Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Chapter Summary
The process of deploying ISA Server can be reduced in complexity, cost, and time by carefully evaluating client requirements. The twin issues of maintenance and access troubleshooting can be more easily enabled if a thorough knowledge and understanding of clients is available to planners and implementers. It’s not just the configuration and installation steps that are important. This chapter has provided insight into the knowledge base and planning decisions that are required while deferring the step-by-step implementation instructions in the next chapter.
KEY TERMS
Network Address Translation (NAT)
SecureNAT
Winsock applications
mspclnt.ini
msplat.txt
chained authentication
Win Proxy Automatic Discover protocol (WPAD)
Exercises
13.1 Planning Client Deployment
Before clients can be deployed you must determine which clients should be deployed. A good understanding can save many hours and make maintenance and access troubleshooting much less demanding.
Estimated Time: 10 minutes
1. Use the following table to list the client requirements, as you understand them, of your network.
2. In the second column of the table, list the client that is required to fulfill this need.
3. Compare your results with the sample table that follows this exercise.
Table 13.2 Client Requirements
|
Requirement |
Client Type |
|
|
|
Table 13.3 Sample Answer Table
|
Requirement |
Client Type |
|
Authentication |
Web proxy, Firewall |
|
Web protocols |
Web proxy, Firewall, SecureNAT |
|
Application filters |
Firewall, SecureNAT |
|
Caching of HTTP requests |
Web proxy, Firewall, SecureNAT |
|
Caching of FTP requests |
Web proxy |
|
Requires the least configuration |
SecureNAT |
|
Fine-tuned Winsock application usage |
Firewall |
Review Questions
Are 16-bit Winsock applications supported? With which clients?
Which client should be selected if access control will be configured by IP address, schedule, protocol, and destination requested? Which will be the simplest to configure?
Which clients use the Web proxy service? Which ones use it most efficiently
Discuss two items that can increase the complexity and cost of deploying the various ISA Server clients.
Exam Questions
In a migration from Proxy Server 2.0 to ISA Server, an inventory of client status must be made. Of the clients listed here, which will not need changes to access the Internet through ISA Server?
Winsock Proxy clients.
Web proxy clients set for autodiscovery.
Clients whose default gateway is set for the ISA Server’s internal network interface.
Web proxy clients coded with the internal network interface of the Proxy 2.0 server (soon to be the ISA Server.) and port 80.
Which of the following ISA Server clients can be used to provide Internet access for Macintosh and Unix clients?
Firewall client
Web proxy client
SecureNAT client
Winsock Proxy Client
Various protocols and types of Web objects can be cached. Which of the following items can be cached?
HTTP and FTP requests from Firewall clients.
HTTP and FTP requests from Web proxy clients.
HTTP and FTP requests from SecureNAT clients.
HTTP requests from SecureNAT clients.
-
You are debating using the Firewall client or the SecureNAT client. Two advantages of one over the other are
The Firewall client can inform the Firewall service of the ports it needs to use. SecureNAT clients need for ports must be statically configured.
The Firewall client will always pass user credentials, thus user group membership can be successfully used for access control.
The SecureNAT client can inform the Firewall service of the ports it needs to use. Firewall clients need for ports must be statically configured.
The SecureNAT client will always pass user credentials, thus user group membership can be successfully used for access control.
Which clients can be used in which modes?
A. SecureNAT clients are not supported in Caching mode.
Web proxy clients are not supported in Firewall mode.
Firewall clients are not supported in Integrated mode.
SecureNAT clients are not supported in Firewall mode.
Answers to Review Questions
16-bit Winsock applications are only supported for Windows NT 4.0 clients and Windows 2000 clients. See the section "Firewall Client."
All clients can be used in this scenario, however, the SecureNAT is be the simplest to configure. See the section "Using Multiple Clients on a Single Computer."
All clients use the Web proxy service. SecureNAT and Firewall client Web requests are forwarded to the Web proxy service. The Web proxy client uses the Web proxy service in the most efficient manner. See the section "SecureNAT Client."
Two items that can increase the complexity of a deployment are authentication and autodiscovery. Authentication may be required to fulfill access rules written to depend on group membership. This requires a more complex deployment. If Web proxy clients are used, then authentication must be required of all clients -- this prevents participation by non-Windows clients. Autodiscovery can save configuration time, but can be difficult to get right. Changes to DNS and DHCP configuration may need to be made. See the "Considering Cost and Complexity."
Answers to Exam Questions
A, B, C. D is incorrect. Proxy 2.0 uses port 80 to listen for Web requests. ISA Server uses port 8080. See "Migrating Proxy 2.0 Clients."
B, C. A and D are incorrect, the firewall and Winsock Proxy clients must be installed and there is no version for non-windows operating systems. See "Introducing ISA Server Client Types."
B, D. A is incorrect, only HTTP requests from Firewall and SecureNAT clients are cached. See "Using Multiple Clients on the Same Computer."
A, B. C and D are incorrect. See "Using Multiple Clients on the Same Computer."
A, B. Firewall clients are supported in integrated mode and SecureNAT clients are supported in Firewall mode. See "Introducing ISA Server Client Types."
Suggested Readings and Resources
ISA Server "Installation and Deployment Guide" available at http://www.microsoft.com/isaserver/techinfo/ISAdeploy.htm.
Carlisle Adams, Steve Lloyd, Understanding the Public-Key Infrastructure, 1999, New Riders Publishing, ISBN: 157870166X.
Roberta Bragg, Windows 2000 Security, Chapters 4 and 17, 2000, New Riders Publishing, ISBN: 0735709912.
"Windows 2000 Certificate Services," a white paper at http://www.microsoft.com/WINDOWS2000/techinfo/howitworks/security/windows2000csoverview.asp.