006. So it might end up being named ISA 2007 [;)]
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htm
HTH,
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Configure ISA 2004 as
a Network Services Segment Perimeter Firewall - Part 5: Configuring the Clients
and DNS Infrastructure
In the first four
parts of this series on creating a network services segment using ISA firewalls,
we discussed general DMZ and perimeter segment networking principles and design
concepts, configuration of the network services segment ISA firewall, and
routing principles and procedures required to make our solution work. We also
configured the edge ISA firewall so that users on the Corpnet ISA firewall
Network could gain access to Internet resources and external users could access
Exchange Server resources located on the network services segment.
Check it out at: http://isaserver.org/tutorials/Configure-ISA-2004-Network-Services-Segment-Perimeter-Firewall-Part5.html
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
One of the biggest
differences between networks of the 90s and 21st century networks is the fact
that there are no longer any trusted networks. While the Interent edge
of your network is exposed to a larger attacker surface, most security
analysts will agree that attacks, compromises and exploits from within the
corporate network are more common, and more destructive, than what comes in from
the outside. For this reason, we can no longer implicitly trust our internal,
corporate network and the traffic moving through it.
This has lead to
an increasing awareness in the importance of Security Zones.
Each security zone is populated by a group of devices that share a common level
of trust, or trustworthiness. Each zone zone also needs to take into account the
common and aggregate value of the devices within that zone. In general, the less
trusted the security zone, the less valued are the assets contained within
it.
For example, your
Exchange Servers, SQL servers and domain controllers represent a different
security zone than wireless devices connected to an anoymous access WAP, and
wired hosts populated with Windows XP computers run by temporary clerical
workers is a different security zone than both the servers and the anonymous
access wireless clients.
This has led to
the push for corporate network perimeterization and strong access controls
between hosts belonging to each perimeter. The best way to do this is to use
internal firewalls to control access between network security zones. The good
news is that an ISA firewall is an idea candidate for an internal network
perimeter firewall because of its strong stateful packet and application layer
inspection feature sets.
That's why I did a
series of articles on how to configure the ISA firewall as a network services
perimeter network firewall. If you're interested in taking network security to
the next level, then check out all five articles in the
series:
Configure
ISA 2004 as a Network Services Segment Perimeter Firewall - Part
1
Configure
ISA 2004 as a Network Services Segment Perimeter Firewall - Part
2
Configure
ISA 2004 as a Network Services Segment Perimeter Firewall - Part
3
Configure
ISA 2004 as a Network Services Segment Perimeter Firewall - Part 4
Configure
ISA 2004 as a Network Services Segment Perimeter Firewall - Part
5
Discuss
this post at: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
It doesn't seem that long ago when I wrote
the aritcle Enabling Full Outlook Client Access Anywhere using the ISA
Firewall?s Secure Exchange RPC Filter at http://www.isaserver.org/articles/2004securerpc.html
In that article I pointed out that the ISA firewall enables the Liebnitz
scenario (best of all possible worlds -- aka Pangloss Scenario A) where you can
use the full Outlook MAPI client from anywhere in the world and never need to
change the configuration information on the Outlook client.
In this scenario, the user is at home, opens
Outlook to read mail and then closes the laptop to hibernate the machine while
Outlook is running. Then the user goes to the office, brings the laptop out of
hibernation and Outlook automatically connects -- the user didn't even need to
start Outlook becuase it was already open when the machine exited hibernation.
The laptop connects to the Exchange Server while the user is in the office
without a skip. The user then closes the laptop, with Outlook still open, and
hibernates the machine.
He then goes to the airport. He connects to
the WLAN at the airport and Outlook starts working automatically soon as the
WLAN connection is established. No muss, no fuss, no VPN, and doesn't even
require Outlook 2003. Then the user closes the laptop to hibernate (not closing
Outlook before hibernation) and get on the plane. He gets to the hotel, plugs
into the hotel broadband network, opens the laptop to bring it out of
hibernation, and Outlook just works. Never did the user have to touch a
configuration open, never did the user need to establish a
VPN.
However, this scenario does have some limitations
and I discussed them when a member of the www.isaserver.org mailing list asked why
anyone would want to mess with RPC/HTTP when secure Exchange RPC Publishing is
available. That was a good question and I gave him a comprehensive response,
which I am now sharing with you:
However, there are limitations to secure RPC publishing:
1. "Open
a Port" firewall admins often will block the RPC endpoint
mapper (TCP 135).
This was a big problem when Blaster hit, and even the
moron ISPs decided to
DoS their customers by "doing them a favor" and
blocking outbound access to
this port. Things are much better now, and
I've been able to use Secure
Exchange RPC at most hotels and airports,
but there are still a number of
locations that block this port, or have
unintelligent firewalls/firewall
admins who don't support RPC outbound
from the remote location
2. You
need to publish each mailbox server. In a simple one or two box
Exchange
organization, secure Exchange RPC is a great option. But for
companies that
have lots of Exchange Servers, publishing each one can be
a hassle.
3.
The weak link in the security chain for many companies is "the network guy" as
he will
balk at opening the packet filters on their packet filter device
(aka
"firewall") in front of the ISA firewall. Since the Syphco rep
slipped
the network guy some roofies, he's convinced Spyhco is a
security
company, when in fact they're a network company and security is
a
sideline, and if they were to secure something, its this
"network"
thing, instead of securing the server applications that require
the
security. So, you'll end up in a war with both the "open a port" network
dude and
management, doesn't know the difference, other than he paid 50 grand
for
the hardware firewall and only 5 grand for the ISA firewall, and
since
money talks and BS walks, you lose because the psychiatric (notice
I
used the term psychiatric and not psychological, because there's
clearly
some psychopathology involved with spending that much money for a
really
fast packet filter) motivators are on his side, not yours.
4.
When remote users get stuck because the trisomy running the packet
filter
device (ah, I mean firewall) doesn't understand RPC or the RPC
endpoint
mapper is blocked, then you have to rely on VPN. Unfortunately,
some popular
packet filter firewalls don't have PPTP NAT editors, so you
can't use that.
OK, you could use L2TP/IPSec, which is secure and fully
supports NAT-T, and
the "network guy" on the remote client end probably
hasn't figured out where
the "close a port" button is for that. But this
highlights the reason why you
choose to use Secure Exchange RPC
publishing in the first place, which was to
avoid using VPN -- not
because VPN isn't good, because its very good, not
because you can't
limit VPN users based on user/group to access only the
Exchange Server
using the MAPI client, because you can, but because of the
user
overhead, which is what you were trying to avoid.
5. So, instead
of falling back on VPN, Microsoft came up with the great
idea of doing what
the Internet criminals do, but without the criminal intent. In
fact,
quite the oppostite of criminal intent becaues they did this to
allow
users full Outlook MAPI client access to the Exchange
Server in spite of the
criminal stupidity of the NAT devices, packet
filter firewalls, and
lissencephalic "hardware" firewall admins who
check their horoscopes and
throwin' bones to see what "port they should
open" today. The common
tool of Internet criminals and Microsoft's RPC/HTTP is to tunnel another
protocol inside an
HTTP header, in this case Exchange RPC. Since "open a
port" firewall
admins don't care about application security (they're only
concerned
with 'port attackers' and 'pinhole abusers'), they allow
outbound TCP
ports 80 and 443. RPC/HTTP uses TCP 443 to reach the RPC proxy,
where it
is then detunneled and the nekkid RPC communcaitons move from the
RPC
proxy to the Mailbox server. The responses return to the RPC proxy,
the
HTTP header is added, and returned to the client. No need for VPN,
no
need for RPC endpoint mappers. All secure within an SSL
tunnel.
Well, those are some of the reasons, there are more, like rainbow
tables and integrated authentication. However, when the enviornments on the
client
and server side for Secure Exchange RPC publishing are right, then
it
r0XOrS. When they're not, life S0XouRxS.
DISCUSS THIS POST
AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-18-2005/m_2001997347/tm.htm
Thomas
W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP --
ISA Firewalls
**Who is John Galt?**
by tshinder
Every now and then
we get questions on configuring the ISA firewall for outbound VPN access. Here's
what you need to do:
1. Determine what
VPN protocol is required. PPTP, L2TP/IPSec, IPSec tunnel mode,
NAT-T?
2. Create Access
Rules allowing the required protocols.
3. Configure the
clients as SecureNAT clients
4. Disable the
Firewall client application
That's all you
need to do. Keep in mind that the ISA firewall will not be able to perform
application layer inspection on VPN tunneled communcations, so you better have
implicit trust in the users who are launching VPN connections from within your
corporate network.
Discuss
this post at: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
One of the very cool things you can do with ISA
firewall is publish multiple Web sites using a single IP address on the external
interface. You can use a single IP address on the external interface of the ISA
firewall to publish multiple sites, or if you have a hundred addresses on the
external interface. The ISA firewall?s Web proxy filter component is what makes
it all happen.
Read all about it
at: http://isaserver.org/tutorials/Publishing-Multiple-Non-SSL-Web-Sites-Single-IP-Address-using-ISA-Firewalls.html
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Amy Babinchak is
the ISA on SBS guru and you'll do yourself a favor by checking out this Webcast
she did recently on how to optimize ISA firewall configuration on an SBS 2003
computer. It won't be up forever, so you better fire up those browsers and
screen recorders and listen up now.
Check out Amy's
Web cast on her blog at http://isainsbs.blogspot.com/2005/11/isa2004-recorded-live-meeting.html
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Network Engines NS 6000
Series
Judge: Joern Wettern
 |
The enterprise-class functionality, managed software updates and outstanding
ease of use are three reasons why the Network Engines NS 6000 series is Joern Wettern's pick for
firewall system. "I was impressed with the usability, especially for smaller
company's branch offices that need enterprise-level firewall protection, but
don't have extensive experience in configuring firewalls," he says. "It's an
ingenious customization of turning an existing product (Microsoft ISA Server
2004 running on Windows Server 2003) into a true appliance. At the same time, it
shields an administrator from tasks that are not part of the firewall, such as
operating system configuration and software updates."
For more
information on Redmond Magazine's Editor's Choice Awards, head
on over to http://redmondmag.com/features/article.asp?EditorialsID=523
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Here's a list of
anonymous proxy sites that help your malicious users bypass the ISA Firewall's
access control policies (actually, any firewall's access control policies, not
just the ISA firewall's). Make sure to include them in your BLOCKED
Sites Domain Name Set and use that set in your global Deny
rule.
http://www.xanproxy.be/
http://ieproxy.com/
http://www.techtakeover.com/search/
http://www.spysurfing.com/
http://www.myfreeproxy.be/
http://worldwideproxy.com/
http://www.proxytastic.com/
http://www.nomorelimits.net/
http://www.proxifree.com/
http://browseatwork.com/
http://www.netsack.net/
http://www.afreeproxy.com/
http://cgi-proxy.net/
http://www.coveredtracks.com/homepage.php
http://www.easyproxy.org/
http://www.privatizer.net/
http://www.secure-tunnel.com/
http://www.spiderproxy.com/
http://thestrongestlinks.com/
http://www.unipeak.com/
http://betaproxy.com/
http://proxy7.com/
http://webwarper.net/
http://www.chronicpulse.net/
http://www.space.net.au/~thomas/quickbrowse.html
http://www.proxyking.net/
http://w3privacy.com/
http://freeproxy.us/
http://www.goproxing.com/
http://greenrabbit.org/
http://hujiko.com/
http://poxy.us.to/
http://hidemyass.com
https://proxify.com/
http://projectbypass.com/
http://www.proxymouse.com/
http://letsproxy.com
http://www.the-cloak.com/login.html
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Takeaway:
Learn what
you can do to protect your corporate network assets from both managed and
unmanaged wireless devices.
Description:
Plenty of information is available that
explains how to create a secure wireless network. But what about securing your
network FROM wireless devices? This list of pointers from Dr. Thomas Shinder
will help you reduce the
risk. Recommendations include:
- Place anonymous access WAPs on perimeter
networks - Limit anonymous access perimeter segments to
unencrypted protocols - Enforce strong bandwidth control on anonymous
access WAP segments - Use IPSec-based domain isolation to protect
domain members
Download the this
top ten list at: https://www.techrepublic.com.com/5138-1009-5962748.html
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Want to know more about the ISA firewall's stateful application layer inspection feature set?
Want to get a few minutes of PowerPoint slides and a lot of minutes of demonstrations on how to do cool stuff with the ISA firewall?
Then check out this Webcast. I'm going to demo stuff that's never been demo'ed before, and I guarantee that you're going to like it a bunch.
| ? | TechNet Webcast: Inside Application Layer Filtering (Level 300)
Tuesday, November 29, 2005 - 11:00 A.M. - 12:30 P.M. Pacific Time |
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htm
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
ISAserver.org Newsletter of November 2005
ISAserver.org -
November 2005 Newsletter
|
by tshinder
I was reading the
Skype network admin guide today (a fine thing to do on Thanksgiving, when
figuring out how to call Mom on the cheap) and found these recommendations for
firewall configuration:
Outgoing
TCP connections should be allowed to remote port 1024 and
higher
Translation:
Create a Protocol Definition for TCP outbound with ports 1024-65535. And create
an access rules that allows these connections to
everywhere.
