The #1 unofficial ISA Server resource site

ISAserver.org Newsletter of July 2004

Sponsored by: Rainfinity
ISAserver.org Newsletter
July, 2004

In this issue: Welcome to the ISAserver.org newsletter! Each month we will bring you interesting and helpful information on ISA Server. We want to know what all *you* are interested in hearing about. Please send your suggestions for future newsletter content to: tshinder@isaserver.org

ISA Web Seminar--Deliver High Availability for ALL your Network Resources. Register Today!

You are invited to attend this web seminar and learn how RainConnect and RainWall can offer ISA Server customers a highly available, integrated Internet and firewall platform that ensures simplification of distributed management while maximizing security and Internet resources. Do not miss this opportunity.

Register today @ http://www.rainfinity.com/isawebseminar



1. DMZ Networking with ISA 2004 Firewalls

By Dr. Thomas W Shinder

One of the big improvements ISA Server 2004 firewalls bring to the table is its new multinetworking feature set. Multinetworking allows the ISA Server 2004 firewall to perform the following:
  • Apply Firewall Policy to ALL connections made through the ISA Server 2004 firewall
  • Apply stateful filtering and stateful application layer inspection on all connections made through the ISA Server 2004 firewall
  • Control inbound and outbound access through the ISA Server 2004 firewall based on source and destination networks
  • Create DMZ segments representing different security zones and tightly control access between these security zones with each other and with the corporate Internet network
  • Apply the ISA Server 2004 firewall's strong stateful filtering and stateful application layer inspection to VPN client connections. This means you won't have to worry about your VPN clients introducing exploits like Blaster into your network.
The ISA Server 2004 firewall completely changes the playing field when it comes to DMZ networking. With ISA Server 2000 firewalls, you could only create two types of DMZs: a public address DMZ that applied stateful filtering to the connections between the public address DMZ and the Internet (providing a relatively low level of security, similar to what you would see with a PIX), or a LAT-based pseudo DMZ, where the ISA Server 2000 firewall's firewall policy would control traffic moving between the pseudo DMZ and the Internet, but requiring the use of RRAS packet filters to control traffic moving between the pseudo DMZ and the Internal network.

With ISA Server 2004 firewalls, firewall policy is applied to all connections made through the ISA firewall. You don't have to mess around with packet filters or depend on the very basic level of security provided by stateful filtering. Instead, the ISA Server 2004 firewall applies both stateful filtering and stateful application layer inspection to all connections made through the ISA Server 2004 firewall.

This is significant especially to Exchange Server organizations because it allows you to use a single ISA Server 2004 firewall to create multiple security zones. For example, lets look at the security zones you might create for a Front-end/Back-end Exchange Server configuration:
  • One security zone represents the Internal network. The Internal network contains the Active Directory domains hosting your corporate user accounts. One key aspect of the Internal network security zone is that there must be no Internet facing servers on the Internal network.
  • An authenticated access-only security zone. This security zone is separate from the Internal network security zone because there are Internet facing servers on this network. For example, the Front-end Exchange Server is placed in this security zone. While this might be considered a DMZ segment, I would call it a "perimeter network" segment because only secure authenticated connections are allowed to Internet facing machines on this network. No anonymous connections are ever made to servers located on this perimeter network segment
  • The true "DMZ" segment. This segment allows anonymous connections to Internet facing servers. For example, you would place your public access Web servers, FTP servers and inbound SMTP relays on this segment. All these resources allow anonymous access and this segment is the one most likely to be successfully attacked, because anonymous connections are allowed. ISA Server 2004 firewall policies controlling access to this segment, and the host based security on servers in this segment, are focused on providing the maximum protection against attacks from unauthenticated users.
A single ISA Server 2004 firewall can control access between each of these networks. For example, you could place four network interface cards on the ISA Server 2004 firewall and use ISA Server 2004 firewall policies to control access between each of the following networks:
  • Internal Networks behind a NIC named Internal
  • Perimeter Network, containing the Front-end Exchange Server is behind a NIC called Perimeter
  • Public access DMZ network behind a NIC named DMZ
  • The ISA Server 2004 firewall connects to the Internet using a NIC named External
This is the ideal configuration for the front-end/back-end Exchange Sever configuration. You remove the front-end Exchange Server from the public access network and the Internal network. This protects the front-end Exchange Server from attacks made by anonymous users and protects the Internal network from the risks inherent to all Internet facing servers.

