Microsoft ISA Server 2000 英文影印版PDF电子书下载

Chapter 1 Introduction to Microsoft Internet Security and Acceleration Server 2000 1

About This Chapter 1

Before You Begin 2

Lesson 1 Overview of ISA Server 3

Editions Comparison 3

ISA Server Enterprise Edition 3

ISA Server Standard Edition 4

Key Differences 4

ISA Server Roles 4

Internet Firewall 5

Secure Server Publishing 5

Forward Web Caching Server 5

Reverse Web Caching Server 5

Integrated Firewall and Web Cache Server 5

Windows 2000 Integration 6

Extensibility 9

Scalability 9

ISA Server Architecture 10

Practice：ISA Server Overview Presentation 15

Lesson Summary 16

Lesson 2 Introduction to the ISA Server Firewall 17

Filtering Methods 17

IP Packet Filtering 17

Circuit-Level(Protocol)Filtering 18

Application Filtering 19

Bandwidth Rules 22

Integrated Virtual Private Networking 22

Integrated Intrusion Detection 24

Packet Filter Intrusions 24

Secure Publishing 25

Lesson Summary 27

Lesson 3 Overview of ISA Server Caching 28

High-Performance Web Cache 28

Forward Web Caching Server 28

Reverse Web Caching Server 30

Active Caching 31

Scheduled Content Download 31

CARP and Cache Server Scalability 32

Hierarchical Caching 33

Web Proxy Routing 34

Lesson Summary 35

Lesson 4 ISA Server s Management Features 37

Intuitive User Interface 37

Policy-Based Access Control 38

Integrated Administration 38

Tiered Policy 40

Array Policy 40

Enterprise Policy 41

Lesson Summary 41

Review 43

Chapter 2 Installing Microsoft Internet Security and Acceleration Server 2000 45

About This Chapter 45

Before You Begin 46

Capacity Planning 47

Lesson 1 Planning for an ISA Server Installation 47

Minimal Requirements 48

Remote Administration Requirements 48

Firewall Requirements 48

Forward Caching Requirements 49

Publishing and Reverse Caching Requirements 50

Array Considerations 50

Standalone Servers and Single-Server Arrays 51

Array Requirements 51

ISA Server Mode 52

Internet Connectivity Considerations 53

Publishing and Connectivity 54

ISA Server in the Network 54

Windows NT 4.0 Domain 54

ISA Server Configuration Data 54

Small Office Scenario 55

ISA Server Network Topology Scenarios 55

Remote Access Server 55

Internet Connection Server 55

Enterprise Scenario 56

Enterprise Network Configuration 56

Web Publishing Topologies 58

Co-Located Web Server 58

Web Server on Local Network 58

Co-Located Exchange Server 59

Exchange Server Publishing Topologies 59

Exchange Server on Local Network 60

Perimeter Network(DMZ)Scenarios 60

Back-to-Back Perimeter Network Configuration 61

Three-Homed Perimeter Network(DMZ)Configuration 62

Lesson Summary 63

Lesson 2 Performing an ISA Server Installation 64

Before You Install ISA Server 64

Setting Up the Network Adapter 64

Setting Up a Modem or ISDN Adapter 65

TCP/IP Settings 65

Windows 2000 Routing Table 66

Installing ISA Server 66

Initializing the Enterprise 67

Installation Procedure 68

Constructing the Local Address Table 70

Windows 2000 Routing Table 71

Default Settings 71

Troubleshooting ISA Server Installation 72

Practice：Installing ISA Server Enterprise Edition 73

Exercise 1:Initializing the Enterprise 73

Exercise 2:Installing ISA Server Software 74

Lesson Summary 77

Lesson 3 Migrating from Proxy Server 2.0 78

Migrating from Microsoft Proxy Server 2.0 78

Operating System Considerations 78

Proxy Server on Windows 2000 78

Proxy Server on Windows NT 4.0 79

Proxy Server 2.0 Array Considerations 80

Migrating to an Array 81

Migrating Proxy Server 2.0 Configuration 82

Proxy Chains 82

Web Proxy Client Requests 82

Publishing 82

Cache 82

SOCKS 82

Lesson Summary 83

Rules and Policies 83

Review 84

Chapter 3 Configuring Secure Internet Access 85

About This Chapter 85

Before You Begin 86

Lesson 1 Configuring Local Clients for Secure Internet Access 87

About ISA Server Clients 87

Assessing Client Requirements 88

Configuring SecureNAT Clients 90

Configuring SecureNAT Clients on a Simple Network 91

Configuring SecureNAT Clients on a Complex Network 91

Additional SecureNAT Configuration for Dial-up Networks 91

Resolving Names for SecureNAT Clients 92

Internet Access Only 92

Internal Network and Internet Access 92

Firewall Clients 92

Advanced Client Configuration 94

Firewall Client Application Settings 94

Sample Wspcfg.ini File 95

Web Proxy Service 97

Configuring Web Proxy Clients 98

Direct Access 99

Practice 1:Establishing Secure Internet Access for Web Proxy Clients 99

Exercise 1:Creating a Protocol Rule 100

Exercise 2:Configuring Internet Explorer to Use the Web Proxy Service 101

Practice 2:Installing Firewall Client 101

Lesson Summary 102

Exercise:Installing Firewall Client over the Local Network 102

Lesson 2 Configuring ISA Server Dial-up Connections 103

Configuring Dial-up Entries 103

Dial-on-Demand 105

Configuring Dial-on-Demand 106

Limiting ISA Server Dial-out to External Sites 107

Closing Dial-up Connections 108