Outbound
TCP connections should be allowed to remote ports 80 and
443
Translation: Allow
outbound TCP 80 and 443 to everywhere
Outgong
UDP packets should be allowed to remote ports 1024 and higher. For UDP to be
useful to Skype, the NAT must allow for replies to be returned to sent UDP
datagrams. (The state of UDP "connections" must be kept for at least 30 seconds,
and Skype recommends that these translations be maintained for as long as an
hour, if possible
Translation:
Create a Protocol Definition with UDP Send/Receive Primary connection 1024-65535
and secondary connection ???. They don't explicitly state what the second
connections are or if the secondary connections are actually required. All they
say is that "the NAT must allow for replies". What I think they mean here is
that you can use the ISA firewall's stateful packet inspection engine to
automatically manage the replies, and that there are not secondary inbound
connections. What I don't know is if they've misused the term "reply". Create a
rule that allows this connection to everywhere.
The NAT
translation should provide consistent translation, meaning that outgoing address
translation is usually the same for consecutive outgoing UDP
packets
Translation: Who
knows? Like the second amendment of the Constitution, poorly worded
documentation creates no end of confusion. However, if I interpret this
correctly, the ISA firewall's stateful packet inspection engine will do this
automatically, without any changes required on your part.
So, bottom line
according to their documentation, you need to allow all TCP and UDP ephemeral
ports, as well as TCP 80 and 443 and that no secondary connections are
required.
If my
interpretation is wrong, it means that the Skype documentation SuX0Rs.
Which would be no surprise, becuase they write this stuff for "open a
port" 'hardware' firewall admins who always let everything outbound,
becuase they think there are no malicious uses are their corporate network
:\
Try this out and
let me know what happens. If it works with the SecureNAT client configuration,
using the rules I've indicated above, then there are no secondary
connections required and I can apologize to the Skype technical writers. If it
doesn't work, it indicates that secondary connections are required and the Skype
technical writers owe me and everyone else an apology for wasting our time with
their spotty docs.
Final note: Skype
is not a secure application, with the poor documentation being on a very small
issue of the overall security risks imposed by Skype communications. I'm not
going to go over all the details here, but you can easily use Google or MSN
Search and find a ton of links to Skype security issues.
The Skype network
admin guide can be found at: http://www.skype.com/security/guide-for-network-admins.pdf
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
I see a good
number of posts from ISA firewall admins who experience poor Web proxy filter
performance for their Web proxy clients when using a back to back ISA firewall
configuation. The most likely issue in this scenario is that the downstream ISA
firewall is performing name resolution. You can significantly improve Web proxy
filter performance by disabling name resolution on the downstream ISA firewall's
Web proxy filter.
Check out
How to configure ISA 2004 to skip name resolution in a Web proxy
chaining configuration at http://support.microsoft.com/default.aspx?scid=KB;EN-US;891244 for
detailed instructions.
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
In a perfect world
we never never need to create a single deny rule. Yes, in the most perfect of
all possible worlds, we would actually use the principle of least privilege and
allow uses access only to the sites they require access. But
that ain't going to happen in my lifetime, so we chase our tails creating block
lists.
If you're such a
tail chaser, then check out Maciej Rusinek's Blacklist
2004 application. It takes the drudgery out of implementing and
managing mammoth block lists.
Find the
application at http://blacklists.w.interia.pl/index_b2004.htm
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_11-25-2005/m_2001998156/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
The first place
most ISA firewall admins check for information on setting up and configuring the
ISA firewall is the ISA firewall's Help File, which is pretty darned good if you
ask me. However, not everything you'd expect to be in there is in
there.
Why? Becuase they
stuck it in the ISA firewall Software Development Kit (SDK) Help file. A good
example of this is information on how to move the ISA firewall's MSDE log files.
If you want info on how to do this, check the ISA SDK info over at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/isasdk/isa/logs.asp
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-02-2005/m_2001998768/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
The DMZ is not dead. It?s not even breathing
hard. In fact, DMZs become more important every day. No longer can you have
implicit trust in any network. Back in the days of yore, you could depend on two
types of networks: the scary ?untrusted? external (Internet) network and the
safe and sane (trusted) internal network.
Learn more
at: http://www.isaserver.org/tutorials/Creating-Multiple-Security-Perimeters-Multihomed-ISA-Firewall-Part1.html
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Lots of Demos of stuff I
haven't written about before and that I haven't seen anywhere else. Have
fun!
TechNet Webcast:
Inside Application Layer Filtering (Level 300)
Tuesday, November 29, 2005 - 11:00
AM - 12:30 PM Pacific Time
Thomas W.
Shinder, M.D., ISA Server MVP, TACteam
How safe is your firewall? Buffer
overruns, mail viruses, and other attacks penetrate many corporate firewalls and
use protocols such as HTTP, SMTP and FTP to defeat port-based rules and pass
attacks inside data streams. This webcast shows how Microsoft Internet Security
and Acceleration Server 2004 features such as URL filtration,
pre-authentication, syntax checking, and intelligent content inspection help
deliver a high-degree of protection through application awareness. Understand
the SMTP filter model and the HTTP filtering engine, and see how these integrate
with Internet Information Services 6.0, Microsoft Exchange Server 2003, and the
Remote Authentication Dial-In User Service to help form a well-defined defensive
strategy.
http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032283954&Culture=en-US
+LOTS+of+Demos&referrer=){kind=small}
by tshinder
Takeaway:
Many computer
security problems involve exploitation of employees by social engineers. Here's
a look at some of the most widely used tactics and techniques aimed at
manipulating people to gain access to your network.
Description:
Just as talented
hackers can use their programming skills to exploit applications, operating
systems, and protocols to get inside your company's network, talented social
engineers can breach your network by using their people skills and powers of
observation to exploit your company's employees, partners, and others who have
legitimate network access. Social engineers are adept at psychologically
manipulating people into giving them access or the information necessary to get
access using a variety of schemes. IT pro Deb Shinder put together a list of tricks typically
used by these intruders, along with some suggestions for how to thwart some of
them. Common ploys include:
- Impersonating IT staff
- Playing on users? sympathy
- Using intimidation tactics
- Shoulder surfing
Download this doc
at: https://www.techrepublic.com.com/5138-1009-5976521.html?part=rss&tag=feed&subj=tr
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-02-2005/m_2001998768/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
If you made it to
my talk about the ISA firewall's stateful application layer inspection feature
set, then you know that we covered some key concepts in how the ISA firewall
provides superior firewall protection using a multilayered approach to network
security. I appreciate the time you took out of your scheudule to attend the
talk and I hope to see you again at the next one!
If you didn't have
a chance to attend the Webinar, then I have some good news. You can now download
the file for offline viewing. You'll be able to see the slide show and the over
45 minutes of really cool demos. I had planned to do seven demos, but only got
five of them done due to time running out.
I'm working on a
collection of seven documents now that gives the deep details of how to
replicate the demostrations I did, and am also including a ton of cool
ISA firewall tips and tricks in each of these docs, many of which I
didn't have time to explain during the demonstrations.
Head on over to
http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032283954&Culture=en-US and register for the meeting. After you register, you'll be taken
to a page where you can download the Webinar recording. Let me know if you have
any questions on what I talked about by clicking on the discussin link.
Thanks!
DISCUSS THIS
POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-02-2005/m_2001998768/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
WPAD allows you to automatically configure your Web browser and the
Firewall client with key configuration information that enhances the
security your ISA firewall provides and is just one of the myriad of
reasons why the ISA firewall whacks the low level of security provided
by common "hardware" firewalls.
You have two options for WPAD: DHCP or DNS. I always use DNS because
it's a much more efficient protocol, and I understand more than the
average bear how the DNS infrastructure works (that is to say, I'm at
the 51st percentile). DHCP is an option, but its lower performance and
you might not be happy with the results. This was an empirical
observation of mine for years, but I never saw any authoritative
documentation of the issue until today.
To quote Jim Harrison regarding the use of DHCP WPAD delivery:
=========================
Don't use DHCP wpad - it's cr*p.
We've found that WinInet (what IE uses) can take up to 10 seconds to
"digest" the DHCP data it gets.
Use only DNS or WINS (if you must).
=========================
I wholly agree with Jim. Don't fear DNS. Embrace it, use it, make it
dance and sing for you. Don't put your head in the sand like some SBS
MVPs and MVP manque types we know ;-)
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by nzamparello9
Well here's the funny thing about your comment... For windows that
maybe true but for linux I've experienced no slowdowns.. In fact when I
had cable access installed at a business of mine the cable guy was
perplexed because he never seen d/l speeds benchmark as fast as a linux
system.. My speed was 14 Mbits per sec!! This was using
DHCP... Soo... What may be true for one os may not be true for
another..
by tshinder
Here's an update to the WPAD issue discussed
in my last post, courtesy of Stefaan Pouseele:
=========================
That's what
described in my article:
http://www.isaserver.org/articles/ISA2004_ClientAutoConfig.html
and related to:
http://forums.isaserver.org/m_350016600/mpage_1/tm.htm
A fix for Windows XP SP2 is officialy
released on November 11, 2005. The
related knowledge base article is KB906055
and should be available soon on
the web. IE uses an obsolete DHCP API but
this API has been fixed (DHCPCSVC)
for Windows XP SP2
only.
HTH,
Stefaan
==========================
I did try to find a link
to the KB article Stefaan mentions, but its not yet up on the MS.com Web site.
I'll keep my eye out for it and let you know when it shows
up.
BTW -- if you haven't had
a chance to read Stefaan Pouseele's excellent articles on ISAserver.org, you
should do yourself a favor. Stefaan has a great talent in getting into the
internals of the ISA firewall's networking behavior and sharing his insights in
a way that is easy to understand.
Check out Stefaan's
section at: http://www.isaserver.org/Stefaan_Pouseele/
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-02-2005/m_2001998768/tm.htm
HTH,
Thomas
W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP --
ISA Firewalls
**Who is John Galt?**
by tshinder
Thanks to Susan
Bradley (http://msmvps.com/bradley/) for the
heads-up on a newsgroup post regarding the planned WSUS support for ISA
2004 SP2 firewalls and subsequent versions.
Check it out
at:
http://groups.google.com/group/microsoft.public.windows.server.sbs/tree/browse_frm/thread/2bd4120fda9432c7/3ab5786f1751b108?rnum=1&hl=en&q=author%3ASteve+author%3AMattox&_done=%2Fgroup%2Fmicrosoft.public.windows.server.sbs%2Fbrowse_frm%2Fthread%2F2bd4120fda9432c7%2F3ab5786f1751b108%3Flnk%3Dst%26q%3Dauthor%3ASteve+author%3AMattox%26rnum%3D2%26hl%3Den%26#doc_3ab5786f1751b108
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-02-2005/m_2001998768/tm.htm
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Posted to
Bruce Cowper's Canadian IT Pro Community blog at http://blogs.technet.com/brucecowper/archive/2005/12/02/415438.aspx
===============================
Last week we held a 2 day series of hands-on labs for ISA
server and Antigen that convered a huge range of scenarios and practical
solutions for security, junk mail filtering and anti-virus. I hope all of you
that attended will agree that it was an awesome experience. I spent a great deal
of time not only working through the labs with you, but talking about how you
could leverage the technologies in your environment.
As a result of the labs, I have been contacted by a number
of you wanting to get hold of the presentation material from the labs, so here
are the links:
To download the presentation on
Internet Security & Acceleration Server 2004 Enterprise Edition, click
here: http://download.microsoft.com/download/a/6/c/a6c4a976-da3e-4950-8c46-c3964cbbec1f/ISA
EE Presentation.pdf
To download the presentation on
Microsoft?s Sybari Antigen click here:
http://download.microsoft.com/download/a/6/c/a6c4a976-da3e-4950-8c46-c3964cbbec1f/Antigen
Presentation.pdf
To
download the presentation on Frontbridge click here: http://download.microsoft.com/download/a/6/c/a6c4a976-da3e-4950-8c46-c3964cbbec1f/Frontbridge
Presentation.pdf
Thanks
again for attending this great event.
I look forward to seeing you all again
soon!
===============================
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-09-2005/m_2001999425/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Thanks to Susan Bradley (http://msmvps.com/bradley/) for the heads-up on a newsgroup post regarding the planned WSUS support for ISA 2004 SP2 firewalls and subsequent versions.
Check it out at:
http://groups.google.com/group/microsoft.public.windows.server.sbs/tree/browse_frm/thread/2bd4120fda9432c7/3ab5786f1751b108?rnum=1&hl=en&q=author%3ASteve+author%3AMattox&_done=%2Fgroup%2Fmicrosoft.public.windows.server.sbs%2Fbrowse_frm%2Fthread%2F2bd4120fda9432c7%2F3ab5786f1751b108%3Flnk%3Dst%26q%3Dauthor%3ASteve+author%3AMattox%26rnum%3D2%26hl%3Den%26#doc_3ab5786f1751b108
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-02-2005/m_2001998768/tm.htm
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
If you've never
read the WSSA, then you're in for a treat. This collection of documents provides
detailed information on creating a complex distributed network using all the
Microsoft networking services. You can learn a ton about how to get the most out
of MS network services using these documents and there are a ton of tips and
tricks that you won't find anywhere else.
While its unlikely
that you'll fully implement a similar network, there are chunks of valuable
information that you can take and put in your fact master's
toolkit.