The front-end/back-end Exchange Server configuration is just one example of how you can leverage the ISA Server 2004 firewall's new multinetworking feature set. Keep a lookout for a detailed "how to" doc on www.isaserver.org on how to made the scenario discussed here work!

Editor's Note:
The Microsoft ISA firewall team wants to know what you think should be included in future feature packs and versions of ISA Server firewalls. Send me a note at tshinder@isaserver.org and I'll do everything I can to make sure your message gets to them loud and clear. Thanks! -Tom.

2. Tom and Deb Shinder's Configuring ISA Server 2004 - Pre-order Today!

By Thomas W Shinder

Tom and Deb Shinder's best selling books on ISA Server 2000 were the "ISA Server Bibles" for thousands of ISA Server 2000 network administrators. Tom and Deb Shinder are preparing for you their next ISA Server book, Configuring ISA Server 2004. This book leverages the over two years of pre-release experience Tom and Deb have had with ISA Server 2004, from pre-alpha to RTM and all the versions and builds in between. They've logging literally 1000's of flight hours with ISA Server 2004 and they'll be sharing the Good, the Great, the Bad and the Ugly of ISA Server 2004 with their no holds barred coverage of Microsoft's new one of a kind application layer inspection firewall.

While the ISA Server 2000 books were good, Configuring ISA Server 2004 is going to be even better. Tom and Deb bring their unique "insider's perspective" to provide you with information that isn't and won't be available anywhere else! Pre-order your copy of Configuring ISA Server 2004 by clicking the link. You'll be glad you did.


Click here to Order your
copy today

ISA Web Seminar--Deliver High Availability for ALL your Network Resources. Register Today!

You are invited to attend this web seminar and learn how RainConnect and RainWall can offer ISA Server customers a highly available, integrated Internet and firewall platform that ensures simplification of distributed management while maximizing security and Internet resources. Do not miss this opportunity.

Register today @ http://www.rainfinity.com/isawebseminar



3. ISAserver.org Learning Zone articles of Interest


We have a great group of articles in the Learning Zone that will help you get a handle on your most difficult configuration issues. Here are just a few of the newer and more interesting articles:

4. KB Articles of the Month


Here are some interesting and useful ISA Server related Q articles posted by Microsoft in the last month:

5. Post of the Month


Are you working with third-party email servers and having problems with certificate assignments? Here's a solution to a problem using Kerio's Webmail Server and importing the SSL certificate to the ISA firewall computer provided by Jeremy Saunders:
"In cases where Customers can't justify MS Exchange CALS for their employees, we deploy Kerio (www.kerio.com). Kerio's webmail server is an Apache (Open SSL) Server.

We chose Kerio, as it's the only POP3 messaging system that uses Active Directory.

Using a Windows 2003 Enterprise CA, I worked out how to generate a new certificate request, Issue it from the Windows 2003 Certificate Server, and then import the signed certificate into the Apache web server.

So far so good...This works perfectly from internal systems.

Now, to be able to publish it through ISA, I need to import the signed Certificate into the Personal Store of the Local Computer (ISA Server).

I've installed an X.509 certificate from a .cer file into the Personal Certificate Store of the Local Computer. This works perfectly, accept for when I check the properties of the certificate I don't get the message that "You have a private key that corresponds to this certificate.", and therefore this certificate is not visible when adding it to the Incoming listener on ISA.

I have the Private Key (.key) file, that I would like to import/associate with this certificate. Does anyone know how to do this?

Unfortunately because this application is using an Apache (Open SSL) server, I don't have the luxury of generating a .pfx file, as you do with IIS, nor do I have the option of sending the request immediately to an on-line authority.

