Sponsored by: Aspelle & GFi
Software Ltd.
ISAserver.org Newsletter
January, 2003
In this issue:
Welcome to the Isaserver.org newsletter! Each month we will
bring you interesting and helpful information on ISA Server.
We want to know what all *you* are interested in hearing about.
Please send your suggestions for future newsletter content to:
tshinder@isaserver.org
Dissatisfied with the limitations and expense of
remote access technologies?
Aspelle's award-winning platform, Aspelle Everywhere,
manages and delivers secure, client-less access to corporate
applications, including Web, Unix, Windows and legacy
systems, over the Internet. Tightly integrated with
proven security standards and Microsoft technologies,
such as ISA server, Aspelle Everywhere is easy to implement
and rapidly adapts to a company's unique security concerns.
Experience a FREE demo: http://www.aspelle.com/info
|
1. Site Updates
By Stephen Chetcuti
The last few weeks saw the launch of ISA Server Feature Pack
1, which Tom covers in detail below, and GFI's freeware
WebMonitor for ISA Server, a handy tool that allows you
to monitor active ISA Server connections in real time.
If you still haven't snapped up Tom's new ISA Server book,
be sure to take advantage of Amazon.com's 30% discount and
purchase
today!
Best Regards,
Stephen Chetcuti
2. Thomas Shinder's New ISA Server Book is
Now Available!
|
By Thomas W Shinder
ISA Server and Beyond is now available! ! We've included
tons of stuff on DMZs, firewall chaining, hierarchical
Web caching (Web Proxy chaining), SSL bridging, SSL
publishing, OWA, Secure IMAP4/SMTP/POP3 publishing,
and publishing services on the ISA Server itself! Most
of this stuff isn't described anywhere else. If you're
ready to take ISA Server 2000 to the next level, then
this is a book you must have.
Click
here to pre-order from Amazon.com today!
|
Click
here to Order your
copy today
|
Downloads content checking & anti-virus for ISA
Server with GFI DownloadSecurity!
GFI DownloadSecurity for ISA Server enables you to
assert control over what files your users download from
HTTP & FTP sites. Downloaded files are content checked
for viruses, malicious content and objectionable material,
and can be quarantined based on file type and which
user downloaded them. GFI DownloadSecurity handles the
security risk of file downloads without resorting to
blocking all file downloads at firewall level! Blocking
of file downloads is an unpopular policy, and results
in your having to temporarily open ports/file types
for users, resulting in additional administration and
potential security holes.
Click
here to download your free trial!
|
3. ISA Server Feature Pack 1 Released
ISA Server Feature
Pack 1 Released
Thomas W Shinder,
M.D., etc.
Its hard to believe that ISA Server 2000
is almost two years old. Its seems like only yesterday when
ISA Server first hit the scene. We’ve learned a lot about
ISA Server since that first day, and we’re still learning
more. Probably the best lesson we’ve learned is that ISA Server
is a secure and stable firewall that’s the ideal network perimeter
security solution for any Microsoft network.
But security isn’t the whole story. A security
device has to be easy to configure. Regardless of operating
system or server service, the most common reason for a break
down in security is misconfiguration. Any Microsoft savvy
network admin will find ISA Server easy to work with, as it
incorporates the familiar MMC interface and have Wizards that
guide you through almost every configuration option. While
I consider ISA Server the easiest firewall on the market to
configure, you can always make it easier. And while ISA Server
has proven to be virtually impenetrable, you can always make
things more secure.
This is where ISA Server Feature Pack 1 (FP1)
comes in. FP1 takes many of the features we already like about
ISA Server and makes them better. In addition to making existing
feature better, FP1 adds some new compelling capabilities
to ISA Server which makes FP1 a must have for any ISA Server
administrator.
Improved SMTP Filter
ISA Server comes with the SMTP filter right
out of the box. The SMTP filter is an application filter that
examines SMTP messages and makes sure that commands sent to
your SMTP server do not exceed a preconfigured length. This
helps prevent buffer overflow attacks. The SMTP filter can
also be configured to work with the SMTP Message Screener.
The Message Screener is a spam control mechanism that can
block messages based on attachment characteristics, source
email address or email domain, or keywords in the subject
line or body.
One of the drawbacks of the original SMTP
filter was that it didn’t support authentication with published
SMTP servers. If you wanted to authenticate with a published
SMTP server, then you needed to disable the SMTP filter. The
new and improved SMTP filter now allows you to send credentials
through to a published SMTP server even when the filter is
enabled. This allows you to publish a secure SMTP server that
you external users can send SMTP messages too. The new SMTP
filter also sports better performance characteristics and
is much less likely to bog down your ISA Server if you choose
to run the Message Screener on the ISA Sever itself.