Check it out at:
http://www.microsoft.com/downloads/details.aspx?FamilyID=d44e34ec-b4e2-49a1-9f40-9ed4ba3765df&DisplayLang=en
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-09-2005/m_2001999425/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
+Released&referrer=){kind=small}
by tshinder
Wiki's have been
around for a long time, but it seems that only recently they've been popular.
What's a Wiki?
According to wiki.org (http://wiki.org/wiki.cgi?WhatIsWiki)
its:
"Wiki is in Ward's original description:
The simplest online database that could possibly work.
Wiki is a piece of server software that allows users to freely create and
edit Web page content using any Web browser. Wiki supports hyperlinks and has a
simple text syntax for creating new pages and crosslinks between internal pages
on the fly.
Wiki is unusual among group communication mechanisms in that it allows
the organization of contributions to be edited in addition to the content
itself.
Like many simple concepts, "open editing" has some profound and subtle
effects on Wiki usage. Allowing everyday users to create and edit any page in a
Web site is exciting in that it encourages democratic use of the Web and
promotes content composition by nontechnical users."
=========================
There are some big
advantages to having a tech wiki. No writer can possibly think of everything
when writing an article on a particular subject. So, having the ability to
leveage the collective experience of thousands of IT Pro's is a big plus.
However, there are disadvantages to allowing anyone to edit content, in that not
everyone knows which end eats :)
I've tried to
implement something like this at www.isaserver.org by including a discussion
board link with each article I publish and making that link prominent in each of
my articles. I wish folks would use this feature more often, because it allows
me to update articles with fresh content, and get ideas that I wouldn't have
ever considered without other people's input. In addition, the discussion board
link allows you to ask me "what did you mean when you said ....". It's
like being able to ask the professor pointed questions about stuff he mentions
in a lecture.
TechRepublic hosts
a lot of my content, so I'll be very interested to see how this works out. Check
out their beta version of their Tech Wiki at:
TechRepublic's "10 things" ... The Wiki
Version:
http://wiki.techrepublic.com/twiki/bin/view/TenThingsPlus/WebHome
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-09-2005/m_2001999425/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Dear ISA firewall
admins, I'd like to take this opportunity to introduce you to one of the best
ISA firewall documentation projects on the microsoft.com Web site:
Troubleshooting Unsupported Configurations for ISA Server
2004.
Why do I think
this is one of the seminal works of ISA firewall documentation on the Web today?
The reason is that the writers really listened to ISA firewall
admins and collected the most common misconfiguration issues that afflict the
ISA firewall.
I highly recommend
that you read this document at least three times and digest the all the tasty
morsels contained therein. You'll be a much better ISA firewall admin and
consultant after reading this doc.
Check it out at:
http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/unsupportedconfigs.mspx
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-09-2005/m_2001999425/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
You might notice
on the www.isaserver.org Web site and
message boards that there is a distinct prejudice on my part against
the use of the unihomed (single NIC) ISA firewall.
Why? Because the
unihomed ISA firewall isn't a security solution, per se. Yes, in some scenarios
the unihomed ISA firewall can bolster the otherwise abysmal level of security
provided by simple stateful packet inspection firewalls, but since the unihomed
ISA firewall can be easily bypassed (since its not in a compulsory path between
source and destination) its rediculously easy for both the neophyte and
experienced intruder to bypass the unihomed ISA firewall.
The ISA firewall
isn't MS Proxy Server 4.0. While the ISA firewall has a Web proxy filter that
hooks into the ISA firewall's Firewall Service, the ISA firewall is a firewall
first, second, last and always.
Here are some more
compelling reasons for not deploying unihomed ISA firewalls:
Multi-network firewall policy. In single network adapter
mode, ISA Server recognizes itself (the Local Host network). Everything else is
recognized as the Internal network. There is no concept of an External network.
The Microsoft Firewall service and application filters operate only in the
context of the Local Host network. (ISA Server protects itself no matter what
network template is applied.) Because the Firewall service and application
filters operate in the context of the Local Host network, you can use access
rules to allow non-Web protocols to the ISA Server computer. This has
implications for running applications located on the ISA Server
computer.
Application layer inspection.
Application level filtering does not function, except for Web Proxy Filter for
Hypertext Transfer Protocol (HTTP), Secure HTTP (HTTPS), and File Transfer
Protocol (FTP) over HTTP.
Server publishing.
Server publishing is not supported. Because there is no separation of Internal
and External networks, ISA Server cannot provide the NAT functionality required
in a server publishing scenario.
Firewall clients.
The Firewall Client application handles requests from Winsock applications that
use the Firewall service. This service is not available in a single network
adapter environment.
SecureNAT clients. SecureNAT
clients use ISA Server as a router to the Internet, and SecureNAT client
requests are handled by the Firewall service. Because the Firewall service is
not available in a single network adapter configuration, such requests are not
supported.
Virtual private networking.
Site-to-site virtual private networks (VPNs), and remote access VPNs are not
supported in a single network adapter scenario.
As Mr. T would
say: "I pity the fool who deploys a unihomed ISA firewall"
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-09-2005/m_2001999425/tm.htm
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
| Press Release | Source: Network Engines |
Network Engines and Websense to Host Launch Party at
InfoSecurity 2005 to Celebrate New Joint Product Offering
Tuesday December 6, 9:28 am ET
Launch Party Celebrates
the Release of Network Engines NS Series Integrated with Websense Web Security
Suite
CANTON, Mass.--(BUSINESS WIRE)--Dec. 6, 2005--Network Engines and
Websense will host a launch party during the InfoSecurity 2005 Conference in New
York City to celebrate the release of the Network Engines NS Series security
appliance powered by Microsoft ISA Server 2004 integrated with Websense Web
Security Suite(TM). This joint offering signals an emerging trend of security
vendors working closely together early in the development and manufacturing
process to give end customers a fully integrated, on-box solution that reduces
total cost of ownership, while greatly automating security tasks.
WHAT: A launch party hosted by Network Engines and Websense.
Food and drinks will be served.
WHEN: December 7th, 5:30 - 7:30 p.m.
WHERE: Microsoft Corporate Offices, NYC
Belvedere Castle Conference Room
1290 Avenue of the Americas, 6th Floor
WHO: Executives from Network Engines, Websense and Microsoft
will be in attendance, as well as VARs, customers,
prospects, industry analysts and media
DON'T MISS: Demonstrations of Network Engines NS Series products at
Booth # 524 at the Jacob Javits Convention Center at
InfoSecurity 2005 from December 6 - 8, 2005.
RSVP: http://www.networkengines.com/infosecny
Network Engines - THE Appliance Company
Network Engines appliances are designed to ease the deployment, enhance
manageability, and increase security of mission critical software applications.
Our heritage of providing technology products and services tailored to
supporting the entire lifecycle of our customers appliances has made us the
appliance partner of choice for software market leaders. Founded in 1997,
Network Engines is headquartered in Canton, Massachusetts and trades on the
NASDAQ exchange under the symbol NENG. For more information about the Company's
products and services visit: www.networkengines.com
Contact:
Network Engines Joni Moore, 508-308-7900 joni.moore@networkengines.com
Source: Network
Engines
by tshinder
In part 1 of this article series on configuring a
multihomed ISA firewall to support multiple DMZ segments, we went over DMZ
design principles and discussed the different types of DMZs the ISA firewall can
support. We also went over in detail the differences between authenticated
access and anonymous DMZ segments, and how we can securely place a front-end
Exchange Server on an authenticated access DMZ while removing the front-end
Exchange Server from the same security zone on which the back-end Exchange
Server lies.
In this, part two of the series, we?ll define
our example network and the access controls we?ll create to allow communications
through the ISA firewall. Get all the details at:
http://www.isaserver.org/tutorials/Creating-Multiple-Security-Perimeters-Multihomed-ISA-Firewall-Part2.html
DISCUSS THIS
POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-09-2005/m_2001999425/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Takeaway:
OWA enables
users with Exchange accounts to manage their e-mail from almost any computer
that has a Web browser, but they don't always take advantage of OWA's full
functionality. Here are some tips for getting more mileage out of OWA features.
Description:
Because the OWA interface is similar to
the Outlook client interface, it's fairly easy to figure out how to handle basic
tasks. But OWA actually offers more options and shortcuts than most users
realize. Dr. Thomas
Shinder put together these recommendations
for tapping into some of OWA's less obvious functionality. For example, he
offers handy hotkeys for saving time on things like sending, saving, and
deleting messages, spell-checking, and marking messages as unread. Other tips
explain how to:
- Use built-in searching on column header sorting
- Speed up OWA connections over slow lines
- Get an Agenda view using a secret URL
- Automatically include your signature in new
messages
Download these
tips at: https://www.techrepublic.com.com/5138-10877-5983909.html?tag=search
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-09-2005/m_2001999425/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
+power+user&referrer=){kind=small}
by tshinder
The ISA Server
Best Practices Analyzer is a diagnostic tool that automatically performs
specific tests on configuration data collected on the local ISA Server 2004
computer from the ISA Server hierarchy of administration COM objects, Windows
Management Instrumentation (WMI) classes, the system registry, files on disk,
and the Domain Name System (DNS) settings.
The resulting report details
critical configuration issues, potential problems, and information about the
local computer. By following the recommendations of the tool, administrators can
achieve greater performance, scalability, reliability, and uptime.
Download the ISA firewall BPA at: http://www.microsoft.com/downloads/details.aspx?FamilyID=D22EC2B9-4CD3-4BB6-91EC-0829E5F84063&displaylang=en
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-09-2005/m_2001999425/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
+Server+2004+Best+Practices+Analyzer+Tool&referrer=){kind=small}
by tshinder
Amy Babinchak
presents an easy to read an insightful article on how to the use the ISA
firewall's new integrated firewall log viewer and log filtering feature set to
troubleshoot common ISA firewall connectivity issues. This is a great article
that fills a gap in the current ISA firewall documentation on the Web today. A
must read.
Check it out at:
http://www.isaserver.org/articles/Basic-ISA-2004-Troubleshooting.html
Also, if you
haven't been there yet, check out Amy's Blog ISA in SBS -- yes, it's
secure at http://isainsbs.blogspot.com/
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-09-2005/m_2001999425/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
In this, part 3 of the series, we will go over
the often misunderstood areas of certificate naming conventions and DNS
infrastructure required to support the configuration. This is an area of common
confusion, so pay very close attention to the concepts discussed in this
article. Once you understand the concepts and issues related to a proper
certificate naming infrastructure, you?ll never again have to wonder why your
secure Web and Server Publishing Rules don?t work correctly.
Check it
out at: http://www.isaserver.org/tutorials/Creating-Multiple-Security-Perimeters-Multihomed-ISA-Firewall-Part3.html
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-16-2005/m_2002000621/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
10 ways to secure your Windows-based SMTP
relays
Takeaway:
You can
mitigate some of the security risks inherent in connecting to and from anonymous
SMTP servers by using inbound and outbound SMTP relays. Here are 10 ways to
reduce the risks.
Description:
Organizations hosting their own mail
services must accept incoming connections from anonymous SMTP servers on the
Internet. In addition, outbound mail must allow connections to SMTP servers of
unknown security configuration. Dr. Thomas
Shinder has assembled a list of
recommendations that will help reduce the attendant security risks. For example,
he suggests that you:
- Disable anonymous and authenticated relay at the
server level - Use different SMTP relays for inbound and
outbound mail - Enable logging for the SMTP service
- Use SSL and authentication for end-user
relays
Join the discussion of this download.
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
An ISAserver.org
Web boards member reminded me about MDSE logging and the need to install SQL
updates. In fact, immediately after installing the ISA firewall (which you
should do when the ISA firewall machine is not connected to the Internet) you
should do the following:
- Get Updates from
the MSDE and Office Web Components - Get the ISA
firewall application updates - Analyze the ISA
firewall's security configuration using the Microsoft Baseline
Security Analyzer - Harden the ISA
firewall using the ISA Server Security Hardening
Guide - Put a recurring
appointment in your Outloook Calendar to repeat these steps once a
month
For more
information and links, check out the ISA Firewall Security Update
Center at:
http://www.microsoft.com/isaserver/techinfo/2004se-p2w-postinstall%28en%29.mspx
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-16-2005/m_2002000621/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
A free service from USEast Network Services 
Visit the USEast BLOG to find more news about appliances, Microsoft, security and lots of other subjects.
Whale To Bundle ISA 2004
December 14, 2005 ? by Stuart J. Johnston
Microsoft and Whale Communications announced a partnership that enables Whale to sell an integrated solution that combines Microsoft?s Internet Security and Acceleration (ISA) Server 2004 with the smaller firm?s Intelligent Application Gateway product.
Whale?s products are designed to reinforce the functionality of enterprise applications and software infrastructure by managing access and enabling a flexible balance between security and functionality.
The deal will provide a solution that delivers support for IPSec VPN, SSL VPN, endpoint security and application security components in a single secure appliance, according to a statement by the two companies.
?We?ve been focused on providing secure access to Exchange, but there are other applications that need security,? said Roger Pilc, CEO of Fort Lee, N.J.-based Whale. The company will begin shipping the bundled systems by the end of the year, Pilc added. Whale?s offering starts at $15,000.