Practice:Configuring a Dial-up Entry 108

Exercise 1:Testing Internet Connectivity 108

Exercise 2:Creating a New Dial-up Entry 109

Exercise 3:Configuring ISA Server to Route through the Dial-up Entry 110

Exercise 4:Restarting the Firewall Service 110

Exercise 5:Viewing SecureNAT Session Information 111

Lesson Summary 111

Lesson 3 Configuring Automatic Discovery of ISA Server 112

Automatic Discovery 112

Configuring WPAD and WSPAD on the DNS or DHCP Server 113

Verifying Automatic Discovery for Firewall Clients 115

Automatic Discovery for Firewall Clients 115

Automatic Discovery for Web Proxy Clients 116

Troubleshooting Automatic Discovery 116

Practice:Configuring Automatic Discovery 117

Exercise 1:Publishing Automatic Discovery 117

Exercise 2:Creating a WPAD Alias(CNAME)Record in DNS 118

Exercise 3:Enabling Automatic Discovery on a Firewall Client 118

Exercise 4:Testing Automatic Discovery 118

Lesson Summary 119

Lesson 4 Troubleshooting ISA Server Client Connectivity 120

Troubleshooting Client Connections 120

Troubleshooting Dial-up Entries 122

Restarting Services after Configuration Changes 123

Lesson Summary 126

Review 127

Chapter 4 Configuring Internet Security Using Access Policies 129

About This Chapter 129

Before You Begin 130

Lesson 1 Creating an Access Policy with ISA Server 131

Controlling Outgoing Requests 131

Configuring Access Policy 133

Rules and Authentication 134

SecureNAT Clients and Authentication 134

Firewall Clients and Authentication 135

Web Proxy Clients and Authentication 135

ISA Server System Security(System Hardening) 136

Getting Started Wizard 137

Lesson Summary 139

Lesson 2 Creating Customized Policy Elements 140

Policy Elements 140

Array-Level and Enterprise-Level Policy Elements 140

Configuring Schedules 141

Configuring Destination Sets 142

Client Address Sets 144

Configuring Protocol Definitions 145

Client Users and Groups 145

Direction 146

Configuring Content Groups 147

Practice:Creating Policy Elements 149

Exercise 1:Creating a Schedule 149

Exercise 2:Creating a Destination Set 150

Lesson Summary 151

Lesson 3 Configuring Protocol Rules 152

Protocol Rules 152

Protocol Rule Configuration Scenario 153

Protocol Availability 154

Application Filters and Protocol Availability 155

Processing Order 156

Array-Level and Enterprise-Level Protocol Rules 156

Web Protocols 156

Protocol Definitions that are Installed with ISA Server 157

Practice:Assigning Protocol Rules to User Accounts 160

Exercise 2:Requiring Authentication for Web Sessions 161

Exercise 1:Monitoring Sessions in ISA Management 161

Exercise 3:Assigning a Protocol Rule to a Windows 2000 User 162

Lesson Summary 164

Lesson 4 Configuring Site and Content Rules 165

Site and Content Rules 165

Processing Order 165

Allow and Deny Actions 166

Destination Sets and Path Processing 166

Array-Level and Enterprise-Level Site and Content Rules 167

Sample Site and Content Rule 168

Content Groups 168

Practice:Creating New Site and Content Rules 174

Exercise 1:Denying Userl Access to Audio and Video Content 175

Exercise 2: Testing the Configuration 176

Lesson Summary 177

Lesson 5 Configuring IP Packet Filters 178

When to Use IP Packet Filters 178

Creating IP Packet Filters 179

Configuring Packet Filter Options 183

IP Fragment Filtering 183

IP Options Filtering 184

Logging Packets 184

Practice:Running Internet Services on the ISA Server Computer 185

Exercise 1:Creating an IP Packet Filter for Incoming(POP3)Mail 185

Exercise 2:Creating an IP Packet Filter for Outgoing(SMTP)Mail 187

Exercise 3:Creating an IP Packet Filter for NNTP 188

Exercise 4:Creating an IP Packet Filter to Allow Outgoing Web Requests(DNS Queries) 189

Exercise 5:Creating an IP Packet Filter for Web Content(HTTP) 190

Lesson Summary 191

Lesson 6 Configuring ISA Server to Detect External Attacks and Intrusions 192

Intrusion Types and Alerts 192

Port Scan Attack 193

All Ports Scan Attack 193

Enumerated Port Scan Attack 193

Ping of Death Attack 194

Land Attack 194

IP Half Scan Attack 194

UDP Bomb Attack 195

Windows Out-of-Band Attack(WinNuke) 195

Configuring Intrusion Detection 195

Practice:Configuring Intrusion Detection on ISA Server 197

Exercise:Enabling Intrusion Detection 197

Lesson Summary 198

Review 199

Before You Begin 201

Chapter 5 Configuring Internet Acceleration through the ISA Server Cache 201

About This Chapter 201

Lesson 1 Creating a Basic Cache Policy with Routing Rules 202

How Caching Works 202

Processing Caching Rules 202

Cache Configuration Properties 203

Routing Rules 203

When to Cache Content 203

Applying Routing Rules to Particular Destinations 204

When to Retrieve Objects from the Cache 204

Default Routing Rule 208

Processing Flow for Caching 208

Rule Order 208

Cache Filtering 210

Additional Cache Policy 211

Practice:Caching Dynamic Content 211

Exercise:Creating a Routing Rule Caching Both Non-Dynamic and Dynamic Content 211

