Getting started with Microsoft ISA Server 2006, Part V: Configure HTTP Filter

Getting started with Microsoft ISA Server 2006, Part V: Configure HTTP Filter

Have you ever need to block users using MSN or Yahoo Messenger? Or block them to using free email services? Or even block them to post anythings on web boards? Or block them to using bit torrent to download files? This topic can answer these questions by using Microsoft ISA Server 2006.

From Part I to IV, you have finished simple configurations on Microsoft ISA Server 2006 to work in your network. But ISA Server can do a lot more than that. Another benefit of ISA Server is that it can filter HTTP traffic. If you know attributes of each HTTP traffic, you can block MSN/Yahoo Messenger, Bit torrent, web mail, disallow post on web boards, etc by allow or block HTTP traffic using HTTP filter. I think most of the readers may not familiar what HTTP traffic look like so let’s see about HTTP traffic in the next section.

Note: This topic isn’t require in order to running ISA Server, only Part I to IV are sufficient. But this topic will be benefits in most organization to improve security.

HTTP Traffic

HTTP Traffic on ISA Server is a data that pass through ISA Server using HTTP protocol (by default is on port 80) which is the protocol that is used by most applications. On each HTTP connection, there will be a header information about client that send to server or server to client. These information are such as Request Methods (GET, POST ,etc.), HTTP Versions (1.0,1.1,1.2), User-Agent (Mozilla/4.0, Firefox, etc.), Content-Type (application/xml, image/jpeg, text/xml, etc.), etc. I will not go into deep detail about HTTP protocol if you want more information, you can find at Wikipedia – HTTP. With these header information, ISA Server can filter HTTP traffic to allow or block specific application or traffic.

To see some sample of HTTP traffic, you can use sniffer program to capture each data packet that pass in/out a computer. The popular one is Ethereal. I have installed Ethereal on a computer which running a web server. Let see the different example of each HTTP header information below.

When client sends request to the web server by browser the Internet Explorer to http://bkkexternal (bkkexternal is the computer that runs a web server).
Detail: The request method is GET. URI is /. The User-Agent is Mozilla (compatible: MSIE 6.0).

This the response header from the above request.
Detail: The response code is 200 (OK). The server is running by Apache 2.2.4. The Content-Type is text/xml

When you submit a form on the browser to the web server.
Detail: The request method is POST. The client host is bkkmisc01. The Content-Type is application/x-www-form-urlencoded.

Note: “/r/n” is tag that tells end of a line, a control line feed.

Configurations

To configure HTTP filter, you need to know what attribute and value need to be configured. On this post, I will show only the following:

1. Block specific browser: Firefox.
2. Block MSN Messenger, Windows Live Messenger.
3. Block download file .torrent.
4. Block AOL Messenger.
5. Block Yahoo Messenger.
6. Block Kazaa.
7. Block free web mail. (e.g. hotmail.com, mail.yahoo.com, etc.)
8. Block post on web boards.

Step-by-step

1. Open Microsoft ISA Server Management Console.
   
2. Right-click on the rule that being configured HTTP filter -> select Configure HTTP.
   
3. Click on Signatures tab and click Add.
   
4. Block specific browser: Firefox.
   To block users to use Firefox browser by configure signature to “Firefox”, “User-Agent” in HTTP Header and Request headers in Search in.
   
5. Block MSN Messenger, Windows Live Messenger.
   To block users to use MSN Messenger and Windows Live Messenger.
   • To block MSN Messenger by configure signature to “msnmsgr.exe”, “User-Agent” in HTTP Header and Request headers in Search in.
     
   • To block Windows Live Messenger by configure signature to “login.live.com”, “Host” in HTTP Header andRequest headers in Search in.
     
6. Block download file .torrent.
   To block download any .torrent files by configure signature to “application/x-bittorrent”, “Content-Type” in HTTP Header and Request headers in Search in.
   
7. Block AOL Messenger.
   To block users to use AOL Messenger by configure signature to “Gecko”, “User-Agent” in HTTP Header and Request headers in Search in.
   
8. Block Yahoo Messenger.
   To block users to use Yahoo Messenger by configure signature to “msg.yahoo.com”, “Host” in HTTP Header andRequest headers in Search in.
   
9. Block Kazaa.
   To block users to use Kazaa by configure signature to “KazaaClient”, “User-Agent” in HTTP Header and Request headers in Search in.
   
10. Block free web mail. (e.g. hotmail.com, mail.yahoo.com, etc.)
    To block users to access free web mail, block any URL that contain string “mail” by configure on signature to mail.
    
11. Block post on web boards.
    Block users to sending any information to internet (e.g. post on web board) by configure to disallow HTTP method:POST.
    • Select on Methods tab and select block specified methods.
      
    • Click Add. New window appears, type “POST” on method and enter some description.
      
    • Don’t forget to apply the settings after configuration.
      
12. If the users are blocked by HTTP filter, they will see page like the figure.
    “Error Code: 500 Internal Server Error. The request was rejected by the HTTP filter.”
    