Stuart J. Johnston has covered technology, especially Microsoft, since February 1988 for InfoWorld, Computerworld, Information Week, and PC World, as well as for Enterprise Developer, XML & Web Services, and .NET magazines. Contact him at stuartj1@mindspring.com. You can contact Stuart about Whale To Bundle ISA 2004 at stuartj1@mindspring.com.
by tshinder
Ran into this
interesting explanation today on Web proxy chaining errors you see when you have
third party on-box Web proxy software installed on the ISA firewall (for
example, Websense or SurfControl):
=============================
Traffic Is in a Proxy Chain Loop
Problem: You are running a third-party
proxy application on the same computer as ISA Server, with the following
settings:
| ? |
Clients make Web requests to ISA Server (port |
| ? |
ISA Server has a Web chaining rule configured, |
The client receives a 12206 error: ISA Server
detected a proxy chain loop.
Cause: ISA Server receives a Web request
on port 8080 and redirects it to port 8082. The third-party proxy application
receives the request on port 8082, and sends it to port 80 as an HTTP
request.
ISA Server intercepts the traffic on port 80 as a
transparent proxy request, and passes it to the Web Proxy filter. This causes
traffic to be directed upstream again, causing a proxy chain loop. This is
detected when ISA Server receives the request for the third time, and returns an
error.
Solution: Possible workarounds include
the following:
| ? |
The preferred workaround method (to preserve
|
||||||||
| ? |
The other workaround is to disconnect the Web |
This solution works because of the way in which ISA
Server processes traffic. Traffic arrives on a particular port, and this port
matches specific protocols. ISA Server gathers all the rules that apply to the
specific protocols, and processes all these rules up to the first deny rule. The
traffic is then passed to the filters registered for the resultant rules. The
second rule (denying access) allows port 80 traffic to pass, without going
through the filter. Note that this workaround will not work if the Web browser
on the ISA Server computer has Web Proxy settings specified. Web requests from
the browser will be blocked by the second rule.
=============================
DISCUSS THIS
POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-31-2005/m_2002001800/tm.htm
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John
Galt?**
by tshinder
If so, its likely
that you have the ISA firewall's eval version installed on your computer. The
solution is to copy the contents of the full version CD onto your hard drive and
then run the install from there. Remember to delete those files when you're
done.
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-31-2005/m_2002001800/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Are you getting
errors indicating that the Firewall Client Share and the MSDE database logging
components won't install on your ISA firewall device? If so, the problem is that
the Server Service isn't enabled on your ISA firewall. This might have been
disabled during a system hardening process by you or your ISA hardware firewall
vendor. Use the Services applet in the Administrative
Tools folder to re-enable the Service Service and give it another
try.
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-31-2005/m_2002001800/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
If so, then you've
been a bad boy :)
Why bad? Because
you didn't do a clean install of the ISA firewall on a clean OS. I bet you had
ISA 2000, a pre-RTM version of ISA 2004, or perish the thought, the old Proxy
2.0 product installed on that server at one time. My advice to you is to crater
the box, install Windows Server 2003, and then install the ISA 2004 firewall.
However, if this isn't an option for you, then try this:
|
1. |
Start Microsoft Windows |
||||||||||||||||||||||||||||||||||||||||||
|
2. |
Remove the following folder if it %programfiles%:\Microsoft ISA Server |
||||||||||||||||||||||||||||||||||||||||||
|
3. |
Locate the %WINDIR%\System32 folder,
|
||||||||||||||||||||||||||||||||||||||||||
|
4. |
Run the ISA Server 2004 Setup
|
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-31-2005/m_2002001800/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John
Galt?**
by tshinder
I've seen this one
many times on the ISA firewall mailing list, Web boards and newsgroups. But I've
never seen it in any of my deployments.
Why? Becuase I
always configure DNS correctly. Remember, you should configure the ISA firewall
with a DNS server on its internal interface only and configure
it to use an internal DNS server that can resolve both internal and external
names. Note that the internal DNS server doesn't have to resolve external names
itself, it can use another DNS server to do those duties (yes Thor, I know if
your scenarios where you don't want the internal DNS server doing external name
resolution, but that is a special case).
Once you have the
ISA firewall configured to use the internal DNS server, make sure that the ISA
firewall's name is registered in the DNS. The ISA firewall needs to be able to
resolve its own name. If not, you'll see an error indicating that the Firewall
service cannot start and that the Web Proxy Filter cannot
load.
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-31-2005/m_2002001800/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Here's a
good'in.
You have a
gigantic Web cache built up and you need to reinstall your ISA firewall. You
don't want to lose all that cached content. What to do? Try
this:
|
1. |
Before you begin the reinstallation process, |
|
2. |
Reinstall the ISA firewall |
|
3. |
Reconfigure cache settings, the same way |
|
4. |
Stop all the ISA Server services, |
|
5. |
Copy the Dir1.cdat file to |
|
6. |
Restart the ISA firewall's |
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_12-31-2005/m_2002001800/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John
Galt?**
by tshinder
There's an
outstanding thread on using OpenVPN with the ISA firewall on the ISAserver.org
Web boards. Check it out at:
http://forums.isaserver.org/SSL_OpenVPN/m_2002001540/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
I ran into a
couple of network troubleshooting issues last week and thought I should write
them down before the issues get lost in the dustbin of history. Both these
issues are related to Internet performance, and ISA firewalls. As you know the
ISA firewall is often the "sin eater" for network problems, as inexperienced
network and firewall administrator attribute Internet performance problems to
the ISA firewall without investigating issues with their own network
infrastructure. I learned long ago that that 99.98% of the time its not an ISA
firewall issue, its a networking issue that involved some other component of the
network infrastructure.
So now to my
problem. I found access to Web sites getting slower and slower over time. What I
mean by slow is that it took serveral seconds, or even minutes, for a Web site
to come up after clicking a link or clicking a button on my Internet Explorer
links bar. One big clue that I had that this was a name resolution issue was
that the browser would freeze for several seconds or longer while waiting for
the site to come up. What I specificially mean by "freeze" is that the links bar
button would stick in a "pushed in" configuration. This is a very common problem
amoung Web proxy clients configured to use the autoconfiguration script, so it
immediately clued me into that this was a DNS problem.
But where was the
DNS problem? There are lots of DNS problems! The first thing I did was check
serveral nslookups on my client machines and more importantly,
on my ISA firewalls. The nslookups work fine, but I had to rerun them serveral
times in order to get a name resolution complete, as the first few attempts
indicated a time out.
I then did a
NetMon trace on both the internal and external interface of the ISA firewall. I
found way too many DNS queries being done and long delays in DNS responses. I
mean tens of thousands of DNS querys (I traced over the course of about an hour
and used a 250MB buffer and capture filter).
OK, so there are
too many DNS queries. Now what? Why are there so many DNS queries by hosts on a
network that is primarily Firewall and Web proxy clients? As you know, Firewall
and Web proxy clients don't perform name resolution themselves and let the ISA
firewall do it for them. So the next step was to identify those hosts who were
asking for the DNS name resolution requests.
The NetMon trace
and the log files on the ISA firewall only showed the IP address of the DNS
server on my network making the DNS queries, which makes sense, since all hosts
on my network segments use a specific DNS server to resolve Internet host names.
That is to say, the internal hosts on my networks are never configured to use an
external DNS server, they always use a dedicated DNS resolver on my internal
network.
At this point I
had to answer the question "How do I figure out what host(s) are sending the DNS
queries to my internal DNS resolver". That was an easy one to answer: just do a
NetMon trace on the DNS resolver. So that's what I did.
The result was
very interesting. It showed that two of my inbound SMTP spam whacking relays
(inbound mail goes through four spam whacking/AV relays before hitting my
Exchange Server -- I don't like putting Antispam/AV software on my Exchange
Server because of the performance hit) were making thousands of requests for
MX records. Now I asked myself the question "why would these
relays make thousands of MX record requests"?
The answer to that
question was becuase the SMTP relays were trying to resolve the MX domain names
of spammers, most of which are bogus. Since the Christmas season saw a big spike
in spam coming into my network, there was a large spike in the number of MX
requests for the NDRs. This lead to thousands of pending DNS requests on my DNS
resolver and was bogging the DNS server down, which lead to delays in name
resolution for all other outbound requests to the Internet.
I "fixed" (I can't
say I solved the problem) by remove the DNS server addresses from the NICs of
the SMTP spam whacking relays. This stopped the DNS query traffic for the MX
records, but also prevents the relays from updating their AV databases. The next
problem I'll need to solve is how to more effectively handle these NDRs if at
all possible. Otherwise, I'll have to schedule a netsh scripts to run to enable
the DNS settings for a set period of time and then disable them. A definite
kludge, but its all I can think of at this time.
MORAL OF
THE STORY:
Most admins would
blame the ISA firewall for slowing down their Internet connections. They would
have been wrong, as is most often the case. Through the thoughtful use of ISA
firewall logs and Network Monitor, I was able to determine that this was a DNS
issue, where the DNS problem was located, and came up with a "fix" for the
performance issue.
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
This is great
news! I've been waiting for a couple of years for the ISA firewall team to put
together a blog, where we can get the inside dope on what's happening with the
ISA firewall, just like we can with the Windows Server and Exchange Team blogs.
We'll my wish has finally come true! Check the out the ISA Server Product Team
Blog at:
ISA Server
Product Team Blog
https://blogs.technet.com/isablog/
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htm
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Here's some good news from GFI. They have a new build of the GFI WebMon 3.0 which will catch the new WMF exploits.
You can download a trial version now, test it out, and
if you decide you don't want to buy it, you can still get coverage until
Microsoft comes out with a fix.
Check out what David Farinic from GFI has to
say:
From: David Farinic [mailto:davidfa@gfi.com]
Sent: Monday, January 02, 2006 9:03 AM
To: [ISAserver.org
Discussion List]
Subject: [isalist] RE: FYI: Hex blog: Windows WMF
Metafile Vulnerability HotFix
For WebMon3
users:
As there are more than
50 variants of this exploit in wild, we added wmf real file-type signature
checking so now you can block this filetype ?whatever? extension content type it
hides under.
However you need to
update to build 20060102 or later version:
ftp://ftp.gfisoftware.com/temp/Netmon/del/20060102/webmonitor3.exe
Handle with care as
this version is currently under testing and once proves bug free we will replace
version of WM3 on our main site.
With Kind Regards
DavidFA.
P.S: Please trust
info/email like this (about WM3 updates) only if they point to *.gfisoftware.com
or *.gfi.com domains for updates.
DISCUSS THIS POST AT:
HTH,
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Got some great
news today!
Amy Babinchak was
named ISA Server Firewall MVP today by Microsoft. Amy spends a lot of time on
the ISAServer.org messages boards and mailing list helping people with ISA
firewall problems, and she disguinshes hereself by being the foremost authority
on ISA installed on SBS. Amy also is singular in her position as the only person
activity invovled in the SBS community to contribute ISA on SBS articles to
ISAserver.org.
Congratulations
Amy!
Check out Amy's
ISA on SBS blog site at:
http://isainsbs.blogspot.com/
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htm
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Jim Harrison comes to the rescue again with cutting edge information on
how to configure the ISA firewall's HTTP Security Filter to protect against the
WMF exploit. I'm not going to go into the details of how to access the
configuration interface or how the filter works, since that's all in the book.
:)
The filter settings
are:
HTTP filter settings (you all know how to get
there).
1.
Extensions:
<choice>
Set "block
specified"
Add .wmf
Description="application/x-msmetafile"
</choice>
<choice>
Set "allow specified"
Remove
.wmf
</choice>
<notachoice>
Set "allow
all"
</notachoice>
2. Signatures:
Name=WMF-1
Description="request file type
trigger"
Type="Request URL"
Signature=".wmf"
Name=WMF-2
Description="response headers trigger"
Type="Response
Headers"
HTTP Header="content-type"
Signature="msmetafile"
Name=WMF-3
Description="response body file type trigger"
Type="Response
Body"
Signature=".wmf"
Name=WMF-4
Description="response body file header
trigger"
Type="Response Body"
Signature="184Gmg"
WMF-4 is the kewl one because all binary files
are base-64 encoded when transferred over HTTP and FTP.
WMF files usually
incorporate a predefined header value that resolves to the Base-64 signature in
this definition.
It's probably the same technique as the GFI filter, except
not as smart.
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John
Galt?**
by tshinder
Here's an Update to the ISA Firewall's HTTP
Security Filter configuration for protecting against the WMF exploits. Props to
Jim Harrison again!
Updated:
HTTP
filter settings (you all know how to get there).
1.
Extensions:
<choice>
Set "block
specified"
Add .emf
Description="application/x-msmetafile"
Add .wmf
Description="application/x-msmetafile"
</choice>
<choice>
Set "allow specified"
Remove .emf
Remove
.wmf
</choice>
<notachoice>
Set "allow
all"
</notachoice>
2. Signatures:
Name=WMF-1
Description="request file type
trigger"
Type="Request URL"
Signature=".emf"
Name=WMF-2
Description="request file type trigger"
Type="Request
URL"
Signature=".wmf"
Name=WMF-3
Description="response headers
trigger"
Type="Response Headers"
HTTP
Header="content-type"
Signature="msmetafile"
Name=WMF-4
Description="response body file type
trigger"
Type="Response Body"
Signature=".emf"
Name=WMF-5
Description="response body file type trigger"
Type="Response
Body"
Signature=".wmf"
Name=WMF-6
Description="response body file header
trigger"
Type="Response Body"
Signature="184Gmg"
WMF-6 is the kewl one because all binary files are
base-64 encoded when transferred over HTTP and FTP.
