Browsing on a isa server 2004

Oplossingen voor veelkomende problemen

Browsing on a isa server
By Simon Jorritsma

A more secure method for allowing outbound access from the ISA firewall to the Internet using the Web browser is to require authentication. The logged on user must authenticate to use the Web and that user’s actions are logged. I consider any anonymous access outbound or inbound a potential security issue. That’s true even when the communications are sourcing from the ISA firewall itself. That’s why the ISA firewall is a critical network resource: all communications are logged with a user name and application. No other firewall currently provides this security for all TCP and UDP protocols and does so transparently.

In order to control access on a per user basis when using the browser on the ISA firewall, you must enable the Web Proxy listener on the Local Host network and then configure the browser to be a Web Proxy client. The Web listener accepts outgoing Web request from browsers configured as Web Proxy clients.

Perform the following steps to enable the Web listener on the Local Host network:

In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name and then expand the Configuration node. Click on the Networks node.
On the Networks node, click the Networks tab in the Details pane. On the Networks tab, right click the Local Host network and click Properties.
In the Local Host Properties dialog box, click the Web Proxy tab.
On the Web Proxy tab, put a checkmark in the Enable Web Proxy clients checkbox. Leave the default HTTP port at 8080. Do not enable the Enable SSL checkbox. Click Apply and then click OK.

Click Apply to save the changes and update the firewall policy.
Click OK in the Apply New Configuration dialog box.

The next step is to configure the browser as a Web Proxy client:

Right click the Internet Explorer icon on the desktop and click Properties.
In the Internet Properties dialog box, click the Connections tab.
On the Connections tab, click the LAN Settings button.
In the Local Area Network (LAN) Settings dialog box, remove the checkmarks from the Automatically detect settings and Use automatic configuration script checkboxes. Put a checkmark in the Use a proxy server for your LAN checkbox. In the Address text box, enter Localhost. In the Port text box, enter 8080. Click OK in the Local Area Network (LAN) Settings dialog box.
Click OK in the Internet Properties dialog box.

The last step is to create and Access Rule that allows outbound access to the Internet from the Local Host network to the Internet using the HTTP and HTTPS protocols. We could create the new Access Rule from scratch, or we can modify the rule we already created. Let’s modify the rule we created earlier:

Perform the following steps to create the Access Rule:

Open the Microsoft Internet Security and Acceleration Server 2004 management console and click the Firewall Policy node. In the Task Pane, click the Tasks tab.
On the Tasks tab, click the Create a New Access Rule link.
On the Welcome to the New Access Rule Wizard page, enter a name for the rule. In this example we’ll name the rule Browsing on ISA. Click Next.
On the Rule Action page, select the Allow option and click Next.
On the Protocols page, select the Selected protocols option from the This rule applies to list and click Add.
In the Add Protocols dialog box, click the Common Protocols folder. Double click the HTTP and HTTPS protocols. Click Close.
Click Next on the Protocols page.
On the Access Rule Sources page, click the Add button.
In the Add Network Entities dialog box, click the Networks folder and double click the Local Host network. Click Close.
Click Next on the Access Rule Sources page.
On the Access Rule Destinations page, click the Add button.
Click the Networks folder and double click the External network. Click Close.
Click Next on the Access Rule Destinations page.
On the User Sets page, accept the default entry All Users and click Next.
Click Finish on the Completing the New Access Rule Wizard page.
Click Apply to save the changes and update the firewall policy.
Click OK in the Apply New Configuration dialog box.
Test the configuration by opening the Web browser on the ISA firewall. The connection is successful.

Open the Web browser and visit the http://www.espresso-jura.nl Web site and read some more on espresso.
If you check the log file entries for this communication, you’ll see the connections to the ISAserver.org forums are authenticated. Notice the Client IP address. The client IP address indicates that the local host connected to the Web via the Web Proxy listener. You can also see the connections to the Web Proxy listener where the Destination Port is 8080.

Simon Jorritsma
email : simon @ mixfix.nl

mixfix voor uw koffie en koffieapparatuur

Disclaimer Koffie Koffie Ex-Dividend Dividend Breien

Disclaimer: Al deze informatie wordt je aangeboden 'zoals het is' en voor eventuele fouten in de tekst en voor de eventuele (negatieve) gevolgen daarvan neem ik geen verantwoording! Dit hele aanpassen geschied dan ook geheel op eigen risico!

Niets uit deze uitgave mag zonder schriftelijke toestemming van S.Jorritsma worden gekopieerd, gedownload, verveelvoudigd, opgeslagen in een geautomatiseerd gegevensbestand of openbaar gemaakt, in enige vorm of op enige wijze, hetzij elektronisch, mechanisch, door fotokopie�n, opnamen, of enig andere manier.

maandag 6 februari 2012