Summary

This is the end of this serie. After complete this serie, starting from install ISA Server, configure the network topology, configure basic rule, configure client types and configure HTTP filter, now you have basic knowledge and understanding how to operate ISA Server on your own. But there are some configurations, I don’t cover for instance how to configure cache on ISA Server, how to implement VPN, etc. If you need more information, try visit ISA Server.org

I think these tutorials may be useful for starter who want to implement Microsoft ISA Server 2006 or some administrators who want to reviews configurations. If you have any problems or any suggestion, feel free to leave some comment below.

Getting started with Microsoft ISA Server 2006, Part IV: Configure Client Type

Introduction

After completed part III, you have done basic configurations on ISA Server. In this part, you’re going to configure on client computer to be one of these types: SecureNAT Client, Firewall Client or Web Proxy Client. You can see more detail in topic below.

Client Types

The table below compares the ISA Server clients.

Feature\ Client types	SecureNAT client	Firewall client	Web Proxy client
Installation required	Some network configuration changes may be required	Yes	No, Web browser configuration required
Operating system support	Any operating system that supports Transmission Control Protocol/Internet Protocol (TCP/IP)	Only Windows platforms	All platforms, but by way of Web application
Protocol support	Application filters for multiple connection protocols required	All Winsock applications	Hypertext Transfer Protocol (HTTP), Secure HTTP (HTTPS), File Transfer Protocol (FTP), and Gopher
User-level authentication	Some network configuration changes required	Yes	Yes
Server applications	No configuration or installation required	Configuration file required	Not applicable

Configurations

On this section, I will how to configure each client type on a client computer. You only select one of these three client types configurations.

1. SecureNAT client
   To configure SecureNAT client, only change gateway in network properties to ISA Server
   • Open Network Connection Properties on client computer.
     
   • On Network Properties, select Internet Protocol(TCP/IP) and click Properties.
     
   • On Internet Protocol(TCP/IP) Properties, change IP Address on default gateway to ISA Server.
     
2. Firewall client
   • Download Firewall Client for ISA Server at Microsoft or at here – Microsoft Firewall Client.
   • Run setup program, set the ISA Server DNS name or IP Address on ISA Server Computer Selection page.
     
   • After install, you’ll see icon as the figure below in task icon. The green color means the client has successfully connected to ISA Server. If the red shows, the client can’t connect to ISA Server. You can double-click on icon to see more detail.
     
   • If you have double-clicked on previous step, select Settings tab and you can verify that ISA Server Selection is type correctly or not. Also, click on Apply Default Settings Now for other users on this computer can use this configuration,too.
     
3. Web Proxy client
   • Open Web browser. In this example, I demonstate on Internet Explorer.
   • On menu bar, select Tools -> Internet Options.
     
   • On Internet Options, select Connections tab and click on LAN Settings.
     
   • On Local Area Network (LAN) Settings, set Address and Port to your ISA Server configuration.
     Note: By default, Web proxy port is 8080.
     

Reference

http://technet2.microsoft.com

Getting started with Microsoft ISA Server 2006, Part III: Create Firewall Policy Rule

Getting started with Microsoft ISA Server 2006, Part III: Create Firewall Policy Rule

Firewall Policy

From part II, you have configured Network Topology. Now you need to create a policy rule to allow traffic pass through the ISA Server.

By default, ISA Server is configured with default rule which blocks all traffics pass through ISA Server. But you can customize rules to match your policy in organization. On each rule, you can customize to allow or deny access, protocols, source and destination addresses, users (ISA Server can integrated with Active Directory), time to use the rule, content types.

Step-by-step

Next, I will create a new web access rule for all users in internal network to access internet(external network) with only HTTP (port 80) and HTTPS (port 443) protocols.

1. Open ISA Server Management. Expand server name(in this example, BKKFRW001) -> Right click on Firewall Policy -> New -> Access Rule.
   
2. New Access Rule Wizard appears, enter the name of access rule. Click Next.
   
3. On Rule Action, select Allow. Click Next.
   
4. On Protocols, click Add. Add Protocols window appears, expand Common protocols and select HTTP and HTTPS.
   
5. On Access Rule Sources, click Add. Add Network Entities window appears, expand Networks and select Internal.
   
6. On Access Rule Destinations, add External network.
   
7. On User Sets, leave All Users. Click Next.
   
8. Click Finish to complete create new rule.
   
9. Again, don’t forget to apply your setting on ISA Server to take effect. Click Apply.
   
10. Next part will be about client configuration to access to ISA Server.

Getting started with Microsoft ISA Server 2006, Part II: Configure Network Topology

Getting started with Microsoft ISA Server 2006, Part II: Configure Network Topology

Network Topology

From Part I, you have finished install ISA Server 2006. Before using the server, you need to do some configurations first. On Getting Started with ISA Server 2006 page on ISA Server Management, there are 5 steps for set up ISA Server as the figure below.

