Securing the Network Perimeter with ISA Server 2004 Ravi Sankar IT Professional Evangelist Microsoft

Session Prerequisites Hands-on experience with Microsoft Windows Server Basic understanding of internal and remote network security fundamentals Experience implementing network resources such as Web servers, FTP servers, and computers running Microsoft Exchange Server Level 200

Session Overview Introduction to ISA Server 2004 Securing Access to Internal Servers Implementing Application and Web Filtering Securing Access to Exchange Server Virtual Private Networking with ISA Server 2004

Introduction to ISA Server 2004 Securing Access to Internal Servers Implementing Application and Web Filtering Securing Access to Exchange Server Virtual Private Networking with ISA Server 2004

Securing the Network Perimeter: What Are the Challenges? Internet Main office Remote user Business partner Branch office Wireless Challenges Include: Determining proper firewall design Access to resources for remote users Effective monitoring and reporting Need for enhanced packet inspection Security standards compliance Challenges Include: Determining proper firewall design Access to resources for remote users Effective monitoring and reporting Need for enhanced packet inspection Security standards compliance

Securing the Network Perimeter: What Are the Design Options? Back-to-back configuration Bastion host Three-legged configuration Web server Internal network Perimeter network Internet Internal network Perimeter network

Configuring ISA Server to Secure the Network Perimeter Use ISA Server to: Provide firewall functionality Publish internal resources such as Web or Exchange servers Implement multilayer packet inspection and filtering Provide VPN access for remote users and sites Provide proxy and caching services LAN Server User Remote User VPN Internet Exchange Server Web Server ISA Server Web Server

Installing ISA Server 2004 Hard Disk Space 150 MB Windows 2000 Server or Windows Server 2003 Windows 2000 Server or Windows Server 2003 RAM 256 MB CPU 500 MHz Hard Disk Format NTFS External NIC Internal NIC Choose an installation type and installation components Configure the internal network Choose an installation type and installation components Configure the internal network

What Is the ISA Server 2004 Default Configuration? The ISA Server default configuration blocks all network traffic between networks connected to ISA Server No servers are published Access rules include system policy rules and the default access rule Only members of the local Administrators group have administrative permissions Default networks are created Caching is disabled The Firewall Client Installation Share is accessible if installed

Managing ISA Server 2004

Monitoring ISA Server 2004 ComponentsExplanation Alerts Monitors ISA Server for configured events and then performs actions when the specified events occur Sessions Provides information on the current client sessions Logging Provides detailed information about the Web proxy, Microsoft Firewall service, or SMTP Message Screener Reports Summarizes information about the usage patterns on ISA Server Connectivity Enables monitoring of connections from the computer running ISA Server to any other computer or URL on any network Performance Monitors server performance in real time, creates a log file of server performance, or configures performance alerts

Configuring Access Rules Types of access rule elements used to create access rules are: Protocols User sets Content types Schedules Network objects Types of access rule elements used to create access rules are: Protocols User sets Content types Schedules Network objects Allow Deny Allow Deny User Destination network Destination IP Destination site Destination network Destination IP Destination site Protocol IP port/type Protocol IP port/type Source network Source IP Source network Source IP Schedule Content type Schedule Content type an action on traffic from user from source to destination with conditions Access rules always define:

Configuring ISA Server to Enable Access to Internet Resources ISA server Web server Proxy server Is the… User allowed access? Computer allowed access? Protocol allowed? Destination allowed? Content allowed?

Implementing Network Templates to Configure ISA Server 2004 Deploy the Single Network Adapter template for Web proxy and caching only Back-to-back configuration Bastion host Three-legged configuration Web server Internal network Perimeter network Deploy the Edge Firewall template Deploy the Front end or Back end template Deploy the Front end or Back end template Deploy the 3-Leg Perimeter template Deploy the 3-Leg Perimeter template Internet

Demonstration 1: Applying a Network Template Use a network template to configure ISA Server 2004 as an edge firewall