After downloading a copy of the OpenSSL Toolkit from either of these sites...
http://www.kerio.com/dwn/kms/sslcert.zip
http://www.shininglightpro.com/products/x86/OpenSSL/official/OpenSSL.exe

I was then able to run the following command to create the PKCS #12 file.

openssl pkcs12 -export -in webmail.cer -inkey webmail.key -out webmail.p12

Whilst researching I came across these two URL's that may be of use to someone that reads this post in the future.
http://support.ipswitch.com/kb/IM-20030415-DM01.htm
http://www.dylanbeattie.net/docs/openssl_iis_ssl_howto.html

It now works perfectly."
Thanks Jeremy!

ISA Web Seminar--Deliver High Availability for ALL your Network Resources. Register Today!

You are invited to attend this web seminar and learn how RainConnect and RainWall can offer ISA Server customers a highly available, integrated Internet and firewall platform that ensures simplification of distributed management while maximizing security and Internet resources. Do not miss this opportunity.

Register today @ http://www.rainfinity.com/isawebseminar



6. ISA Server Links of the Month


It's what everyone has been waiting for! That's right, you guessed it. ISA Server 2000 Service Pack 2 is now available for download:

http://www.microsoft.com/downloads/details.aspx?FamilyID=c8d3d98b-1cd4-406a-a04a-2aa2547d09a3&DisplayLang=en

Are you struggling with your ISA 2004 firewall beta 2 software? Maybe an updated Help file will do the trick. Download it here:

http://download.microsoft.com/download/5/a/e/5ae686f4-c4a6-4213-bc50-abc46b0714dc/isa.chm

Web and Server Publishing Rules are always good for generating troubleshooting questions. Check out the Publishing FAQ and see if the answer to your publishing woes lies within:

http://www.microsoft.com/technet/prodtechnol/isa/maintain/isafaqpb.mspx

Here's two great White Papers written by your's truly! One provides the fact ammo you need to get the boss to pony up the dollars for an ISA firewall to protect your Exchange Servers and the other provides valuable info on how to set up your network perimeters. Check the right side of the page:

http://www.networkengines.com/sol/firewallforexchange.aspx

As always, there's lot's more, but you'll have to wait for next month ;)

7. Ask Dr. Tom


QUESTION: Hi Tom! I'm testing out the new ISA 2004 firewall and I have a question. I want to publish OWA, OMA, ActiveSync and RPC over HTTP using the ISA 2004 firewall. I also want to use forms-based authentication on the ISA firewall. My OWA works, but none of the other publishing rules work. I have one IP address on my ISA firewall. Thanks in advance for any help you can give on this! --Dave S.

ANSWER: This is a common issue encountered by ISA firewall admins who only have a single IP address bound to the external interface of the ISA 2004 firewall. When using the ISA 2004 firewall's forms- based authentication feature, the ISA firewall itself generates the form instead of the Exchange Server. You can see this working in your own configuration when the form appears to the users and allows them to log on via the form. Your problems begin with the OMA, ActiveSync and RPC over HTTP publishing.

The reason why your OMA, ActiveSync and RPC over HTTP publishing rules fail is that the OMA, ActiveSync and RPC over HTTP clients cannot respond to the form. These clients send credentials to the ISA firewall, but not in a format that would automatically "fill in the form". There are two solutions to this problem. The best solution is to obtain another IP address and bind that to the external interface of the ISA firewall. However, if this is not an option, you can use the approach outlined in the article ISA Server 2004: Supporting Both Basic and Forms-based Authentication with a Single External IP Address and Web Listener at http://www.isaserver.org/tutorials/2004pubowamobile.html. Make sure to read the text closely and understand what it is that we're trying to accomplish. Once you understand the principles behind the procedure, you'll be able to customize it for your own environment.

ISA Web Seminar--Deliver High Availability for ALL your Network Resources. Register Today!

You are invited to attend this web seminar and learn how RainConnect and RainWall can offer ISA Server customers a highly available, integrated Internet and firewall platform that ensures simplification of distributed management while maximizing security and Internet resources. Do not miss this opportunity.

Register today @ http://www.rainfinity.com/isawebseminar


Visit the Subscription Management section to unsubscribe.
ISAserver.org is in no way affiliated with Microsoft Corp.
For sponsorship information, contact us at advertising@isaserver.org.
Copyright © ISAserver.org 2004. All rights reserved.