Contents Overview 1 Installing ISA Server 2 Installing and Configuring ISA Server Clients 15 Lab A: Installing ISA Server and Configuring Clients 24 Maintaining ISA Server 36 Lab B: Configuring ISA Server 44 Review 51 Module 2: Installing and Maintaining ISA Server Information in this document is subject to change without notice. The names of companies, products, people, characters, and/or data mentioned herein are fictitious and are in no way intended to represent any real individual, company, product, or event, unless otherwise noted. Complying with all applicable copyright laws is the responsibility of the user. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Microsoft Corporation. If, however, your only means of access is electronic, permission to print one copy is hereby granted. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.  2001 Microsoft Corporation. All rights reserved. Microsoft, Active Directory, ActiveX, BackOffice, FrontPage, JScript, MS-DOS, NetMeeting, Outlook, PowerPoint, Visual Basic, Visual C++, Visual Studio, Windows, Windows Media, and Windows NT are either registered trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or other countries. Other product and company names mentioned herein may be the trademarks of their respective owners. Module 2: Installing and Maintaining ISA Server iii Instructor Notes This module provides students with the knowledge and skills to install and configure Microsoft ® Internet Security and Acceleration (ISA) Server 2000 as a cache server and as a firewall. After completing this module, students will be able to:  Install ISA Server on a computer running Microsoft Windows ® 2000 Server.  Configure computers as Web proxy, Firewall, or SecureNAT clients for ISA Server.  Perform administrative tasks for maintaining ISA Server. Materials and Preparation This section provides the materials and preparation tasks that you need to teach this module. Required Materials To teach this module, you need the Microsoft PowerPoint ® file 2159A_02.ppt. Preparation Tasks To prepare for this module, you should:  Read all of the materials for this module.  Complete the labs.  Study the review questions and prepare alternative answers to discuss.  Anticipate questions that students may ask. Write out the questions and provide the answers.  Read RFC 1918, “Address Allocation for Private Internets,” under Additional Reading on the Trainer Materials compact disc.  Read RFC1928, “SOCKS Protocol Version 5,” under Additional Reading on the Student Materials compact disc.  Review the document titled “Pre-Migration-Considerations.htm” on the Microsoft ISA Server compact disc.  Review the document readme.htm on the ISA Server compact disc.  Read the following sections in ISA Server Help: “Planning Considerations,” “Installing ISA Server,” “Checklist: Migrating from Microsoft Proxy Server 2.0,” “Migrating from Microsoft Proxy Server 2.0,” “ISA Server Clients,” “Installing and Configuring ISA Server Clients,” “Administering ISA Server,” and “Troubleshooting.” Presentation: 60 Minutes Lab: 60 Minutes iv Module 2: Installing and Maintaining ISA Server Module Strategy Use the following strategy to present this module:  Installing ISA Server Describe the issues to consider before and during the installation of ISA Server, including a new installation or an upgrade of a server from Microsoft Proxy Server 2.0. Point out the CPU scalability and operating system differences between ISA Server Standard Edition and ISA Server Enterprise Edition. Explain that configuring the local address table (LAT) correctly is the single most important part of installing ISA Server.  Installing and Configuring ISA Server Clients Describe the features of each ISA Server client: Web proxy, Firewall, and SecureNAT. Present or, if possible, demonstrate the procedures for configuring client computers for each type of client.  Maintaining ISA Server Present the tasks required to maintain an ISA Server computer, including starting and stopping services and backing up and restoring ISA Server. Point out the taskpads and the Advanced view features in ISA Management. Present or, if possible, demonstrate the procedures for adding entries to both the LAT and local domain table (LDT). Explain the use of the Msplat.txt file by the Firewall client. Emphasize that for maximum security, you should save the backup files to an NTFS file system disk partition and set the appropriate permissions to protect against unauthorized access. Module 2: Installing and Maintaining ISA Server v Customization Information This section identifies the lab setup requirements for a module and the configuration changes that occur on student computers during the labs. This information is provided to assist you in replicating or customizing Microsoft Official Curriculum (MOC) courseware. The labs in this module are also dependent on the classroom configuration that is specified in the Customization Information section at the end of the Classroom Setup Guide for Course 2159A, Deploying and Managing Microsoft Internet and Security Acceleration Server 2000. Lab Setup There are no lab setup requirements that affect replication or customization. Lab Results Performing the labs in this module introduces the following configuration changes:  Student computers that are configured as ISA Server computers have ISA Server installed.  Student computers that are configured as ISA Server computers have the Default Web Site in Internet Information Services (IIS) configured to use Transmission Control Protocol (TCP) port 8008.  Student computers that are configured as ISA Server computers have entries added to the LAT and the LDT.  Student computers that are configured as ISA Server client computers have the ISA Server administration tools installed.  Student computers that are configured as ISA Server client computers have the Firewall Client software installed.  