Deploying ISA Server 2004: Best Practices To deploy ISA Server to provide Internet access: Plan for DNS name resolution Create the required access rule elements and configure the access rules Plan the access rule order Implement the appropriate authentication mechanisms Test access rules before deployment Deploy the Firewall Client for maximum security and functionality Use ISA Server logging to troubleshoot Internet connectivity issues Plan for DNS name resolution Create the required access rule elements and configure the access rules Plan the access rule order Implement the appropriate authentication mechanisms Test access rules before deployment Deploy the Firewall Client for maximum security and functionality Use ISA Server logging to troubleshoot Internet connectivity issues

Securing Access to Internal Servers Introduction to ISA Server 2004 Securing Access to Internal Servers Implementing Application and Web Filtering Securing Access to Exchange Server Virtual Private Networking with ISA Server 2004

Securing Access to Internal Servers: What Are the Challenges? The challenges vary depending on the type of access that is required: The challenges vary depending on the type of access that is required: Ensure that only the specified servers are accessible Filter traffic at the application layer Ensure that only the specified servers are accessible Filter traffic at the application layer Access to non-Web resources Enable authentication Enable data encryption Enable authentication Enable data encryption Access to secure Web sites Ensure that only the specified Web sites are accessible Filter traffic at the application layer Hide the complexity of the internal network Ensure that only the specified Web sites are accessible Filter traffic at the application layer Hide the complexity of the internal network Access to public Web sites

What Is ISA Server Publishing? ISA Server enables three types of publishing rules: Web publishing rules for publishing Web sites using HTTP Secure Web publishing rules for publishing Web sites that require SSL for encryption Server publishing rules for publishing servers that do not use HTTP or HTTPS Web publishing rules for publishing Web sites using HTTP Secure Web publishing rules for publishing Web sites that require SSL for encryption Server publishing rules for publishing servers that do not use HTTP or HTTPS

Implementing ISA Server Web Publishing Rules To create a Web publishing rule, configure: Action Name or IP address Users Traffic source Public name Action Name or IP address Users Traffic source Public name Web listener Path mappings Bridging Link translation Web listener Path mappings Bridging Link translation

Implementing ISA Server Secure Web Publishing Rules To create a secure Web publishing rule: Choose an SSL bridging mode or SSL tunneling Install a digital certificate on ISA Server, on a Web server, or on both Configure a Web listener for SSL Configure a secure Web publishing rule Choose an SSL bridging mode or SSL tunneling Install a digital certificate on ISA Server, on a Web server, or on both Configure a Web listener for SSL Configure a secure Web publishing rule

Demonstration 2: Configuring a Secure Web Publishing Rule Configure a secure Web publishing rule to an internal Web server

Implementing Server Publishing Rules To create a server publishing rule, configure: Action Traffic Traffic source Traffic destination Networks Action Traffic Traffic source Traffic destination Networks To enable secure server publishing, configure ISA Server to publish a secure protocol, and then install a server certificate on the published server

Securing Access to Internal Servers: Best Practices To enable access to internal servers: Implement a split DNS for internal and external access to the resources Become familiar with Web access error messages Implement SSL certificates correctly Implement a split DNS for internal and external access to the resources Become familiar with Web access error messages Implement SSL certificates correctly

Implementing Application and Web Filtering Introduction to ISA Server 2004 Securing Access to Internal Servers Implementing Application and Web Filtering Securing Access to Exchange Server Virtual Private Networking with ISA Server 2004

Firewall Requirements: Multiple-Layer Filtering Packet filtering: Filters packets based on information in the network and transport layer headers Enables fast packet inspection, but cannot detect higher-level attacks Filters packets based on information in the network and transport layer headers Enables fast packet inspection, but cannot detect higher-level attacks Stateful filtering: Filters packets based on the TCP session information Ensures that only packets that are part of a valid session are accepted, but cannot inspect application data Filters packets based on the TCP session information Ensures that only packets that are part of a valid session are accepted, but cannot inspect application data Application filtering: Filters packets based on the application payload in network packets Can prevent malicious attacks and enforce user policies Filters packets based on the application payload in network packets Can prevent malicious attacks and enforce user policies