WMF files usually
incorporate a predefined header value that resolves to the Base-64 signature in
this definition.
It's probably the same technique as the GFI filter, except
not as smart.
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htm
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John
Galt?**
by tshinder
a free
service from USEast Network Services
Visit the USEast BLOG to find more news
about appliances, Microsoft, security and lots of other
subjects.
Network Engines and Ingram Micro
Enter into Distribution Agreement
Wednesday January 4,
8:56 am ET
Ingram Micro Becomes First
North American Distributor of Network Engines NS Series Security
Appliances
CANTON, Mass.--(BUSINESS WIRE)--Jan. 4, 2006--Network Engines,
Inc., (NASDAQ-NENG), today announced it has signed a North American distribution
agreement with Ingram Micro Inc. (NYSE: IM - News), the world's largest
technology distributor and a leading technology sales, marketing and logistics
company. Under the terms of the agreement, Ingram Micro will now offer its
reseller customers the entire family of Network Engines NS Series(TM) Security
Appliances.
The NS Series, powered by Microsoft? Internet Security and Acceleration
Server 2004, is a family of multifunction application security appliances
designed for small and large enterprises. NS security appliances are developed
to add "defense-in-depth" protection and provide unparalleled application-layer
filtering inside the traditional perimeter firewall.
"We are pleased to add the world's largest technology distributor to our
partner list, as Ingram Micro's market reach and customer list are second to
none in the industry," said Vince Ardizzone, director America's channel sales
for Network Engines. "This partnership announcement is also a strong endorsement
of the market's need for an appliance version of ISA Server 2004."
"Network Engines has achieved a category lead with the NS Series product line
because it provides an innovative way to help companies better manage security
threats," said Paul Bay, senior vice president, vendor management, Ingram Micro
North America. "Our clients are asking for more powerful, consolidated security
solutions. Network Engines addresses this trend by working closely with
Microsoft, to create a powerful, integrated out-of-the-box appliance. This makes
ease of deployment and management a reality for IT shops large and small."
About Ingram Micro
As a vital link in the technology value chain, Ingram Micro creates sales and
profitability opportunities for vendors and resellers through unique marketing
programs, outsourced logistics services, technical support, financial services
and product aggregation and distribution. The company serves 100 countries and
is the only global IT distributor with operations in Asia. Visit www.ingrammicro.com
Network Engines - THE Appliance Company
Network Engines appliances are designed to ease the deployment, enhance
manageability, and increase security of mission critical software applications.
Our heritage of providing technology products and services tailored
supporting to the entire lifecycle of our customers appliances has made us the
appliance partner of choice for software market leaders.
Founded in 1997, Network Engines is headquartered in Canton, Massachusetts
and trades on the NASDAQ exchange under the symbol NENG. For more information
about the Company's products and services visit: www.networkengines.com.
Safe Harbor for Forward-Looking Statements
Statements in this press release regarding Network Engines' (the "Company")
future financial performance and any other statements about Network Engines'
management's future expectations, beliefs, goals, plans or prospects constitute
forward-looking statements within the meaning of the Private Securities
Litigation Reform Act of 1995. The Company's actual results could differ
materially from those stated or implied in forward-looking statements due to a
number of factors, including those factors contained in the Company's most
recent annual report on Form 10-K for the year ended September 30, 2005 under
the section "Factors That May Affect Future Operating Results" as well as other
documents that may be filed by the Company from time to time with the Securities
and Exchange Commission. Forward-looking statements include statements regarding
the Company's expectations, beliefs, intentions or strategies regarding the
future and can be identified by forward-looking words such as "anticipate,"
"believe," "could," "estimate," "expect," "intend," "may," "should," "will," and
"would" or similar words. The Company assumes no obligations to update the
information included in this press release.
Network Engines and the Network Engines logo are trademarks of Network
Engines, Inc. All other registered and unregistered trademarks in this document
are the sole property of their respective owners.
by tshinder
a free
service from USEast Network Services
Visit the USEast BLOG to find more news
about appliances, Microsoft, security and lots of other
subjects.
January 04, 2006
08:46 AM US Eastern Timezone 
Network Engines Attains Gold Certified Partner
Status in Microsoft Partner Program; Network Engines Recognized for Innovation
and Skills in development of Microsoft Powered Appliances
CANTON,
Mass.--(BUSINESS WIRE)--Jan. 4, 2006--Network Engines, Inc. (NASDAQ:NENG), a
leading appliance partner for Microsoft security solutions, today announced it
has attained Gold Certified status in the Microsoft Partner Program with three
competencies; Independent Software Vendor (ISV)/ Software Solutions, Networking
Infrastructure Solutions and Advanced Infrastructure Solutions. As a Gold
Certified partner, Network Engines has demonstrated expertise with Microsoft
technologies and proven ability to meet customers' needs. Microsoft Gold
Certified Partners receive a rich set of benefits, including access to marketing
programs, training and support resources, giving them a competitive advantage in
the marketplace.
"We are extremely pleased to have attained Gold Certified status in the
Microsoft Partner Program, allowing us to further promote our expertise and
relationship with Microsoft to our customer base," said Mike Riley, vice
president of marketing and corporate strategy at Network Engines. "This
distinction validates the market need for NEWS, our appliance management
software subsystem, that has been developed to ease the deployment and unify
configuration and management of Microsoft Windows server powered appliances."
"Customers are looking for partner companies that can bridge the gap between
their business demands and technology capabilities. They need to trust in
someone that can act as an expert adviser for their long-term strategic
technology plans - Network Engine's ongoing development of award winning
appliance solutions clearly demonstrates such a long-term strategic commitment.
Microsoft Gold Certified Partners, which have certified expertise and direct
training and support from Microsoft, can build a positive customer experience
with our technologies," said Allison Watson, vice president of the Worldwide
Partner Sales and Marketing Group at Microsoft Corp. "Today, Microsoft
recognizes Network Engines as a new Microsoft Gold Certified Partner for
demonstrating its expertise in providing customer satisfaction with Microsoft
products and technology."
As one of the requirements for attaining Gold Certified Status, Network
Engines had to declare a Microsoft Competency. Microsoft Competencies are
designed to help differentiate a partner's capabilities with specific Microsoft
technologies to customers looking for a particular type of solution. Each
competency has a unique set of requirements and benefits, formulated to
accurately represent the specific skills and services that partners bring to the
technology industry.
The Microsoft Partner Program was launched in December 2003 and represents
Microsoft's ongoing commitment to the success of partners worldwide. The program
offers a single, integrated partnering framework that recognizes partner
expertise, rewards the total impact that partners have in the technology
marketplace, and delivers more value to help partners' businesses be successful.
Network Engines - THE Appliance Company
Network Engines appliances are designed to ease the deployment, enhance
manageability, and increase security of mission critical software applications.
Our heritage of providing technology products and services tailored
supporting to the entire lifecycle of our customers appliances has made us the
appliance partner of choice for software market leaders.
Founded in 1997, Network Engines is headquartered in Canton, Massachusetts
and trades on the NASDAQ exchange under the symbol NENG. For more information
about the Company's products and services visit: www.networkengines.com.
Safe Harbor for Forward-Looking Statements
Statements in this press release regarding Network Engines' (the "Company")
future financial performance and any other statements about Network Engines'
management's future expectations, beliefs, goals, plans or prospects constitute
forward-looking statements within the meaning of the Private Securities
Litigation Reform Act of 1995. The Company's actual results could differ
materially from those stated or implied in forward-looking statements due to a
number of factors, including those factors contained in the Company's most
recent annual report on Form 10-K for the year ended September 30, 2005 under
the section "Factors That May Affect Future Operating Results" as well as other
documents that may be filed by the Company from time to time with the Securities
and Exchange Commission. Forward-looking statements include statements regarding
the Company's expectations, beliefs, intentions or strategies regarding the
future and can be identified by forward-looking words such as "anticipate,"
"believe," "could," "estimate," "expect," "intend," "may," "should," "will," and
"would" or similar words. The Company assumes no obligations to update the
information included in this press release.
Network Engines and the Network Engines logo are trademarks of Network
Engines, Inc. All other registered and unregistered trademarks in this document
are the sole property of their respective owners.
by tshinder
Jim Harrison has
published a beta version of a script that will configure your ISA firewall to
block many of the Web based vectors for WMF exploits.
Check it out
at:
http://isatools.org/block_wmf.zip
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Just a quick note
to let you know that MS has released the update to correct the WMF situation
early. Check it out at:
http://www.microsoft.com/technet/security/bulletin/advance.mspx
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htm
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Jim Harrison has
finalized his script that configures the ISA firewall to mitigate the threat of
the WMF exploit. You can download it from:
http://isatools.org/block_wmf.zip
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htm
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Jim Harrison has finalized his script that configures the ISA firewall to mitigate the threat of the WMF exploit. You can download it from:
http://isatools.org/block_wmf.zip
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-7-2006/m_2002002194/tm.htm
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
From: USEast News Service
[mailto:NewsService@USEast.Net]
Sent: Monday, January 09, 2006 4:08
PM
To: USEast News Service
Subject: Network Engines Appoints
Gregory A. Shortell as President and CEO
a free service from USEast Network
Services
Visit the USEast BLOG to find more news
about appliances, Microsoft, security and lots of other
subjects.
Network Engines Appoints Gregory A. Shortell as President and
CEO
Former Nokia Executive and Network Security Industry
Veteran to Lead Appliance Company
Canton, MA ? January 9, 2006 ? Network Engines, Inc. (NASDAQ: NENG), a
leading provider of storage and security server appliance products and services,
today announced that Gregory A. Shortell has been appointed as president and
chief executive officer, effective immediately. Mr. Shortell is succeeding Mr.
John Curtis, who will continue with the company as vice president of OEM
business and assist in the leadership transition. Mr. Shortell was also
appointed to Network Engines? board of directors replacing Mr. Curtis.
In his role as president and CEO, Mr. Shortell is responsible for leading the
company's strategic direction while overseeing and managing day-to-day
operations. Mr. Shortell brings to Network Engines more than 20 years of
experience in executive management as well as global sales and marketing
operations. He has a proven track record of developing global indirect sales
channels and key partner relationships while increasing revenue and market share
in segments that include OEM component hardware and network security software
appliances.
Mr. Shortell joins Network Engines from Nokia where he was the Senior Vice
President, Global Sales and Marketing. During his tenure there, he was credited
with developing Nokia?s enterprise delivery network of distribution and reseller
channels. While responsible for the global sales and marketing of Nokia?s
Enterprise Businesses Group, he expanded the business from $14 million in 1997
to more than $1 billion in 2004 by building sales and services in the network
security, appliance, connectivity and mobility segments.
?Over the
past year, Network Engines has strengthened its OEM business and created a
foundation for its own branded security appliances,? said Fontaine Richardson,
lead director of Network Engines? board of directors. ?Greg?s experience in
strategic planning, sales and marketing operations, as well as appliance
industry knowledge makes him uniquely suited to lead the company into its next
phase of development. We would like to thank John Curtis for the
tremendous job he has done as CEO. The Board looks forward to working with Greg
to leverage the opportunities resident in our businesses and increase
shareholder value.?
?I am very excited to be given the opportunity to direct one of the
industry?s leading appliance companies, as I believe there is a significant
market opportunity for network appliances,? said Mr. Shortell, president and CEO
of Network Engines. ?Network Engines has a proven track record as a successful
OEM provider working with leading firms such as EMC and Nortel. Based on this
experience, we are presented with a unique opportunity to collaborate with our
partner Microsoft to bring security solutions to Microsoft business applications
and establish profitable growth for the company.?
As vice president of OEM business, John Curtis will be responsible for
strengthening and expanding relationships with existing OEM partners as well as
expanding the OEM business. ?I am very proud of the progress our company
has made over the past four years and I am excited about the opportunity to
continue to grow our OEM business,? remarked Mr. Curtis.
Prior to its purchase by Nokia in 1998, Mr. Shortell was the Managing
Director of International Operations at Ipsilon, where he established the
company?s sales, marketing and support organizations in both the EMEA and APAC
regions. Before joining Ipsilon, he served as Vice President, International at
Xyplex Corporation. While responsible for the management and development of the
International region for Xyplex, he led the corporation in growth, profitability
and sales productivity. Previously, as Vice President, International at Emulex
Corporation, he built an international operation for the company?s storage
networking solutions and significantly increased international sales over three
years. After receiving a B.S. from William Penn University and an M.B.A. from
Long Island University, Mr. Shortell completed a post graduate program with a
concentration in International Business at Oxford University, England, and
completed the Nokia Executive Management Development program at IMD in Lausanne,
Switzerland.
Network Engines - THE Appliance Company
Network Engines
appliances are designed to ease the deployment, enhance manageability, and
increase security of mission critical software applications.
Our heritage of providing technology products and services tailored
supporting to the entire lifecycle of our customers appliances has made us the
appliance partner of choice for software market leaders.
Founded in 1997, Network Engines is headquartered in Canton, Massachusetts
and trades on the NASDAQ exchange under the symbol NENG. For more
information about the Company's products and services visit: www.networkengines.com.
by tshinder
Ok - thanx to all who reported.
V1.2 is on http://isatools.org/block_wmf.zip.
I've changed the WMF-4 and -5 signatures to use "content-disposition"
instead of "blank". This is what was causing the crashes in the HTTP
Filter. Not to worry; this has been fixed in SP2, which coincidentally
is why I didn't see it.