Delegation of Basic Authentication Credentials
ISA Server allows you to configure Web Publishing
Rules that require authentication before the request reaches
the Web server. This is a nicely security feature since unauthenticated
users are stopped at the Incoming Web Requests listener. However,
one of the drawbacks of authenticating at the ISA Server was
that you couldn’t enforce authentication at the Web server.
You had to choose between authenticating with the Web server
or the ISA Server.
ISA Server Feature Pack 1 changes all of
this. Now you can create a Web Publishing Rule and limits
access to authenticated users. If the users send Basic authentication
credentials to the Incoming Web Requests listener, then ISA
Server can take those credentials and forward them to the
Web Server when then Web server challenges the Web Proxy service
for authentication. The Web Proxy service forwards the credentials
to the Web server and the user gains access to the Web server.
This provides for “single sign on” and allows you to support
authentication at the ISA Server and at the Web server.
Delegation of Basic Credentials is great,
but keep in mind that Basic authentication is by its very
nature insecure. When you use this feature, make sure you
configure the Incoming Web Requests listener to force SSL
for the connection over the public network.
New Outlook Web Access Wizard
One of the most common questions we see on
the ISAserver.org message boards and mailing list is how to
publish Outlook Web Access. FP1 includes a new OWA Wizard
that takes care of many of the configuration steps you would
otherwise have to handle manually. The Wizard creates the
Destination Sets, binds certificates to the listener, and
creates the Web Publishing Rule. I like this Wizard because
it collects several configuration interfaces into a single
easy to use Wizard.
The OWA Wizard does more than walk you through
the basic ISA Server configuration for publishing your OWA
sites. It also makes the ISA Server capable of fixing problems
related to SSL publishing. If you’ve ever tried to publish
an OWA site using SSL to HTTP bridging, you’ve probably had
some problems along the way. The OWA Wizard makes some registry
changes and allows the ISA Server to be translate the HTTP
responses send by the OWA server to HTTPS links.
URLScan 2.5 for ISA Server
You probably have used URLScan to protect
your Web servers. URLScan is an ISAPI plug in that allows
servers to examine the integrity of the HTTP request before
allowing it to go through. Many people have asked for a version
of URLScan that works with ISA Server. URLScan 2.5 installs
on ISA Server and examines all the HTTP requests coming in
for all Web Publishing Rules. When you have URLScan installed
on the ISA Server, the HTTP requests are examined before they
ever get to the internal Web server, thus improving security
on your Web servers many fold. URLScan configuration works
the same way as it does on Web servers: you make changes to
the URLScan.ini file.
Link Translator
The Link Translation feature is an interesting
one. It’s something I never thought about needing, but there
must have been a groundswell of support that led to the development
of this feature. The Link Translator allows you to publish
Web sites that have embedded “hard links” to internal resources
that are located on the internal network. For example, the
Web site or application has a link for http://server/. External users can’t
use that reference, but the Link Translator can be configured
with a dictionary that converts http://server/ to http://www.server.net/, which
is accessible from the Internet.
Another interesting feature of the Link Translator
is that you can use it to manipulate the protocols used in
a bridging situation. For example, if an external client makes
a request using SSL to the ISA Server, and the bridging is
from SSL to HTTP, absolute links in the response body that
contain HTTP in them can be converted to HTTPS and insure
that the communications work between the Web server and the
external network client.
I’m definitely going to have to spend some
time with the Link Translator. I see a lot of potential for
this tool and I’ll keep you in “on the know” with regular
article updates over at http://www.isaserver.org/.
Improved RPC Filter
Perhaps the most compelling reason to use
ISA Server instead of another firewall is the ability to easily
publish an internal Exchange Server so that external Outlook
MAPI clients can connect to that server. Exchange RPC publishing
allows you to create a complete mail server publishing solution
with a single rule. You don’t need to monkey around with SMTP,
POP3 or IMAP4 if your clients all use “big Outlook” (Outlook
2002/2002).
If there was a drawback to Exchange RPC publishing,
it would have been that there was no way you could force your
external network clients to use encryption. The users had
the option to use, or not use, and encrypted RPC link. The
new FP1 RPC Filter allows you to force your external Outlook
Clients to use encryption. When you force encryption, external
network clients not using encryption will not be able to connect
to the published Exchange Server.
Another big plus of the new RPC Filter is
that it supports outbound access to external Exchange Servers.