To use ISA Server, only first 2 steps on the figure above are needed to be configured so this part will shows how to configure Network Topology on ISA Server which is the first step in the figure above. For the second step, I will cover in the next part(part III). Also, you need to enable client to access ISA Server by configure on clients,too. Client Configuration will be 

The series are divided into 5 parts:

ISA Server 2006 comes with many defined templates. Here are some details of each template. You can select one of them that match your network.

1. Edge Firewall
   

   This is a standard network topology for small to medium organization. The ISA Server is a main gateway controlling traffic between intranet and internet. The ISA Server needs 2 network interfaces.

2. 3-Leg Perimeter
   

   This is a standard network topology for medium to large organization. There are another network which is Perimeter network adding to ISA server compare to edge firewall. The perimeter network or DMZ (Demilitarized Zone) is a network that is less secure for serving Web server, E-Mail server, DNS server,etc so that internet users can access these services without access to internal network. The ISA Server needs 3 network interfaces.

3. Front Firewall
   

   This is a network topology for organization that security is high priority. In this case, there are more than 1 firewall server. When hacker attacks the server and one fails, there is still back firewall to protect your internal network. This template, ISA Server will be act as front firewall server between internet and perimeter network and needs 2 network interfaces.

4. Back Firewall
   

   This is a network topology for organization that security is high priority. The configuration is the same as in Front Firewall template except that the ISA Server that you’re configuring is the back firewall that serperate internal and perimeter network.This template, ISA Server needs 2 network interfaces.

5. Single Network Adapter
   

   This is a network topology for ISA Server to be act as Proxy server only. ISA Server can do caching to improve performance for users using Internet in organization. This template, ISA Server requires only a single network interface as the name of the template.

Note: For Front and Back Firewall templates, you have more than one firewall servers. It is best practice that you should use different firewall software or using hardware firewall with software firewall not the same on front and back. If hacker can destroy the front firewall, you still have back firewall which the hacker can’t use the previous technique to attack the firewall.

Step-by-step

This example will configure ISA Server 2006 using Edge Firewall template.

1. Open ISA Server Management.
   1. On left window, expand Configuration and select Networks
   2. On right window, select Templates tab.
   3. Click on Edge Firewall template. Network Template Wizard window appears.
   
2. Click Next.
   
3. You can export your configurations before let the wizard overwrite the old one by click on Export button. Otherwise, click Next.
   
4. On Internal Network IP Addresses, you can configure your internel network IP Address. If the existing value is correct, click Next.
   
5. On Select a Firewall Policy, you can select firewall policy template. The description will display what will be configure on ISA Server. I select “Block all” to block all traffic between ISA Server. I will configure rules later in the the next part.
   
6. Click Finish to complete the wizard.
   
7. To make ISA Server takes effect, click on Apply.
   

Getting started with Microsoft ISA Server 2006, Part I: Installation

Getting started with Microsoft ISA Server 2006, Part I: Installation

ISA, Security, WindowsDecember 28th, 2007

Introduction

Microsoft Internet Security & Acceleration Server 2006 is a firewall and proxy product from Microsoft. It can protects local network from hackers, limit access for internet access, improve internet speed for users and also logging any connections that pass through ISA Server.

Or you can say that ISA Server is a gateway between intranet(LAN) and internet so it has more than one network interfaces usually it has 2 or 3 network interfaces depends on network topology(Edge firewall, 3-Leg Perimeter, etc.) in your organization.

The series are divided into 5 parts:

• Getting started with Microsoft ISA Server 2006, Part I: Installation
• Getting started with Microsoft ISA Server 2006, Part II: Configure Network Topology
• Getting started with Microsoft ISA Server 2006, Part III: Create Firewall Policy Rule
• Getting started with Microsoft ISA Server 2006, Part IV: Configure Client Type
• Getting started with Microsoft ISA Server 2006, Part V: Configure HTTP Filter

This post will show how to install ISA Server 2006 Standard Edition on a Windows 2003 Server which has 2 network interfaces: one is connected to internal network(LAN) and the other connected to external(Internet). The diagram is as below:

Step-by-step

1. Open ISA setup program.
   
2. Click Next.
   
3. Enter your license information. Click Next.
   
4. Select Setup Type. If you want to customize features or change installed directory, select Custom. Otherwise, select Typical. I leave Typical for convenience.
   
5. On Internal Network, you must enter your internal IP address range. You can do this by adding manually or select from network adapter. Before click Next, ensure that your network addressed was configured correctly.
   
6. On Firewall Client Connections, if you haven’t upgrade from previous ISA Server(ISA 2000 or 2004), leave the check box uncheck and click Next. Otherwise, check the check box before continue.
   
7. On Service Warning, click Next. Notice that some of services will be restarted or disabled while installing.
   
8. Click Install.
   
9. Wait for install finishes.
   
10. You can check “Invoke ISA Server Management when the wizard closes” if you want to configure ISA now.
    
11. Now you have finished installing ISA Server 2006. For configure the ISA details, continue on the next part.