Application and Web Filters in ISA Server 2004 Application filters: Are add-ons to the firewall service Enable firewall traversal for complex protocols Enable application-layer intrusion detection Enable application-layer content filtering Are add-ons to the firewall service Enable firewall traversal for complex protocols Enable application-layer intrusion detection Enable application-layer content filtering Web filters: Are DLLs based on the ISAPI model Enable request and response scanning and modification Enable blocking of specific responses Enable traffic logging and analysis Enable data encryption and compression Enable custom authentication schemes Are DLLs based on the ISAPI model Enable request and response scanning and modification Enable blocking of specific responses Enable traffic logging and analysis Enable data encryption and compression Enable custom authentication schemes

Use HTTP Web filtering to: Filter traffic from internal clients to other networks Filter traffic from Internet clients to internal Web servers Filter traffic from internal clients to other networks Filter traffic from Internet clients to internal Web servers Implementing HTTP Web Filtering in ISA Server 2004 HTTP Web filtering can block HTTP packets based on: Length of request headers and payload Length of URL HTTP request method HTTP request file name extension HTTP request or response header Signature or pattern in the response header or body Length of request headers and payload Length of URL HTTP request method HTTP request file name extension HTTP request or response header Signature or pattern in the response header or body HTTP Web filtering is rule-specific—you can configure different filters for each access or publishing rule

Demonstration 3: Application Filtering in ISA Server 2004 Edit the default application filtering that is performed by ISA Server 2004

Implementing the HTTP Web Filter: Best Practices To configure a baseline HTTP filter: Configure maximum header, payload, URL, and query lengths Verify normalization, and do not block high-bit characters Allow only GET, HEAD, and POST Block executable and server-side includes extensions Block potentially malicious signatures Configure maximum header, payload, URL, and query lengths Verify normalization, and do not block high-bit characters Allow only GET, HEAD, and POST Block executable and server-side includes extensions Block potentially malicious signatures Use the HTTPFilterConfig.vbs script from the ISA Server CD to import and export HTTP filter configurations

Securing Access to Exchange Server Introduction to ISA Server 2004 Securing Access to Internal Servers Implementing Application and Web Filtering Securing Access to Exchange Server Virtual Private Networking with ISA Server 2004

Secure Client Access to Exchange Server: What Are the Challenges? Outlook mobile access XHTML, cHTML, HTML ActiveSync-Enabled mobile devices Wireless network Wireless network ISA server Outlook web access Outlook using RPC Outlook using RPC over HTTP Outlook express using IMAP4 or POP3 Outlook web access Outlook using RPC Outlook using RPC over HTTP Outlook express using IMAP4 or POP3 Exchange front-end server Exchange front-end server Exchange back-end servers Exchange back-end servers

Configuring Secure Outlook RPC Client Access Outlook client Outlook client Exchange servers Exchange servers ISA server Port 135 Exchange UUID = 3000 Exchange UUID = 2000 Use the mail server publishing rule to enable Outlook RPC connections

Configuring RPC over HTTP Client Access RPC over HTTP requires: Exchange Server 2003 running on Windows Server 2003 and Windows Server 2003 global catalog servers Outlook 2003 running on Windows XP Windows Server 2003 server running RPC proxy server Modifying the Outlook profile to use RPC over HTTP to connect to the Exchange server To enable RPC over HTTP connections through ISA Server, use the Secure Web Publishing Wizard to publish the /rpc/*virtual directory

Configuring ISA Server for Outlook Web Access To configure ISA Server to enable OWA access: Use the Mail Server Publishing Wizard to publish the OWA server 1 1 Configure a bridging mode. For best security, secure the connection from client to ISA Server and from ISA Server to OWA server 2 2 Configure a Web listener for OWA publishing. Choose forms-based authentication for the Web listener 3 3 Forms-based authentication ensures that user credentials are not stored on the client computer; can be used to block access to attachments

Demonstration 4: Configuring Outlook Web Access Configure an OWA publishing rule and forms-based authentication

Securing Access to Exchange Server: Best Practices Enable Outlook RPC connections for pre–Exchange Server 2003 and Outlook 2003 environments Use forms-based authentication on ISA Server for OWA Implement RPC over HTTP with SSL Explore the use of additional ISA Server features to protect computers running Exchange Server Consider third-party add-ons for ISA Server to protect computers running Exchange Server

