Configuring Outbound Internet Access with ISA Server

Understanding ISA Object Permissions

You can assign permissions for a number of ISA Server objects, such as those listed here:

The ISA Management MMC snap-in is used to assign permissions for ISA Server objects. The ISA Management console is the primary tool used to administer ISA Server.

To assign ISA Server object permissions:

  1. Click Start, click Programs, click Microsoft ISA Server and then click ISA Management.
  2. To connect to the ISA server, click the Internet Security And Acceleration Server icon located at the top the console tree, click the Action menu, and then select Connect To.
  3. Enter the name of the ISA server.
  4. Locate the ISA Server object that you want to view or assign permissions for.
  5. Right-click the object and select Properties from the shortcut menu.
  6. Click the Security tab. 

The default ISA object permissions for the ISA Server Enterprise Edition are listed here:

The default ISA object permissions for the ISA Server Standard Edition are listed here:

To access the Security tab, to configure Alerts permissions:

To access the Security tab, to configure Arrays permissions:

To access the Security tab, to configure Enterprise permissions:

To access the Security tab, to configure Enterprise Policy permissions:

To access the Security tab, to configure Gatekeeper permissions:

To access the Security tab, to configure Sessions permissions:

The default permissions required by ISA Server services are listed here:

How to restrict Read permissions

  1. Click Start, Administrative Tools, and then click Active Directory Users And Computers to open the Active Directory Users and Computers management console.
  2. For all you domains, proceed to create a Global group to contain all ISA Servers in each particular domain.
  3. For all domains, proceed to create a Global group to contain each ISA Server array.
  4. For the root domain, proceed to create a Local group for users that are allowed to access ISA Server objects.
  5. Grant the Domain Admins group of all domains membership in the Local group just created.
  6. Grant the two Global groups that you have previously created in your domains membership in the Local group.
  1. Open the ISA Management console.
  2. For each of the ISA objects listed here, you can remove Authenticated Users permissions. To do this, access the Security tab of the Properties sheet of the ISA object. Select Authenticated Users and then click Remove :
    • Alerts
    • Server
    • Arrays
    • Gate-keeper object
    • Enterprise Policy
    • Session
  1. For each array, proceed to grant Read permissions to the Global group that contains each ISA Server array (created previously).
  2. Next, at the enterprise level, proceed to grant Read permissions to the Local group that was created for those users allowed to access ISA Server objects.
  3. Proceed to grant Read permissions to the default enterprise policy to the Local group.

How to configure ISA Server array permissions

  1. Open the ISA Management console.
  2. For the ISA array that you want to configure, right-click the array object and select Properties from the shortcut menu.
  3. Click the Security tab.
  4. If you want to add a new user or group, click the Add button. Select the user or group and then assign the appropriate permissions.
  5. If you want to modify existing permissions, select the user or group, and proceed to modify the permissions as required.
  6. If you want to deny permissions for a user or group, select the user or group, and then click the Remove button.

Default Access Policy, Packet Filtering, Cache, Publishing and Routing Configuration Settings

With ISA, protocol rules, and site and content rules determine access policy. Protocol rules define which protocols clients can use to access the Internet. Site and content rules define which sites and content can be accessed. If you have not configured enterprise policy settings to prohibit array level rules – allow, then a default site and content rule called Allow Rule allows all clients access to all content on all sites, all the time. Because no protocol rules are defined and applied when you install ISA Server, traffic will not be able to pass through.

Packet filters are used to manage the flow of IP packets to ISA Server and from ISA Server. Packet filtering inspects the header of each packet for protocol, port, and destination address and source address information. Packets are dropped if they are not explicitly allowed. Packet filtering is disabled in ISA cache mode. In ISA firewall mode and integrated mode, packet filtering is enabled. This means that all packets are dropped if they are not allowed by access policy, packet filters, and publishing rules.
With regard to routing, the default routing rule allows Web Proxy client requests to be directly obtained from the Internet.

The size of the ISA Server cache is determined by the settings specified during ISA Server setup. The other settings that are enabled after installation are: HTTP caching is enabled, FTP caching is enabled, and Active caching is disabled.
The default Web publishing rule enables no publishing of internal servers. All requests are dropped. This means that your internal servers cannot be accessed by external clients.
Alerts, other than these noted here are enabled after ISA Server installation: All port scan attack, Dropped packets, Protocol violation, and UDP bomb attack.

Configuring Outgoing Web Request Properties

One of the primary processes in configuring access is to configure Outgoing Web Request properties. Outgoing Web Request properties can be accessed on the Outgoing Web Request tab of the Server Properties sheet. Incoming Web requests and Oncoming Web requests are configured separately on the Server Properties sheet.