Also, you should manually remove these filters (yes, all of them) from
any web publishing rule that is servicing RPC/HTTP traffic. It seems
that *any* filter definitions cause ISA to trash this traffic (*really*
secure, huh?).
Also, since some folks have had crashing problems, I've created a script
to get you out of trouble faster. Unblock_wmf.vbs is your panic button
and is included in the package. It completely reverts the changes
wrought by block_wmf.vbs.
Updated actions:
1. backs up your current config
2. examines Enterprise (EE) and all arrays
3. within each Enterprise policy and array, it examines all rules. If
the rule is:
- "allow"
- not "default"
- includes the Web Proxy filter
..it updates the HTTP Filter settings as:
Extensions:
If "block specified"
Add .emf
Add .wmf
If "allow specified"
Remove .emf
Remove .wmf
Signatures:
Name=WMF-1
Description=" request url '.emf' file type trigger"
Type="Request URL"
Signature=".emf"
Name=WMF-2
Description=" request url '.wmf' file type trigger"
Type="Request URL"
Signature=".wmf"
Name=WMF-3
Description=" response headers content-type trigger"
Type="Response Headers"
HTTP Header="content-type"
Signature="msmetafile"
Name=WMF-4
Description=" response header '.emf' file type trigger"
Type="Response Headers"
HTTP Header=" content-disposition "
Signature=".emf"
Name=WMF-5
Desctiption=" response header '.wmf' file type trigger"
Type="Response Headers"
HTTP Header="content-disposition"
Signature=".wmf"
Name=WMF-6
Description=" response body '.emf' file type trigger "
Type="Response Body"
Signature=".emf"
Name=WMF-7
Description=" response body '.wmf' file type trigger "
Type="Response Body"
Signature=".wmf"
Name=WMF-8
Description=" response body base-64 file header trigger "
Type="Response Body"
Signature="184Gmg"
--------------------------------------------
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
--------------------------------------------
DISCUSS THIS POST AT:
http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-1
4-2006/m_2002002974/tm.htm
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Hey folks,
I had no idea until today
how many new ISA firewall MVPs we have! Check
this out:
Amy
Babinchak -- Amy enters the ISA firewall space via SBS 2003 SP1. Amy is
the leading contributor of ISA firewall information on the SBS platform over at
www.isaserver.org
Jason Fossen -- new MVP and
he's located here in my neck of the woods -- Dallas, Texas. Jason runs the ISA
firewall scripting Web site www.isascripts.org
Moez
Mezghani -- new MVP from North Africa
Martin Pavlis
-- MVP from the Czech Republic
Alessandro Perilli
-- MVP from Italy and the genius who taught me how to support four NICs
in a VMware virtual machine :))
Meibo Zhang -- a friend
of mine from China who has a tremendous Chinese language ISA firewall site at
www.isacn.org
Hong Zhi Zhu -- another new MVP from
China, Chong Qing. He's active in the Windows IT Pro magazine web boards and has
written a number of articles on the ISA firewall
Hopefully one day all
the ISA firewall MVPs will be able to get together at the same time in the
Redmond world wide MVP conference.
Welcome them to the
club!
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-14-2006/m_2002002974/tm.htm
Thanks!
Tom
Thomas
W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP --
ISA Firewalls
**Who is John Galt?**
by tshinder
LCS-Bridge:? SIP application filter
Get the most from your Microsoft? Live Communications Server 2005 deployment with Collective Software LCS-Bridge for ISA Server 2004. Here are some of the exciting features we are building into this powerful filtering solution:
- Enable secure collaboration across the firewall:
- Transfer files
- Share applications
- Whiteboard
- Secure SIP traffic before it enters the network:
- Pre-authenticate external users with ISA
- SIP protocol analysis
- Dynamic port control
More on LCS-Bridge:
We are currently seeking customers for an exclusive closed-beta program for LCS-Bridge. If you have an existing LCS 2005 and ISA 2004 deployment and would like to help us finalize the features of our filter, please let us know. Ask about becoming a Beta customer
Want to ask us a question, recommend a feature, or chat about real-time communication scenarios? Head over to our forum and speak your mind. LCS-Bridge discussion
?
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-14-2006/m_2002002974/tm.htm
?
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
?
by tshinder
I get a good
number of questions from people asking what to do about port scan
warnings from their ISA firewalls. Its a good question, as there is a
general impression that port scans represent some sort of attack. The problem is
that the vast majority of ISA firewall admins, and especially those who use the
ISA firewall on SBS, do not understand the nature of port scans and how to
appropriately respond to them.
?
In most cases, you
can ignore port scans. Port scans are inevitiable and you will never stop them.
The good news is that you don't need to stop them. However, for the trained
observer, certain types of ports scans, done in particiular patterns, can become
"interesting" from the technical and investigational point of view.
?
The problem is
that it takes a trained eye to appreciate the "interesting" from the
"uninteresting" port scans, and the overwhelming majority of SBS admins and
consultants don't have this training. The end result is that port scan IDS
warnings from the ISA firewall generate fear, uncertainty and doubt and lead the
hapless and uninformed to disable needed services, which leads to a self-imposed
DoS secondary to a non-existant threat.
?
For this reason,
I'd encourage all ISA on SBS users to disable the port scan IDS feature in the
ISA firewall console. However, if you're interested in learning about intrusion
detection and how to separate the wheat from the chaff, then I highly recommend
the following books:
?
Network
Intrusion Detection by Stephen Northcutt http://www.amazon.com/gp/product/0735712654/qid=1137084489/sr=2-1/ref=pd_bbs_b_2_1/103-6999506-6655024?s=books&v=glance&n=283155
?
Inside
Network Perimeter Security: The Definitive Guide to Firewalls, Virtual Private
Networks (VPNs), Routers, and Intrusion Detection Systems by Stephen
Northcutt http://www.amazon.com/gp/product/0735712328/qid=1137084535/sr=1-5/ref=sr_1_5/103-6999506-6655024?s=books&v=glance&n=283155
?
The
Protocols (TCP/IP Illustrated, Volume 1) by W. Richard Stevens http://www.amazon.com/gp/product/0201633469/qid=1137084610/sr=2-1/ref=pd_bbs_b_2_1/103-6999506-6655024?s=books&v=glance&n=283155
?
Internetworking with TCP/IP Vol.1:
Principles, Protocols, and Architecture by Douglas E Comer http://www.amazon.com/gp/product/0130183806/qid=1137084682/sr=2-3/ref=pd_bbs_b_2_3/103-6999506-6655024?s=books&v=glance&n=283155
?
Once you've read
and re-read and digested and understand the contents of these books, you'll be
ready to begin your quest in interpreting IDS issues, like port scan
reports. Until then, you're better off just turning off port scan
alerts.
?
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-14-2006/m_2002002974/tm.htm
?
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
?
by tshinder
There are a number of solutions on the market
today that plug into the ISA firewall?s Web proxy filter that enable you to
block dangerous downloads and non-work related Web sites. One of the slickest
and easiest to configure and manage solutions I?ve found so far is the GFI
WebMonitor 3.0.
?
Check out the
review at http://www.isaserver.org/articles/Product-Review-GFI-WebMonitor30.html
?
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-14-2006/m_2002002974/tm.htm
?
?
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
?
by tshinder
Hey folks,
?
Here's a real
goodin'.? The WSSRA Virtual Environments for Development and
Test doc will allow you to model your network using best practices on a
virtual machine platform. Here's the official description from the MS
site:
?
Windows Server
System Reference Architecture Virtual Environments for Development and Test
(WSSRA-VE) can help large organizations and enterprises create environments for
development and testing that emulate their own production environments. The
guidance describes the architectural blueprint, planning considerations,
deployment practices, and operational considerations for creating and supporting
a virtualized instantiation of the Windows Server System Reference Architecture. It leverages the power of Virtual Server 2005 and automated
deployment and configuration tools to minimize the physical infrastructure and
logistical overhead necessary to deploy emulations of various data center
services.
Like WSSRA itself, the WSSRA-VE is intended to aid users in
their own effort to model their operational environment and condense it to a
scale that can be representative of the infrastructure integration challenges
facing developers and testers of distributed, message-based applications and IT
services, and still be inexpensive and relatively economical to build and use
throughout a large-scale IT organization.
WSSRA-VE consists of a set of guides that can be viewed here
or as part of a downloadable package. The guides are the following:
| ? |
Introduction |
| ? |
Blueprint |
| ? |
Planning Guide |
| ? |
Build Guide |
| ? |
Operations Guide |
The downloadable package also includes a WSSRA-VE Deployment
Kit that provides most of the configuration files and supporting documents used
to build instances of these virtualized environments.
Downlaod the WSSRA
VE for Dev and Test at: http://www.microsoft.com/technet/itsolutions/wssra/ve/default.mspx
?
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-14-2006/m_2002002974/tm.htm
?
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
?
by tshinder
Amy
Babinchak did some expert sleuthing for more information on how the ISA
firewall port scan IDS feature works and came up with a real beauty! The title
of the article is ISA Server Port Scan Alerts and although
Microsoft doesn't attribute the author, I think you should know that our ISA
firewall Hero -- Jim Harrison (www.isatools.org) is the author of that
article and its an article that's well worth reading, for both ISA networking
pro's and ISA/SBS consultants.
?
I guarantee you'll
come out with a better understanding of port scans.
?
Where will you
find the link to the aritcle? I could tell you here, but since Amy found the
article, I'm going to send you to her site!
?
ISA in SBS
- yes, it's secure http://isainsbs.blogspot.com/
?
?
DISCUSSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-14-2006/m_2002002974/tm.htm
?
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
?
by tshinder
Over the years there have been a number of
questions about how to configure the ISA firewall in a ?hardware? firewall?s
?DMZ?. I have to admit that this question never made much sense to me, since I
couldn?t figure out why the fledgling ISA firewall admin would want to create
such a configuration. It seemed to be a simple affair to place the ISA firewall
either in parallel or in a back to back configuration with the ?hardware?
firewall in front of the ISA firewall, allowing the ISA firewall to provide its
superior level of protection nearest to the protected resources.
?
However, I
recently participated in a thread where the fellow asking the question clearly
stated his design goals and wanted to know how to best achieve them. You can
read that thread over at http://forums.isaserver.org/Where_to_put_my_ISA_with_Netscreen%3f%3f%3f/m_2002002953/tm.htm
?
To find out my
solution, check out: http://www.isaserver.org/tutorials/Creating-Parallel-ISA-Firewall-Configuration-Netscreen-DMZ.html
?
?
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-21-2006/m_2002003855/tm.htm
?
?
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
?
by tshinder
Head's up on a
Securing SBS 2003 with ISA 2004 course being offered as part of the MS partner
program. Registration is FREE!
?
Check out Amy
Babinchak's blog over at http://isainsbs.blogspot.com/2006/01/free-securing-sbs-with-isa-training.html?for
details.
?
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-21-2006/m_2002003855/tm.htm
?
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
?
by tshinder
A connection between a computer and
the Internet increases the level of risk from malicious software and external
attackers, and as old risks are managed, new ones are discovered or created.
?
A significant factor that increases
the risks from malicious software is the tendency to give users administrative
rights on their client computers. When a user or administrator logs on with
administrative rights, any programs that they run, such as browsers, e-mail
clients, and instant messaging programs, also have administrative rights. If
these programs activate malicious software, that malicious software can install
itself, manipulate services such as antivirus programs, and even hide from the
operating system.
?
Malicious software poses numerous
threats to organizations, from intercepting a user's logon credentials with a
keystroke logger to achieving complete control over a computer or an entire
network by using a rootkit. Malicious software can cause Web sites to become
inaccessible, destroy or corrupt data, and reformat hard
disks.
?
A defense-in-depth strategy, with
overlapping layers of security, is the best way to counter these threats, and
the least-privileged user account (LUA) approach is an important part of that
defensive strategy. The LUA approach ensures that users follow the principle of
least privilege and always log on with limited user accounts. This strategy also
aims to limit the use of administrative credentials to administrators, and then
only for administrative tasks.
?
For more info see the new Applying
the Principle of Least Privilege to User Accounts on Windows XP. http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/luawinxp.mspx#ELAA
?
DISCUSS THIS POST
AT:?http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-21-2006/m_2002003855/tm.htm
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
?
by tshinder
Beginning in February 2006 ISAserver.org will
hold bi-monthly Readers? Choice polls, giving the ISAserver.org community the
opportunity to vote for the products they view as the very best in their
respective category.
?
The polls will be held on a bi-monthly basis
with?eighteen awards being announced in six different categories. Products
get awards for coming in?as the top rated product, first runner up and
second runner up.?Visitors to the site can cast their vote by selecting
their favorite product in the left-hand?bar.
Below is a list of the ISAserver.org?Readers? Choice categories and the
month that visitors can submit their votes.
- ISA Access Control - February 2006
- ISA Anti Virus - April 2006
- ISA Reporting - June 2006
- ISA Monitoring & Administration - August 2006
- ISA Content Security - October 2006
- ISA Hardware Appliances - December 2006
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-21-2006/m_2002003855/tm.htm
?
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
?
by tshinder
Do you have
problems finding answers to your ISA firewall related questions? There's a good
chance the answer to your question can be found somewhere on the Internet, but
where? The Microsoft ISA Server team posted a blog entry today with some good
tips and tricks on how to effectively navigate ISA content on the
Web.