Virtual Private Networking with ISA Server 2004 Introduction to ISA Server 2004 Securing Access to Internal Servers Implementing Application and Web Filtering Securing Access to Exchange Server Virtual Private Networking with ISA Server 2004

Virtual Private Networking: What Are the Challenges? VPNs provide a secure option for communicating across a public network VPNS are used in two primary scenarios: VPNs provide a secure option for communicating across a public network VPNS are used in two primary scenarios: Network access for remote clients Network access between sites Network access for remote clients Network access between sites VPN quarantine control provides an additional level of security by providing the ability to check the configuration of the VPN client machines before allowing them access to the organization’s network

Enabling Virtual Private Networking with ISA Server ISA Server enables VPN access: By including remote-client VPN access for individual clients and site-to-site VPN access to connect multiple sites By enabling VPN-specific networks, including:  VPN Clients network  Quarantined VPN Clients network  Remote-site network By using network and access rules to limit network traffic between the VPN networks and the other networks with servers running ISA Server By extending RRAS functionality By including remote-client VPN access for individual clients and site-to-site VPN access to connect multiple sites By enabling VPN-specific networks, including:  VPN Clients network  Quarantined VPN Clients network  Remote-site network By using network and access rules to limit network traffic between the VPN networks and the other networks with servers running ISA Server By extending RRAS functionality

Enabling VPN Client Connections To enable VPN client connections: Choose a tunneling protocol Choose an authentication protocol Use MS-CHAP v2 or EAP if possible Enable VPN client access in ISA Server Management Configure user accounts for remote access Configure remote-access settings Configure firewall access rules for the VPN Clients network Choose a tunneling protocol Choose an authentication protocol Use MS-CHAP v2 or EAP if possible Enable VPN client access in ISA Server Management Configure user accounts for remote access Configure remote-access settings Configure firewall access rules for the VPN Clients network

Implementing Site-to-Site VPN Connections To enable site-to-site VPN connections: Choose a tunneling protocol Configure the remote-site network Configure network rules and access rules to enable: open communications between networks, or controlled communications between networks Configure the remote-site VPN gateway Choose a tunneling protocol Configure the remote-site network Configure network rules and access rules to enable: open communications between networks, or controlled communications between networks Configure the remote-site VPN gateway

How Does Network Quarantine Work? ISA Server DNS Server Web Server Domain Controller File Server Quarantine script VPN Quarantine Clients Network VPN Clients Network RQC.exe Quarantine remote access policy ISA server DNS server Web server Domain controller File server Quarantine script Quarantined VPN Clients Network VPN clients network Rqc.exe Quarantine remote access policy

Implementing Network Quarantine To implement quarantine control on ISA Server: Enable quarantine control on ISA Server Create and install a listener component Configure network rules and access rules for the Quarantined VPN Clients network Use CMAK to create a CM profile for remote-access clients Create a client-side script that validates client configuration

Demonstration 5: Configuring Site-to-Site VPN Connections Configure ISA Server on one site to enable site-to-site VPN connections

Configuring VPN Access Using ISA Server: Best Practices Use strongest possible authentication protocols Enforce the use of strong passwords when using PPTP Avoid the use of pre-shared keys for L2TP/IPSec Configure access rules to control access for VPN clients and site-to-site VPN connections Use access rules to provide quarantined VPN clients with the means to meet the security requirements

Session Summary ISA Server 2004 is secure by default because it blocks all traffic—configure access rules to provide the fewest possible access rights Many applications now use HTTP as a tunneling protocol—use HTTP filtering to block the applications Implement ISA Server publishing rules to make internal resources accessible from the Internet Implementing Outlook RPC publishing and RPC over HTTP publishing means that users can use Outlook from anywhere Use access rules to limit access for VPN remote-access clients, site-to-site VPN clients, and network quarantine clients

Next Steps Find additional security training events: Sign up for security communications: default.mspx Attend Course 2824: Implementing Microsoft Internet Security and Acceleration Server afinal.mspx Get additional security information on ISA Server: default.mspx

Questions and Answers