The settings that you define when configuring Outgoing Web Request properties are listed here:

The different authentication methods that you can configure are:

Understanding How Rules are Applied for Outgoing Requests

For each outgoing request, the following occurs:

When multiple rules exist, the order in which they are evaluated and processed is illustrated here:

A few common client access issues encountered are listed here:

Configuring Policy Elements

ISA Server rules are affected by policy elements. Policy elements pertain to a part or component of a policy. They are not created explicitly for each rule. Policy elements are predefined, and can be reused and customized.

The policy elements that you can configure in the ISA Management console are listed here

How to configure a destination address set

  1. Open the ISA Management console.
  2. Expand the Policy Elements folder in the console tree.
  3. Right-click Destination Sets and select New Set from the shortcut menu.
  4. The Destination Set dialog box opens.
  5. In the Name box, enter the name of the new destination address set.
  6. In the Description box, enter a description for the destination address set.
  7. Click the Add button.
  8. The Add/Edit Destination dialog box opens.
  9. Enter a domain name as the destination, or click the Browse button to browse to the domain.
  10. You can alternatively specify an IP address range.
  11. To specify a specific directory path or file name, enter its details in the File box.
  12. Click OK.
  13. Click OK in the Destination Set dialog box.

How to configure a client address set

  1. Open the ISA Management console.
  2. Expand the Policy Elements folder in the console tree.
  3. Right-click Client Address Sets and select New Set from the shortcut menu.
  4. The Client Set dialog box opens.
  5. In the Name box, enter the name of the new client address set.
  6. In the Description box, enter a description for the client address set.
  7. Click the Add button.
  8. The Add/Edit IP Addresses dialog box opens.
  9. In the From box, enter the start address that defines the start of the IP address range.
  10. In the To box, enter the end address that defines the end of the IP address range.
  11. Click OK.
  12. Click OK in the Client Set dialog box.

How to configure protocol rules

A few factors to consider on configuring protocol rules are listed here:

To configure protocol rules:

  1. Open the ISA Management console.
  2. Expand the Access Policy folder in the console tree.
  3. Right-click Protocol Rules and select New from the shortcut menu.
  4. The New Protocol Rule Wizard launches.
  5. Provide a name for the new protocol rule. Click Next.
  6. When the Rule Action page opens, select either Allow or Deny. Click Next.
  7. The Protocols page opens.
  8. In the Apply this rule to box, select between the following options to define the type of traffic:
    • All IP Traffic
    • Selected Protocols
    • All IP Traffic Except Selected Protocols
  1. When you select the Selected Protocols type, a Protocols box is displayed. This is where you specify which protocols to allow or which protocols to block.
  2. You next have to define the schedule for the rule. This schedule defines when the rule will be enforced. Click Next.
  3. Select the client type and then click Next.
  4. Click Finish.

To modify existing protocol rules:

  1. Open the ISA Management console.
  2. Expand the Access Policy folder in the console tree.
  3. Select the Protocol Rules folder, click the View menu and then select the Advanced view option.
  4. Right-click the protocol rule that you want to modify and then select Properties from the shortcut menu.
  5. On the General tab, change the following:
    • Rule name
    • Rule description.
    • Enable or disable the rule.
  1. On the Action tab, you can change to Allow or Deny.
  2. On the Protocols tab, you can modify the protocols.
  3. On the Schedule tab, you can create a schedule, or activate or inactivate the schedule.
  4. On the Applies to tab, you can define who the rule applies to.

How to configure site and content rules

  1. Open the ISA Management console.
  2. Expand the Access Policy folder in the console tree.
  3. Right-click Site and Content Rules and select New Rule from the shortcut menu.
  4. The New Site and Content Rule Wizard launches.
  5. Provide a name for the new site and content rule. Click Next.
  6. When the Rule Action page opens, select either Allow or Deny. Click Next.
  7. On the Rule Configuration page, specify to who the rule will apply:
    • Destinations
    • Schedules
    • Clients
    • Custom

Click Next.

  1. If you have selected the Destinations option previously, the following page lets you specify either of the following options:
    • All Destinations
    • All Internal Destinations
    • All External Destinations
    • Specified Destination Set
    • All Destinations Except the Selected Set.
  1. If you have selected the Schedules option previously, you have to define the schedule on the Schedule page.
  2. If you have selected the Clients option previously, you have to specify the client address set, or select the default of Any Request, or select users and groups on the Client Type page.
  3. If you have selected the Custom option; you can define either of these:
    • Destination
    • Schedule
    • Client address sets
    • Content Groups
    • All destinations except selected set.
  1. Click Next and then click Finish.