?
Check it out on
the ISA Server Team Blog at https://blogs.technet.com/isablog/default.aspx
?
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-21-2006/m_2002003855/tm.htm
?
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
?
by tshinder
?A?free
service?from USEast Network Services?????
Visit the USEast BLOG to find more news
about appliances, Microsoft, security and lots of other
subjects.
?
| Press Release | Source: Corrent Corp. |
Corrent Launches UTM Appliance with Intelligent I/O and
Hardware-Enforced DDoS Protection
Monday January 23,
8:01 am ET
TEMPE, Ariz.--(BUSINESS WIRE)--Jan. 23, 2006--Corrent Corp., a
leading developer of hardware-accelerated security appliances, and an OEM
appliance partner for Microsoft security solutions, today announced the release
of the Corrent? SR325 security appliance, the first unified threat management
(UTM) appliance with intelligent I/O, inline VPN acceleration, and
hardware-enforced DDoS protection that is based on Microsoft Internet Security
& Acceleration (ISA) Server 2004 and Sybari Antigen software. The SR325 is
an "all-in-one" security appliance that offers comprehensive protection for
enterprise networks with security features, integration, and a level of
performance that far exceed server-based solutions.
"There is no lack of products for handling the escalating number of security
threats facing corporations each year, but deploying separate security
appliances and trying to get them to work together has created just another
impossible task for overworked IT managers," said Richard Takahashi, Corrent
president and CEO. "By combining our hardware acceleration technology with
Microsoft security software, we are able to deliver a single appliance that
offers comprehensive protection for both external and internal threats. Best of
all, because the appliance is based on Microsoft technology, it is easy to use
and integrates seamlessly with existing networks."
For businesses with significant investments in Microsoft technology, the
Corrent SR325 is a smart choice as either a gateway device for the perimeter, or
as an internal firewall to add an extra layer of defense to protect valuable
assets such as Microsoft Exchange Server or other application servers. The SR325
offers a stateful inspection and application-layer firewall, intrusion detection
and prevention, VPN, Web caching and gateway antivirus protection for SMTP
traffic.
"Our customers appreciate the wide range of options provided by the
integration of Microsoft security solutions with OEM appliance partners like
Corrent," said Marcus Schmidt, senior product manager of the Enterprise Access
& Security Products division at Microsoft Corp. "UTM appliances are
attractive to many customers because the convenience and ease of installation of
a single appliance simplifies deployment and management."
Corrent Intelligent I/O Technology
At the heart of the SR325 is an intelligent I/O subsystem consisting of three
dual-port intelligent Gigabit Ethernet cards, each with its own RISC-based
Corrent CR777 security processor and separate memory subsystem. These
intelligent I/O interfaces are capable of VPN acceleration, offloading packet
processing and using their integrated signature-matching engines to enhance
content inspection, such as virus detection. Because the I/O subsystem is
programmable, functions can be upgraded to keep pace with improvements to
Microsoft Windows Server and security software.
Capable of more than 700 Mbps in VPN throughput and more than 1.5 Gbps in
firewall throughput, the SR325 offers one of the highest levels of performance
available in a Windows-based platform. Since even a small amount of VPN traffic
can have a negative effect on firewall performance, offloading VPN processing to
dedicated processors ensures that other network traffic can be processed at peak
rates.
Defending Against DDoS Attacks
The intelligent I/O subsystem is also key to the SR325's ability to provide
superior protection against Distributed Denial-of-Service attacks. While all
firewalls offer some protection against DDoS attacks, Corrent appliances are
unique in their ability to detect and mitigate attacks in hardware at the
network interfaces.
DDoS attacks often originate from Internet worms within a corporation from
infected laptops or PCs. Since firewalls seldom restrict outgoing traffic, the
firewall can be choked by DDoS traffic, even if it is not the target of the
attack, and even if it takes no direct action to stop it. The surge in traffic
from an ongoing attack can send CPU utilization to 100 percent and prevent even
administrative access to the firewall at the same time the network becomes
bottlenecked. To prevent this situation, the intelligent network subsystems on
the SR325 monitor both traffic levels and CPU utilization, and when network
traffic exceeds a preset high-water mark, the network interfaces actively
throttle excess traffic while preserving bandwidth for secure traffic and
management control. With full access, the firewall administrator can then take
steps to identify the source of the attack, isolate infected machines and create
new rules to block the attack.
The SR325 security appliance is a 2U rack-mountable unit powered by dual 3
GHz Intel Xeon processors. It comes standard with hot-swappable RAID drives and
power supplies. The hardware is protected by a 3-year warranty and the purchase
price includes the first year of software support.
Price and Availability
Available for shipment beginning in February 2006, Corrent's SR325 is priced
starting at $13,000 MSRP. Corrent products are distributed by Ingram Micro and
sold through a network of value-added resellers worldwide. Government customers
can purchase at substantial discounts directly through GSA Advantage, the
federal purchasing system.
For more information about purchasing or about becoming a Corrent reseller,
please visit www.corrent.com.
by tshinder
Provides a technical
overview of Internet Authentication Service (IAS) accounting and describes three
ways to deploy IAS SQL Server logging with Microsoft? SQL Server? 2000 and SQL
Server Desktop Engine (MSDE 2000).
?
Download this very useful doc at http://www.microsoft.com/downloads/details.aspx?FamilyID=ab63da81-11e7-4705-8c48-24e1d0bf8bc9&DisplayLang=en
?
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-28-2006/m_2002004840/tm.htm
?
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
?
&referrer=){kind=small}
by tshinder
If you're using Outlook Web Access to allow
remote users to access your Exchange server, you don't want to expose your
network to outside attack at the same time. Here's what you need to know about
how ISA Server 2004's firewall may help.
?
Read more at: https://www.techrepublic.com.com/5100-6350_11-5996006.html?tag=sc
?
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-28-2006/m_2002004840/tm.htm
?
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
?
by tshinder
When you start using Web applications like
Outlook Web Access for Exchange, you open your network up to new avenues of
attack. Here's how you can defend your network using ISA Server
2004.
?
Learn all about it
at: https://www.techrepublic.com.com/5100-6350_11-6025401.html?tag=sc
?
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-28-2006/m_2002004840/tm.htm
?
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
?
by tshinder
A popular request in the ISA firewall community is how to provide external users access to the ISA firewall's Web proxy service. There are a number of reasons why you might want to publish the ISA firewall's Web proxy listener to allow external users access to it.
For example, suppose you have a company with a main office that uses an ISA firewall at the main office. This company has six branch offices with 10-30 computers located at each branch office. Because each branch office has so few users, corporate IT has decided to use a simple NAT device to provide Internet access for each branch office. The simple NAT devices do not support site to site VPN connections, so corporate IT cannot use site to site VPN connections to connect the branch offices to the main office and they do not want to allow remote access VPN connections from each individual host at each office because of the administrative overhead.
Learn more about the design and configuration at: https://www.techrepublic.com.com/5100-6350_11-5961196.html?tag=sc
?
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-28-2006/m_2002004840/tm.htm
?
?
HTH,
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
?
by tshinder
Check out this
paper on A Quantitative Study of Firewall Configuration Errors
at http://www.eng.tau.ac.il/~yash/computer2004.pdf
?
I found it a
fascinating read because I wasn't aware that anyone had ever tried to quantify
firewall configuration errors in a semi-controlled fashion. You should read the
paper for what it provides in terms of an approach to studying the problem, but
you should not accept the conclusions. The conclusions are invalided by the
fatally flawed definitions they use for defining a configuration
errors.
?
For example, they
include the following as configuration errors that would be patently incorrect
when deploying ISA firewalls in the correct context:
?
Allowing
NetBIOS to cross the firewall For an intranet firewall, you should
enable NetBIOS from one private segment to another. It would be a configuration
error only if you allowed NetBIOS to and from the Internet or other
significantly untrusted segment
?
Allowing
RPC Portmapper to cross the firewall This is true for most firewalls,
but not the ISA firewall. The reason for this is that the ISA firewall has a
sophisticated RPC application inspection filter that protects against RPC
exploits
?
These were the two
major errors. But overall a great read!
?
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-28-2006/m_2002004840/tm.htm
?
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
?
by tshinder
"In
the past I have read a lot about VPN users having problems accessing internal
resources which are also published on the same ISA server. I had never fully
understood those problems because I had never experienced them myself. Recently
I was lucky to see the problem with my own eyes and investigate it further. Now,
I would like to share a nice workaround to that problem...."
?
Read how
Stefaan Pouseele solves this problem at http://www.isaserver.org/tutorials/work-around-VPN-clients-split-DNS.html
?
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_01-28-2006/m_2002004840/tm.htm
?
?
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John
Galt?**
?
by tshinder
In this article we?ll move?our attention to the details of the
configuration. Enabling remote access to remote desktop Web connections sites is
fairly straightforward: you need to create a Web Publishing Rule and one or more
RDP Server Publishing Rules, depending on how many RDP servers you want to make
available to external users....
?
Check out
the detailed procedures at: http://www.isaserver.org/tutorials/Publishing-Remote-Desktop-Web-Connection-Sites-ISA-Firewall-Part2.html
?
DISCUSS THIS POST AT: http://forums.isaserver.org/Tom%26%2339%3bs_ISA_Firewall_Blog_Discussion/forumid_48/tt.htm
?
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John
Galt?**
?
by tshinder
From Jim Harrison:
Correct - all web clients do exactly that.
This is also why the logs will forever contain anonymous requests even
if all you allow are authenticated connections, because ISA will log
those denied anonymous requests.
What you can't tell from the logs is what happens after that in detail.
This requires a bit of Netmon (or Ethereal, if you swing that way)
sleuthing.
Here's the bouncing ball:
** Client, he say:
GET http://www.isaserver.org/ HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/x-shockwave-flash, application/vnd.ms-excel,
application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET
CLR 1.1.4322; InfoPath.1)
Host: www.isaserver.org
Proxy-Connection: Keep-Alive
** ISA, she say:
HTTP/1.1 407 Proxy Authentication Required ( The ISA Server requires
authorization to fulfill the request. Access to the Web Proxy service is
denied. )
Via: 1.1 HEARTOFGOLD
Proxy-Authenticate: Negotiate
Proxy-Authenticate: Kerberos
Proxy-Authenticate: NTLM
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
Pragma: no-cache
Cache-Control: no-cache
Content-Type: text/html
Content-Length: 4113
..note - the ISA in this case (as in yours, probably) logged this
request as anonymous and responded saying that it allowed three
authentication methods: Negotiate, Kerberos and NTLM. These are the
default auth methods for any ISA installation (including SBS).
** Client, he say:
GET http://www.isaserver.org/ HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/x-shockwave-flash, application/vnd.ms-excel,
application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET
CLR 1.1.4322; InfoPath.1)
Host: www.isaserver.org
Proxy-Connection: Keep-Alive
Proxy-Authorization: NTLM
TlRMTVNTUAABAAAAB7IIogQABAAzAAAACwALACgAAAAFASgKAAAAD0ZPUkRQUkVGRUNUSE9N
RQ==
Note that the client chose NTLM auth and passed the first part of the
handshake in Base-64 encoding. Not to worry, this isn't like Basic,
which is base-64 encoded plain text; this is base-64 encoded encrypted
information. ISA also logs this request as anonymous.
** ISA, she say:
HTTP/1.1 407 Proxy Authentication Required ( Access is denied. )
Via: 1.1 HEARTOFGOLD
Proxy-Authenticate: NTLM
TlRMTVNTUAACAAAACAAIADgAAAAFgomiWWcfZe6QNCsAAAAAAAAAALQAtABAAAAABQLODgAA
AA9IAE8ATQBFAAIACABIAE8ATQBFAAEAFgBIAEUAQQBSAFQATwBGAEcATwBMAEQABAAiAGgA
bwBtAGUALgBqAGEAbABvAGoAYQBzAGgALgBvAHIAZwADADoAaABlAGEAcgB0AG8AZgBnAG8A
bABkAC4AaABvAG0AZQAuAGoAYQBsAG8AagBhAHMAaAAuAG8AcgBnAAUAIgBoAG8AbQBlAC4A
agBhAGwAbwBqAGEAcwBoAC4AbwByAGcAAAAAAA==
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
Pragma: no-cache
Cache-Control: no-cache
Content-Type: text/html
Content-Length: 0
Note that ISA also passed some NTLM data back to the client - this is
part and parcel to NTLM authentication even outside of HTTP
** Client, he say:
GET http://www.isaserver.org/ HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/x-shockwave-flash, application/vnd.ms-excel,
application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;.NET
CLR 1.1.4322; InfoPath.1)
Host: www.isaserver.org
Proxy-Connection: Keep-Alive
Proxy-Authorization: NTLM
TlRMTVNTUAADAAAAGAAYAG4AAAAYABgAhgAAAAgACABIAAAACAAIAFAAAAAWABYAWAAAAAAA
AACeAAAABYKIogUBKAoAAAAPSABPAE0ARQBKAGkAbQBIAEYATwBSAEQAUABSAEUARgBFAEMA
VABunrbKxTfLxwAAAAAAAAAAAAAAAAAAAABNhP8BkKK3ZR1MXfC2h14+Q4IQaVlWRH8=
Note that the client passes the remaining part of the NTLM handshake -
if ISA can resolve the credentials passed by the client during this
process, all will be FD&H.