This configuration had been problematic because you would
have to create a Protocol Rule that requires secondary connections
and then configure the clients as Firewall clients. With the
new RPC Filter, even the lowly and underpowered SecureNAT
client can connect to external Exchange Servers through the
ISA Server.
Conclusion
Feature Pack 1 delivers a bevy of must-have
features. The improvements in the SMTP and RPC filters make
it almost mandatory that you install FP1. Other features,
such as Link Translation and URLScan have a place in many
environments too. I’ve installed the feature pack on over
a dozen machines so far, and haven’t found any adverse effects.
Web and Server Publishing Rules work better, the VPNs work
as they always have, and outbound access is improved because
now the SecureNAT clients can access external Exchange Servers.
Bottom line: get ISA Server Feature Pack 1 and install it
now! You can find it at http://www.microsoft.com/downloads/details.aspx?FamilyID=2f92b02c-ac49-44df-af6c-5be084b345f9&DisplayLang=en.
Dissatisfied with the limitations and expense of
remote access technologies?
Aspelle's award-winning platform, Aspelle Everywhere,
manages and delivers secure, client-less access to corporate
applications, including Web, Unix, Windows and legacy
systems, over the Internet. Tightly integrated with
proven security standards and Microsoft technologies,
such as ISA server, Aspelle Everywhere is easy to implement
and rapidly adapts to a company's unique security concerns.
Experience a FREE demo: http://www.aspelle.com/info
|
4. ISAServer.org Learning Zone articles of
Interest
We have a great group of articles in the Learning Zone that
will help you get a handle on your most difficult configuration
issues. Here are just a few of the newer and more interesting
articles:
5. Q Articles of the Month
Here are some interesting and useful ISA Server related Q articles
posted by Microsoft in the last month:
6. Post of the Month!
Ever wonder about some of those cryptic status codes that appear
in the ISA Server service log files? Me too! Here's some helpful
advice from Alex Polak:
The status code, which appears in the ISA log entry, comes
from one of the following sources
1. (most common) - actual HTTP code returned by a web server
(e.g. 200, 304 etc.)
2. ISA web proxy event code. You can find a list of those
in the ISA.CHM Help file under Troubleshooting-Additional
Resources -> Event Messages -> Web Proxy
service event messages
The response received by a client browser, will contain
the corresponding HTTP code
(such as "407 Proxy Authorization Required", "414 URL too
long" etc.) while the log will list the exact error code
(e.g. 12209, 12215 etc.).
Note, that in case of 12215 error, you will probably need
to use the Search tab on the CHM document, since
the link to it from the page I've referenced above, seems
to be missing.
3. Other errors - usually caused by an unexpected condition.
'64' is an example of such an error; this is the Windows
error code meaning "The specified network name is no longer
available. " (Editor's Note: open a command prompt and
type net helpmsg 64 and you'll see a description
of the error. --Tom.)
This was apparently caused by faulty client/browser or server
software, which unexpectedly terminated the connection to
the ISA server in the middle of the session.
The '995' code also belongs to this last group (Editor's
Note: 995 is the I/O operation has been aborted because
of either a thread exit or an application request error.
--Tom.)
--
Alex Polak Microsoft ISA Server Product Team This posting
is provided "AS IS" and includes no warranties, and confers
no rights.
Downloads content checking & anti-virus for ISA
Server with GFI DownloadSecurity!
GFI DownloadSecurity for ISA Server enables you to
assert control over what files your users download from
HTTP & FTP sites. Downloaded files are content checked
for viruses, malicious content and objectionable material,
and can be quarantined based on file type and which
user downloaded them. GFI DownloadSecurity handles the
security risk of file downloads without resorting to
blocking all file downloads at firewall level! Blocking
of file downloads is an unpopular policy, and results
in your having to temporarily open ports/file types
for users, resulting in additional administration and
potential security holes.
Click
here to download your free trial!
|
7. ISA Server Link of the Month
Sizing and tuning is key to a smooth running server of any kind.
This is especially true of a caching firewall that services
thousands of user requests per minute. When performance is lagging,
should you upgrade the processor? add memory? create an array?
use RAID? edit the Registry? Stop guessing and find out for
sure. Microsoft has released an article entitled ISA Server
Performance Best Practices and its a goodie! A definite "must-read".
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/prodtech/ISA/ISAPrfBP.asp
8. Ask Dr. Tom
QUESTION: I've been trying to get an understanding of
ISA Server for about a year now. I guess some people are denser
then others, it's been a struggle. I am in the process of setting
up a lab in order to migrate from Proxy Serve to ISA Serve.
The Proxy Server had packet filters defined for DNS and when
I migrated the lab system to ISA server the packet filters migrated
as well, which I expected. I disabled the DNS packet filters
and followed your instructions on how to publish a DNS server.