Lesson Summary 213

Cache Requirements and Recommendations 214

Lesson 2 Configuring Cache Properties in ISA Server 214

Configuring Cache Drives 214

Configuring Size and Location 215

Cache Content Files 216

Configuring How ISA Server Caches Objects 217

Configuring Which Content to Cache 217

Configuring Expiration Policy 218

Request Headers 218

Response Headers 218

RAM Caching 218

HTTP Object Caching 219

FTP Object Caching 220

Returning Expired Objects 221

Configuring Active Caching 223

Configuring Negative Caching 224

Practice 1:Enabling Active Caching 224

Exercise:Enabling Active Caching 224

Practice 2:Adjusting the Amount of RAM Used for Caching 225

Exercise:Adjusting the Percentage of Available Memory Used for Caching 225

Lesson Summary 225

Lesson 3 Scheduling Cache Content Downloads 226

Scheduled Cache Content Downloads 226

Updating Cache Content Automatically 226

Configuring Properties for Existing Download Jobs 227

Configuring the Schedule for Content Download Jobs 229

Downloading Dynamic Content 229

Practice:Creating a Scheduled Content Download Job 230

Exercise:Scheduling a Content Download for Microsoft Online Seminars 230

Lesson Summary 231

Review 232

Chapter 6 Secure Server Publishing 233

About This Chapter 233

Before You Begin 233

Publishing Policy Rules 234

Lesson 1 Publishing Servers Securely 234

Server Publishing Rules 235

How Server Publishing Works 235

Server Publishing Rule Actions 237

Sample Rule Action 237

Client Address Sets 238

Server Publishing Rules and IP Packet Filters 239

Publishing Servers on a Perimeter Network 239

Practice:Publishing an Internal Server 240

Server on the Same Computer as ISA Server 240

Exercise 1:Creating a Publishing Rule on Serverl 241

Exercise 2:Verifying the FTP Server Connection 242

Lesson Summary 243

Lesson 2 Publishing Web Servers Securely 244

Web Publishing Rules 244

Destination Sets and Client Sets 244

Web Publishing Rule Actions 246

SSL and HTTP Bridging 247

Rule Order 248

Default Web Publishing Rule 248

Sample Web Publishing Rule 248

Publishing a Web Server on the Local Network 249

Publishing a Web Server Hosted on the ISA Server Computer 250

Using Packet Filters to Publish a Web Server on the ISA Server Compute 250

Practice:Publishing a Web Server on the ISA Server Computer 251

Exercise 1:Configuring Incoming Web Request Properties 251

Exercise 2:Creating a Destination Set for the Web Server 252

Exercise 4:Creating a Web Publishing Rule 253

Exercise 3:Preparing the Web Site 253

Exercise 5:Testing the Configuration 254

Lesson Summary 255

Lesson 3 Publishing Mail Servers 256

Mail Server Security Wizard 256

Mail Wizard Settings 257

Content Filtering 257

Exchange Server on the ISA Server Computer 258

Configuring Exchange Server on the Local Network 258

Practice:Publishing the SMTP Service 259

Exercise 1:Configuring the SMTP Service 259

Exercise 2:Creating a Mail Wizard Rule 260

Exercise 3:Configuring Outlook Express 261

Exercise 4:Testing the Configuration 262

Lesson Summary 263

Review 264

Before You Begin 265

About This Chapter 265

Chapter 7 Securing Enterprise Networks with ISA Server 265

Lesson 1 Applying Enterprise Policies 266

Enterprise Policies and Arrays 266

How Enterprise Policies are Applied 266

Creating an Enterprise Policy 267

Configuring the Policy Settings for an Enterprise 268

Backing Up and Restoring an Enterprise Configuration 271