** ISA, she say:
HTTP/1.1 200 OK
Proxy-Connection: Keep-Alive
Connection: Keep-Alive
Content-Length: 40936
Via: 1.1 HEARTOFGOLD
Date: Fri, 27 Jan 2006 05:49:15 GMT
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: ASPSESSIONIDCCRRSRBC=EIBLFICAIMCPFBFCEKFFKBEA; path=/
Cache-control: private
This is where access is allowed (200 response).
You should note that I haven't included anything that may have been
passed in the HTTP body - it's not important to this discussion and only
makes for an unweildy thread.
--------------------------------------------
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
Thomas W Shinder, M.D.
Site: www.isaserver.org <http://www.isaserver.org/>
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7 <http://tinyurl.com/3xqb7>
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
Here's the skinny:
Details follow:
1. BW controls in ISA 2000 didn't do what everyone expected, although
they did do what they were designed to.
2. Since the BW controls in ISA 2000 were a "non-standard mechanism",
they didn't play well in the traffic control space
3. there wasn't time to build in an industry standard mechanism before
ISA 2004 shipped, so it hit the gates without anything.
4. Branch Office Updates (coming to a download site RSN) adds Diffserv;
a mature, industry-standard traffic control mechanism.
--------------------------------------------
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
--------------------------------------------
by tshinder
Here's some facinating information on why your WPAD and
autoconfiguration script might not work as you expected:
I wish it were that simple...
It depends on how the app is configured and coded.
For instance, while I was preparing my updated "ISA clients"
presentation for Black Hat (thanx for the invite, Tim!) last year, I
discovered that of all the "proxy-aware" browsers, only IE, FF and NS
actually requested *and* used the script properly.
Windows Media Player for instance, makes a wpad request as:
GET /wpad.dat?Type=WMT
Needless to say, ISA dislikes this request and tells WMP to bugger off.
The second wpad request is more proper, but its clear from the list
comments that it doesn't always play in the user-auth game properly (no
Dan; I still don't have a good answer from them).
The only way to know for certain what's happening is to:
1. Use ISA active log queries
2. Crack open your fav net cap tool
..and watch the conversation
..but you're right; if it "gets" proxy auth at all, many apps don't
"get" anything more than Basic or Digest if you're *really* lucky.
--------------------------------------------
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
--------------------------------------------
-----Original Message-----
From: Thomas W Shinder [mailto:tshinder@tacteam.net]
Sent: Sunday, January 29, 2006 8:12 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Web Client Requests
Hi Jim,
Just to make clear, IE negotiates with the Web proxy device.
In contrast, cr*pware like Realplayer and Java apps don't negotiate.
Right?
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
by tshinder
A rare lesson on the WinInet and WinHTTP interfaces by Jim Harrison:
First, we'll cover the bare basics of WinInet and WinHTTP.
You'll have to put on your developer hat for this one, though cuz I'm
about to "background" you a bunch...
First a couple of links from MSDN:
WinInet:
http://msdn.microsoft.com/library/en-us/wininet/wininet/portal.asp
WinHTTP:
http://msdn.microsoft.com/library/en-us/winhttp/http/winhttp_start_page.
asp
The most generic term that can be applied to either WinInet or WinHTTP
is "Internet library", since they both provide similar APIs for HTTP and
FTP-over-HTTP traffic. Unlike WinInet, WinHTTP has no support for
direct FTP communications; you *must* use a CERN proxy to access FTP
sites with WinHTTP; but enough of that...
You'll also hear wild rumors of other things such as XMLHTTP and
ServerXMLHTTP, but these are just wrappers around WinInet and WinHTTP,
respectively. By the same token, neither of them should be confused
with Winsock, which is another layer them and the actual TCP/IP stack.
Basically, they all look sorta like this in the "grand scheme of things"
(look out, Alexandre; more ASCII art for ya):
YourApplication.exe
| |
WinInet WinHTTP
|___________|
|
Winsock <----> Firewall Client
|
TCP/IP
|
Yadda
WinInet
- proxy configuration registry
Policy:
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet
Settings\ProxySettingsPerUser.
Default user:
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Interactive user:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
System:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Which one of the above locations is used depends on whether or not an
actual user account is in use (logged in or impersonated) and the
setting of the ProxySettingsPerUser value. If this is set to 0, then
only the System default proxy settings will be used by WinInet-based
applications. Note that the proxy configuration used by IE is the
default proxy configuration used by any other application that makes use
of WinInet *unless* they explicitly change them as described in
http://msdn.microsoft.com/library/en-us/wininet/wininet/setting_and_retr
ieving_internet_options.asp.
Unfortunately, if they only change them for the current session, there's
no way you can determine this except via netcap analysis.
WinHTTP
- proxy config registry
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp
As you can see (you can, can't you?), WinHTTP proxy configuration is
simpler than WinInet because it uses only one location. The preferred
method of configuring WinHTTP proxy is via the use of ProxyCfg.exe, a
tool written specifically to handle this task. This KB addresses an
updated version of the tool:
http://support.microsoft.com/kb/830605/en-us. WinHTTP does (almost)
understand how to use the wpad script, but with limitations as outlined
here:
http://msdn.microsoft.com/library/en-us/winhttp/http/autoproxy_issues_in
_winhttp.asp.
Using ProxyCfg, you have two options; direct or specific proxy. Note
that you don't get to specify "auto-" or "config URL". What they don't
tell you is that if there are no values stored here, WinHTTP will defer
to the WinInet settings, which is why OL2K3 usually seems to "obey" IE
configuration. If WinInet is configured for wpad, then WinHTTP will use
it, too.
WPAD
While WinHTTP and WinInet both understand how to retrieve and consume
the wpad script, the calling application can also instruct both to use
either static proxy or wpad (called "autoproxy" by WinHTTP). To answer
your "SBS wpad" question, there is nothing special about the wpad
package I built for SBS; the package merely takes advantage of the fact
that this script is available via the Web Proxy listener as well as the
auto-configuration listener. IOW, nothing will change for this package
when SP2 hits the streets.
GPO
..of course, GPO WinInet (IE) settings affect how and WinHTTP
applications behave as well...
WTF?
The biggest question in anyone's mind is less likely to be "what does
each do?", but more "how do I know when app <blah> is using one or the
other?", or "how do I control the behavior of app <blah>?", or even
"will you just get on with it?!?" This is a toughie.
Determining library usage for app <blah>:
The simplest thing I can recommend is that you learn to use
winhttptracecfg. This tool enables you to configure WinHTTP tracing so
that you can not only determine what applications or services are using
WinHTTP, you can also see what they're doing "on the wire".
Instructions for use of this tool are found here:
http://msdn.microsoft.com/library/en-us/winhttp/http/winhttptracecfg_exe
__a_trace_configuration_tool.asp. My fav cmd-line is: Winhttptracecfg
-e 1 -l c:\<TestName>. This enables WinHTTP tracing and configures it
to write to a file on C:\ with a filename starting with <TestName>, so
that I have an idea what I was about when this file was written. If
this file gets created when I run my app, then I know it's using
WinHTTP; otherwise, it's using WinInet or custom code (ew). The only
way you can see if an app is using WinInet is to either ask the
developers or sun it under a debugger and watch the system calls. By
default, WinHTTP tracing adds to the filename so that you know what
process was being logged and the date/time of the start of the logging,
as: "WinMedia-wmplayer.exe-1236.10.27.05.660-01.29.2006.LOG". Since
WinHTTP tracing creates a file "per-process", it's sometimes fun to
enable WinHTTP tracing to see what things are happening on your system
that you don't even know about. Just remember to disable it or it'll
run forever.
How do I control how app <blah> behaves?
This is the real problem isn't it? How can I make app (1) act as a web
proxy client, but app (2) act as a SecureNET client, and app (3) act as
a Firewall Client, all the while allowing app (4) to take nudie pictures
of me while my webcam is broken (did I really say that out loud)?.
Unfortunately, there isn't a "one size fits all" answer because:
- Not all applications are proxy-aware
- Not all applications allow you any form of control over their behavior
- Not all applications allow you the same level of control
- Not all applications behave the same when configured as <blah>
- Not all application developers have a freakin' clue how to write code
that behaves properly
In general follow these guidelines:
- use WinInet settings first - both WinInet and WinHTTP use these by
default
- use wpad whenever possible; if the applications can properly consume
it, you get one-stop shopping for your proxy config
- use system-level settings and disable per-user settings. This can
help keep the users from buggering themselves (unless app (4) is in
use).
- use proxycfg only when you've positively determined that the settings
you created for app (1) don't' adversely affect apps (2) through (4)
(especially (4)).
Next entry in the thread == Java app.
--------------------------------------------
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
--------------------------------------------
by tshinder
More from Jim Harrison on why Java Apps are broken (not the ISA
firewall) and issues related to horked apps that sent requests to the
Local Host Network ID:
Part II - IE, 127/8 and Java apps...
Let's break these down into their component parts.
** IE and the 127/8 problem:
IPv4 address notation is referred to as "dotted-decimal" because of the
periods separating the IP octet values. Another form of "dotted"
address notation is "fully-qualified domain name", or FQDN, which also
uses periods to separate the heirachical entites
(host.subdomain.domain.tld).
In the absence of specific instructions, IE will drop into "Rainman
mode" and treat an IP address as a "FQDN" due to the the presence of a
"." in the address. Note the caveat "in the absence of". This is where
Stefaan and I were bouncing the ball around this morning. If your next
question is "what the hell do you mean by 'specific instructions'?",
then one example might be "go take a long walk on a short pier.", but
what you're probably looking for is something more along the lines of:
1. configure the IE host machine with a proper domain suffix
..and
2. configure IE to use wpad (or config URL) and populate the web proxy
local IPs list
..or
3. configure IE to "use a proxy" and populate the "bypass" list
.. IE will be able to determine that 127/8 is indeed local and behave
properly.
All of the above will help IE sort out the difference between "remote"
and "local" and form its connection properly. As Stefaan pointed out,
IE needs to be instructed on the environment where it operates and the
above options work toward this goal.
** Java apps:
Of all things causing ISA admins to accelerate the depletion of their
mind-altering substance stores, it has to be Java apps written by
developers who either don't understand how to use the features of the
host environment or just don't care to try. In nearly all cases, it
boils down to three problems:
- the app doesn't understand how to use a CERN proxy
- the app doesn't understand how to authenticate to a CERN proxy
- the app doesn't support the chosen auth methods of the CERN proxy
admin
This is where the fun begins, because the IE configuration absolutely
affects how the "child apps" within it operate. If IE is not handling
the applet request properly, all hell breaks loose. By the same token,
if the Java applet can't authenticate using the auth set offered by the
proxy, the ice cream melts away here, too.
In general, the answer to the Java app failing to auth using anything
but basic can be solved by applying the latest Sun JRE from
http://java.sun.com/j2se/1.5.0/download.jsp.
If this doesn't help, the app is effectively broken and needs a rewrite.
In the interim, you *must either allow Basic auth or anonymous access
for this app. Tom and others have handled both of these admirably
(generally?) on isaserver.org articles...
--------------------------------------------
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
--------------------------------------------
by tshinder
From the WSUS newsgroups:
"Hi WSUS
Admins:
Just a heads up on the next new product category you will be seeing
in? WSUS
synchronization options.? Look for the addition of ISA
(Internet Security
and Acceleration Server) product family - and ISA
2004.? There will be WSUS
update support for this product in the near
term, estimated to be within the
next month.
thanks -
Bobbie
Bobbie Harder
Program Manager, WSUS
Microsoft
This
posting is provided "As Is" with no warranties, and confers no rights.
Use of
included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_02-5-2006/m_2002005670/tm.htm
HTH,
Tom
Thomas W Shinder, M.D.
Site:
www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP --
ISA Firewalls
**Who is John Galt?**
&referrer=){kind=small}
by tshinder
A security or
operating system update available through the Windows Update Site seems to
prevent Outlook 2002/2003 from starting. You won't notice anything until you
restart your computer. I've been trying to figure out which fix broke Outlook,
but you don't have the option of removing the fixes in the
Add/Remove Programs applet.
?
If you run into
the same problem, make sure that you send the error information to Microsoft.
Even better, you should call PSS and demand they do something about
this.
?
DISCUSS
THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_02-5-2006/m_2002005670/tm.htm
?
HTH,
Tom
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
?
by tshinder
Jason Fossen, ISA
firewall MVP, has created a great script based on Stefaan Pouseele's article on
controlling DNS settings for VPN clients connecting to networks with a well
designed split DNS infrastructure. Check it out!?
| J.F.
Starting Member ? Posts: 29 Status: offline |
Great article!? This could drive an admin insane! I borrowed the article's idea Thanks for the tip! ?? Cheers, |
?
HTH,
Tom
?
DISCUSS THIS POST AT: http://forums.isaserver.org/Roll_up_discussion_link_for_posts_up_to_02-5-2006/m_2002005670/tm.htm
?
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA
Firewalls
Thomas W Shinder,
M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
?
Trending After Hours posts
Sort by Trending
0 helpful
2 replies
0 helpful
10 replies
0 helpful
3 replies
Discussion
Hello everyone
0 helpful
3 replies
Discussion Locked
Designing Websites for Clear Mobile Viewing
0 helpful
1 reply