In event viewer I got an error that port 53 was in use. Do you
have any suggestions where the port may be getting bound to
the external network card? Also if you would, please point me
to where I can get some information on how to setup MX records
on an external DNS server. I can't seem to get the proper response
form nslookup that identifies the mail servers.
ANSWER: I typically suggest removing the DNS server from
the ISA Server, but there are times when you might want to do
this, or when you have to do this. There are two circumstances
where I see a DNS server on the ISA Server to be a good thing:
when the DNS server is configured as a caching only server,
or if you’re experiencing problems with DNS server publishing
because of pending name resolution operations (you’ll see a
flood of UDP 137 packets in the packet filter log if you have
the latter problem), then you can configure the DNS server as
a secondary for your public DNS servers.
The caching only DNS server on the ISA Server is a good option
because you can configure your internal network DNS resolvers
to use this server as a forwarder. You can then configure the
caching only server to use your ISP’s DNS server as a forwarder.
This protects your internal network DNS server from direct contact
with Internet servers, and it also limits your caching only
server’s exposure to only the ISP’s DNS server.
The other situation where you would want to put a DNS server
on the ISA Server comes courtesy of Jim Harrison. In this case,
you configure your public DNS zones on internal DNS servers
and then configure the DNS server on the ISA Server to be a
secondary for these zones. This seems to circumvent problems
some ISA Server admins experience when publishing DNS servers.
Some things to keep in mind when running a DNS server on the
ISA Server itself. First, make sure that you configure the DNS
server to listen on the appropriate interface. If it’s a caching
only server, it should listen only on the internal interface.
If it’s a secondary for your public zones, then configure it
to listen only on the external interface. There is a default
DNS packet filter pre-configured on the ISA Server and you should
leave that intact. If you are running a secondary on the ISA
Server, then you need to configure packet filters that will
allow inbound access to UDP 53 and perhaps TCP 53, depending
on whether you want to support external IIS 5.0 MX record queries.
As for creating MX records, all you need to do is create a Host
(A) record and then create a Mail Exchange (MX) record using
the A record. You can set preference levels for the MX record,
with the low value being the preferred mail server. If the preferred
server is not available, SMTP servers will send to the next
favored server based on the preference value.
QUESTION: I read your article on "ISA Server DMZ Scenarios",
and have a question for you. I generally have worked with firewalls
that are not ISA (Checkpoint, PIX, etc). Firewalls with 3 or
more NICs and a DMZ or multiple DMZ's are used a lot. In your
article you state that the DMZ must have public IP addresses.
Is this an ISA thing? In practice, the firewalls I have dealt
with have had a minimum of 3 zones (internal, external, DMZ)
and quite often more zones for specialized secure connectivity.
These zones have always been private IP addresses, most of these
techniques and setups have been approved by the vendor (Checkpoint,
Cisco) and then validated by outside consulting (PWC, IBM, Metagroup,
etc). Is the issue that ISA still does not do what the other
firewalls can do, and that is why it cannot support these configurations?
Looking through some of ISA it seems that there is a lot of
great work done in making it a neat product. I got your ISA
book, and it is great!
ANSWER: You do need to use public addresses in the conventional
trihomed DMZ configuration. The reason for this is that ISA
Server sees the world in terms of a trusted address space (LAT
hosts) and an untrusted address space. ISA Server policies and
enforced for communications between trusted and untrusted hosts
but not between trusted hosts. You can use private addresses
in the DMZ segment, but if that segment isn’t on the LAT, the
ISA Server won’t apply policy and will only route packets between
that segment and the Internet. This obviously won’t work. You
can put the DMZ host addresses in the LAT, but then the ISA
Server won’t apply policy to packets moving between the LAT
segments. You can get control over packet movement between the
LAT segments directly connected to the ISA Server by using RRAS
packet filters and IPSec polices. RRAS packet filters and IPSec
policies work nicely together, because not all operating systems
support IPSec policies. I cover the details of configuring LAT-based
DMZ segments in ISA
Server and Beyond. Lastly, thanks for getting the book!
Dissatisfied with the limitations and expense of
remote access technologies?
Aspelle's award-winning platform, Aspelle Everywhere,
manages and delivers secure, client-less access to corporate
applications, including Web, Unix, Windows and legacy
systems, over the Internet. Tightly integrated with
proven security standards and Microsoft technologies,
such as ISA server, Aspelle Everywhere is easy to implement
and rapidly adapts to a company's unique security concerns.
Experience a FREE demo: http://www.aspelle.com/info
|
|