Practice:Creating and Applying an Enterprise Policy 272

Exercise 1:Creating an Enterprise Policy 272

Exercise 2:Creating a New Array that Inherits the Default Enterprise Policy 274

Exercise 3:Testing the Configuration 275

Lesson Summary 277

Lesson 2 Configuring ISA Server Arrays 279

Creating ISA Server Arrays 279

Array Requirements 280

Arrays and Standalone Servers 280

Promoting Standalone Servers 281

Array Member Settings 283

Storing an Array Configuration 283

Controlling Array Membership 284

Backing Up and Restoring an Array Configuration 285

Backing Up the Configuration 285

Backing Up a Standalone Server Configuration 286

Restoring the Configuration 286

Using Arrays to Provide Fault Tolerance 287

Fault Tolerance for Firewall Clients 288

Fault Tolerance for SecureNAT Clients 288

Cache Array Routing Protocol 290

How CARP Works 290

Configuring CARP 291

Configuring the Load Factor 292

CARP and Scheduled Content Download 292

Lesson Summary 293

Integrating Virtual Private Networks with ISA Server 294

Lesson 3 Securing Virtual Private Networks with ISA Server 294

Configuring the Network for VPN Connectivity 295

Using the ISA Server VPN Configuration Wizards 296

Local ISA Server VPN Configuration Wizard 296

Remote ISA Server VPN Configuration Wizard 297

ISA Virtual Private Network Configuration Wizard 298

Reconfiguring the VPN 298

ISA Server and IPSec 299

Large Network Scenario with VPN and Routing 300

Large Network VPN Description 300

Meeting Network Requirements 301

ISA Server Array at the United States Headquarters 301

ISA Server Array at the Canada Branch Office 301

ISA Server Array at the United Kingdom Branch Office 301

Enterprise Policy at Headquarters 302

ISA Server Policy at the Canada Branch Office 303

Lesson Summary 304

ISA Server Policy at the United Kingdom Branch Office 304

Review 305

Chapter 8 Secure Videoconferencing with H.323 Gatekeeper 307

About This Chapter 307

Before You Begin 308

Lesson 1 Configuring Clients to Use H.323 Gatekeeper 309

H.323 Protocol 309

Intra-Enterprise Conference Call Scenario 310

H.323 Gatekeeper Usage Scenarios 310

H.323 Gatekeeper Snap-in 310

Overview of H.323 Gatekeeper 310

Inter-Enterprise Conference Call Scenario 311

PSTN Call Scenario 312

Registering Clients with H.323 Gatekeeper 313

Endpoint Attributes 314

Aliases 314

Client Address Translation 315

From within Your Company 316

At the Destination 316

Installing H.323 Gatekeeper 317

Practice:Configuring a Client to use H.323 Gatekeeper 318

Exercise 1:Adding a Gatekeeper 318

Exercise 2:Configuring NetMeeting to Use H.323 Gatekeeper 318

Exercise 3:Testing the Configuration 320

Lesson Summary 320

Lesson 2 Routing Conference Calls with H.323 Gatekeeper 322

Call Routing Rules 322

Phone Number Rules 323

Example of a Phone Number Rule 324

IP Address Rules 326

IP Address Rule Resolution Example 327

E-mail Address Rules 327

Rule Processing and Destinations 330

None 330

Registration Database 330

Gateway/Proxy 331

Internet Locator Service(ILS) 331

Local Network 332

Active Directory Directory Services 332

Gatekeeper 332

DNS 332

Multicast Gatekeeper 332

Applying Rules to Calls 333

Inbound Calls 333

Outbound Calls 334

Lesson Summary 335

Review 336

Chapter 9 Monitoring and Optimizing ISA Server Performance 337

About This Chapter 337

Before You Begin 338

Lesson 1 Configuring Alerts 339