Student computers that are configured as ISA Server client computers have the default gateway set to the Internet Protocol (IP) address of the ISA Server computer on the private network.  Student computers that are configured as ISA Server client computers have Microsoft Internet Explorer configured to use a Proxy server. Important Module 2: Installing and Maintaining ISA Server 1 Overview  Installing ISA Server  Installing and Configuring ISA Server Clients  Maintaining ISA Server ***************************** ILLEGAL FOR NON - TRAINER USE ****************************** Whether you deploy Microsoft ® Internet Security and Acceleration (ISA) Server 2000 as a dedicated firewall, a Web cache server, or an integrated solution, you must plan carefully to ensure that you have the required hardware and software. After you perform an ISA Server installation, you must configure client computers. Depending on the client operating systems and your specific requirements to control Internet access, you can choose to use the transparent SecureNAT technology or deploy the ISA Firewall Client software. You can also configure computers as Web proxy clients to improve browser performance. In addition, it is important to properly maintain ISA Server to ensure that all client computers have fast and secure access to the Internet. After completing this module, you will be able to:  Install ISA Server on a computer running Microsoft Windows ® 2000 Server.  Configure computers as Web proxy, Firewall, or SecureNAT clients for ISA Server.  Perform administrative tasks for maintaining ISA Server. Topic Objective To provide an overview of the module topics and objectives. Lead-in In this module, you will learn about the installation and maintenance tasks for ISA Server. 2 Module 2: Installing and Maintaining ISA Server    Installing ISA Server  Identifying Hardware and Software Requirements  Identifying Pre-Installation Tasks  Selecting an Installation Mode  Specifying the Initial Cache Size  Configuring the LAT  Upgrading from Microsoft Proxy Server 2.0  Troubleshooting ISA Server Installation ***************************** ILLEGAL FOR NON - TRAINER USE ****************************** Before you install ISA Server, you must set up the hardware and configure the software for the ISA Server computer. To help identify the choices that you will make during installation, review the pre-installation checklist before performing the installation. If you encounter problems during a new installation or an upgrade from Microsoft Proxy Server 2.0, see the Troubleshooting ISA Server Installation section. You also can automate the installation of ISA Server. For more information about performing an unattended setup, see “Unattended setup” in ISA Server Help. Topic Objective To identify the topics related to installing ISA Server. Lead-in Before you install ISA Server, you must set up the hardware and configure the software of the ISA Server computer. Note Module 2: Installing and Maintaining ISA Server 3 Identifying Hardware and Software Requirements Hard Disk Space Hard Disk Space 20 MB Windows 2000 Server, Windows 2000 Server, Windows 2000 Advanced Server, or Windows 2000 Advanced Server, or Windows Datacenter Windows Datacenter Hard Disk Format Hard Disk Format NTFS Internal Adapter Internal Adapter External Adapter External Adapter Active Directory Active Directory Arrays RAM RAM 256 MB CPU CPU 300 MHz or higher ***************************** ILLEGAL FOR NON - TRAINER USE ****************************** The table below lists the hardware and software requirements for ISA Server. Component Requirements CPU 300 megahertz (MHz) or higher Pentium II-compatible • ISA Server Standard Edition supports up to 4 processors • ISA Server Enterprise Edition has no CPU limit Memory 256 megabytes (MB) of random access memory (RAM) Hard disk space 20 MB and space for cache File system and disk format One local hard disk partition formatted with NTFS file system Operating system Microsoft Windows 2000 Server, Microsoft Windows 2000 Advanced Server, or Microsoft Windows 2000 Datacenter Server Windows 2000 Service Pack If running on Windows 2000 Server or Windows 2000 Advanced Server, ISA Server requires Service Pack 1. You should install Service Pack 2 when it becomes available. For more information, see “System Requirements” in the ISA Server Release Notes on the ISA Server compact disc. Networking A network adapter that is compatible with Windows 2000 for communicating with the internal network and an additional network adapter, modem, or Integrated Services Digital Network (ISDN) adapter that is compatible with Windows 2000 for communicating with the Internet or an upstream server. The Active Directory ™ directory service for Windows 2000 must be installed on your network to implement the array feature. Topic Objective To identify the hardware and software requirements for ISA Server. Lead-in Before you install ISA Server, consider the software and hardware requirements. Delivery Tip Point out the CPU scalability difference between ISA Server Standard Edition and ISA Server Enterprise Edition. Explain that Windows 2000 Datacenter Server does not require Service Pack 1 because it already includes all of the components of this Service Pack. Note 4 Module 2: Installing and Maintaining ISA Server Forward Caching Requirements The following table lists the hardware configurations of a single ISA Server computer for the expected number of users who gain access to objects on the Internet. Number of users ISA Server computer RAM Disk space allocated for caching Up to 500 Pentium II, 300 MHz 256 MB 2-4 gigabytes (GB) 500-1,000 Pentium III, 550 MHz 256 MB 10 GB More than 1,000 Two ISA Server computers with Pentium III, 550 MHz processors. Additional ISA Server computer for each 2,000 users. 