Configuring Content Group Settings

ISA Server includes a number of preconfigured content groups. If you are configuring site and content rules, you can apply the rule to one of these content groups:

The Web server has an impact on which MIME types are associated with which file name extensions. The IIS default associations are listed here:

Configuring Custom Error Messages

While there are a number for default error messages for the common errors for incoming and outgoing requests, you can also configure custom messages. To create custom error messages, you can use the default HTML files located in the \ErrorHtmls folder.

To create a custom error message:

  1. Open \Program Files\Microsoft ISA Server\ErrorHtmls\default file. default.htm is for internal client errors, and defaultR.htm is for external client errors.
  2. Change [ERRORNUM] to the error code.
  3. Change [ERRORTEXT] to the error message that you want to be displayed.
  4. Change [SERVERNAME] to the name of the server that should return the message.
  5. Replace [VIAHEADER] to the Via header message string which the ISA Server computer receives for the message.
  6. Save the file.

How to configure bandwidth rules

Bandwidth rules make it possible for you to set the priority for requests. Bandwidth rules are configured by specifying the following elements:

The above elements have to be defined before you actually create the bandwidth rule.

To configure bandwidth priority:

  1. Open the ISA Management console.
  2. Expand the Policy Elements folder in the console tree.
  3. Right-click the folder and select New Bandwidth Priority from the shortcut menu.
  4. The New Bandwidth Priority dialog box opens.
  5. In the Name box enter the name of the bandwidth priority.
  6. Specify outbound bandwidth.
  7. Specify inbound bandwidth.
  8. Click OK.

To configure bandwidth rules:

  1. Open the ISA Management console.
  2. Navigate to the Bandwidth Rules folder.
  3. Right-click the folder and select New Rule from the shortcut menu.
  4. The New Bandwidth Rule Wizard launches.
  5. In the Name box enter the name of the bandwidth rule.
  6. In the Description box, enter a description for the bandwidth rule. Click Next.
  7. Choose between the following options:
    • Apply This Rule to All IP Traffic
    • Selected Protocols
    • Except Selected Protocols

Specify the selected protocols and then click Next.

  1. You next have to define the schedule for the rule. This schedule defines when the rule will be enforced. Click Next.
  2. Set the client type, and then click Next.
  3. Specify the destinations that the rule applies to.
    • All Destinations
    • All Internal Destinations
    • All External Destinations
    • Specified Destination Set
    • All Destinations Except the Selected Set.
  1. Specify the destination set if necessary. Click Next.
  2. Select the content group. Options include:
    • All Content Groups
    • Selected Content Groups

Click Next.

  1. On the Bandwidth Priority page, specify the bandwidth priority.
  2. Click Next and then click Finish.

How to configure routing rules

  1. Open the ISA Management console.
  2. Navigate to the Routing folder.
  3. Right-click the folder and select New Rule from the shortcut menu.
  4. The New Routing Rule Wizard launches.
  5. In the Name box enter the name of the routing rule.
  6. In the Description box, enter a description for the routing rule. Click Next.
  7. When the Destination Sets page opens, specify the destination set and then click Next.
  8. On the Request Action page, you have to specify how client requests should be handled. Options include:
    • Retrieve them directly from specified destination
    • Route to specified upstream server
    • Redirected to hosted site
    • Use dial-up entry

Click Next.

  1. On the Cache Retrieval Configuration page, you have to define how this routing rule searches for and retrieves objects from the cache. Click Next.
  2. On the Cache Content Configuration page, specify whether objects should be stored in the cache. Click Next.
  3. Click Finish.

How to configure an ISA Server chain

  1. Open the ISA Management console.
  2. Navigate to the Routing folder.
  3. Select the Routing folder.
  4. Right-click the default routing rule and select Properties from the shortcut menu.
  5. The Default Rule Properties dialog box opens.
  6. Click the Action tab.
  7. Select the Routing Them to a Specified Upstream Server option.
  8. Click the Settings button associated with the Primary Route.
  9. The Upstream Server Setting dialog box opens.
  10. Select the ISA server and change the URL if applicable.
  11. Enable the Use This Account checkbox and then select the account to use for authentication.
  12. Select either Basic authentication or Integrated Windows authentication.
  13. Click OK.
  14. Use the same process to configure the Backup route.


Top 5 Free Networking Tools

Bookmark Configuring Outbound Internet Access with ISA Server

Latest Blog Posts


English English GermanGerman SpanishSpanish FrenchFrench ItalianItalian PortuguesePortuguese RussianRussian DutchDutch
GreekGreek HindiHindi JapaneseJapanese KoreanKorean ChineseChinese Chinese (Simplified)Chinese (Simplified) ArabicArabic

Copyright 2009 Tech-FAQ. All rights reserved. Privacy Policy.