Preconfigured Alerts 339

Alert Conditions 341

Event Location 342

Event Thresholds 342

Alert Action 343

ISA Server Events 345

Practice:Configuring an Alert to Send an E-mail Message 348

Exercise:Configuring the Intrusion Detected Alert to Send You an E-mail Message 348

Lesson Summary 349

Lesson 2 Logging ISA Server Activity 350

Managing ISA Server Logs 350

Logging to a File 352

W3C Format 353

Log File Names 354

ISA Format 354

Log File Options 355

Logging to a Database 356

Logging Packets 359

Firewall and Web Proxy Log Fields 360

Packet Filter Log Fields 370

Practice:Reading Web Logs 372

Exercise:Analyzing a Web Log 372

Lesson Summary 373

Configuring Reports 374

Lesson 3 Creating ISA Server Reports 374

Viewing Reports 375

Summary Reports 375

Web Usage Reports 376

Application Usage Reports 376

Security Reports 377

Configuring Report Jobs 377

Traffic Utilization Reports 377

Report Job Credentials 379

Configuring Report Log Summaries 380

Report Database 381

Practice:Creating and Viewing Reports 382

Exercise 1:Creating a Report Job 382

Exercise 2:Viewing Reports 384

Lesson Summary 385

Effective Bandwidth for Dial-up Connections 386

Lesson 4 Controlling Bandwidth 386

Determining Effective Bandwidth 386

Effective Bandwidth for Dedicated Network Connections 387

Configuring Bandwidth Priorities 389

Configuring Bandwidth Rules 391

Rule Order 393

Default Bandwidth Rule 394

Practice:Creating a Bandwidth Rule 394

Exercise 1:Creating a New Bandwidth Priority Policy Element 394

Exercise 2:Creating a New Bandwidth Rule 395

Lesson Summary 396

Lesson 5 Additional Tuning and Monitoring Tools 397

Tuning ISA Server Performance 397

Tuning Cache Performance 398

ISA Server Performance Objects and Counters 399

ISA Server Performance Monitor 400

Performance Objects and Counters Included in ISA Server 402

Lesson Summary 421

Review 422

Chapter 10 Troubleshooting ISA Server 423

About This Chapter 423

Before You Begin 423

Lesson 1 Troubleshooting Tools in ISA Server 424

Troubleshooting Tools 424

ISA Server Reports 424

Event Viewer 425

Netstat 426

Performance Monitor 426

Telnet 428

Network Monitor 429

The Routing Table 430

The Route Determination Process 431

Troubleshooting Routing Tables 431

Practice:Testing Port Status 432

Exercise:Testing ISA Server ports 432

Lesson Summary 435

Lesson 2 Troubleshooting Strategies in ISA Server 436

Troubleshooting User Access 436

Authentication 436

Troubleshooting Packet-Based Access Problems 438

VPN Network Considerations 439

Additional Troubleshooting Notes 440

Lesson Summary 444

Review 446

Appendix A Questions and Answers 449

Appendix B Deploying and Administering ISA Server in a Complex Network 479

About This Appendix 479

Before You Begin 479

Scenario Background 480

Questions 480

Appendix C Event Messages 489

Alert Event Messages 490

Bandwidth Event Messages 491

Cache Event Messages 492

Common Service Event Messages 495

Dial-up Connection Events 499

Firewall Service Event Messages 500

Winsock Error Code Messages 505

Intrusion Detection Event Messages 538

Log Event Messages 543

Control Service Event Messages 547

Packet Filter Event Messages 549

Server Event Messages 551

Web Proxy Service Event Messages 555

HTTP Messages 558

HTML Messages 561

Gopher Messages 562

FTP Messages 563

Internet Messages 563

Appendix D Glossary 567

Index 581