256 MB for each 2,000 users 10 GB for each ISA Server computer If the number of users exceeds 1,000 users, consider better-performing hardware for the ISA Server computer or add more ISA Server computers. Reverse Caching Requirements The following table lists the hardware configurations of a single ISA Server computer for the expected number of requests from Internet, or external, users. The exact RAM requirements depend on the content that you are publishing. Ideally, all cacheable content should fit into memory. Number of hits per second for a single ISA Server computer ISA Server computer Less than 800 Pentium II, 300 MHz ~800 Pentium III, 550 MHz More than 800 Pentium III, 550 MHz for each 800 hits per second. You can add more processors to your computer or you can add additional ISA Server computers. Firewall Requirements The following table lists the hardware configurations for the expected rate of data transfer for Firewall and SecureNAT clients that gain access to objects on the Internet. Rate of data transfer ISA Server computer RAM 1–25 megabits per second Pentium II, 300 MHz 256 MB 25–50 megabits per second Pentium III, 550 MHz 256 MB More than 50 megabits per second Pentium III, 550 MHz for each 50 megabits per second 256 MB Although it is important to have the required hardware configuration, the rate of data transfer is highly dependent on the speed of your connection to the Internet. Delivery Tip Summarize the hardware configurations that are listed in the tables. It is not necessary to describe each configuration in detail. Emphasize that these recommendations are only guidelines. Students can monitor ISA Server for actual performance and adjust the ISA Server computers accordingly. Note [...]... solving other common problems Module 2: Installing and Maintaining ISA Server 15 Installing and Configuring ISA Server Clients Topic Objective To identify the topics related to installing and configuring ISA Server clients Client Overview Lead-in Configuring Web Proxy Clients Before you install and configure ISA Server clients, evaluate the needs of your organization and compare the features of each... unrelated to ISA Server and you will have to examine your network configuration Note For more information on troubleshooting client connection problems, see “Troubleshooting client connections” in ISA Server Help 24 Module 2: Installing and Maintaining ISA Server Lab A: Installing ISA Server and Configuring Clients Topic Objective To introduce the lab Lead-in In this lab, you will install ISA Server and configure... the following installations, and then click OK: • Typical Installation Includes the most commonly used components • Full Installation Includes all ISA Server components and extensions • Custom Installation Includes the ISA Server components and extensions that you specify 8 Module 2: Installing and Maintaining ISA Server 6 If you are installing ISA Server Enterprise Edition and the computer is not part... 2.0 SOCKS rules to ISA Server policy is not supported Comparing Proxy Server 2.0 and ISA Server Configurations When you upgrade to ISA Server, most rules, network settings, monitoring configurations, and cache configurations in Proxy Server 2.0 are migrated to ISA Server The differences and exceptions between Proxy Server 2.0 and ISA Server are listed as follows: Publishing Proxy Server 2.0 requires... all Internet access for internal users by using ISA Server To accomplish this, you must install ISA Server and configure client computers as Web proxy, Firewall, and SecureNAT clients Estimated time to complete this lab: 30 minutes Module 2: Installing and Maintaining ISA Server 25 Exercise 1 Installing ISA Server In this exercise, you will install ISA Server in Integrated mode Scenario The security... requests 14 Module 2: Installing and Maintaining ISA Server Troubleshooting ISA Server Installation Topic Objective Err or You Cannot Connect to Internet Resources After Installation Err or ISA Server Presents Error Messages During Installation You Cannot Find Array to Join During Installation Users Can Gain Access to Internet Without Defined Rules Err or After installing ISA Server and ISA Server clients,... click to clear the ISA Services check box, ensure that the Add-in Services check box is cleared, and then click Continue ISA Server Setup completes the installation of the ISA Server administration tools k In the Launch ISA Management Tool dialog box, click to clear the Start ISA Server Getting Started Wizard check box, and then click OK 30 Module 2: Installing and Maintaining ISA Server 1 (continued)... array Module 2: Installing and Maintaining ISA Server 13 3 Perform the upgrade to Windows 2000 During the upgrade to Windows 2000, you may receive a message indicating that Proxy Server 2.0 will not work on a computer running Windows 2000 You can disregard this message and continue installing ISA Server 4 Install Windows 2000 Service Pack 1 5 Begin installing ISA Server Key Points Migration of Proxy Server. .. to upgrading to ISA Server from Proxy Server 2.0 Upgrading from Microsoft Windows NT Lead-in ISA Server supports a full migration path for Microsoft Proxy Server 2.0 users Publishing Cache Content SOCKS Rules Proxy Server 2.0 2.0 ISA Server Configurations SecureNAT Client 2000 IPX Protocol Proxy Server 2.0 ISA Server Comparing Proxy 2.0 and ServerSOCKS Rules Winsock Proxy Client ISA Server 2000 Upgrade... Default NNTP Virtual Server, and then click Properties i In the Default NNTP Virtual Server Properties dialog box, in the IP address list, click ip_address (where ip_address is the IP address of the ISA Server computer on your private network), and then click OK j Close Internet Information Services Module 2: Installing and Maintaining ISA Server 29 Exercise 2 Installing the ISA Server Administration . a Proxy server. Important Module 2: Installing and Maintaining ISA Server 1 Overview  Installing ISA Server  Installing and Configuring ISA Server Clients. Overview 1 Installing ISA Server 2 Installing and Configuring ISA Server Clients 15 Lab A: Installing ISA Server and Configuring Clients 24 Maintaining ISA Server