- Introduction
- Considering Current Infrastructure Issues
- Considering Cost and Complexity
- Chapter Summary
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Considering Current Infrastructure Issues
Before deciding what systems should be implemented as which type of ISA Server client, you should take the time to understand the client types, determine the appropriate options available to each current client system, and determine the network infrastructure changes that might have to be made. To do so consider:
ISA Server client types
Using multiple clients on a single computer
Proxy 2.0 client migration
Introducing ISA Server Client Types
The first step in planning deployment of client types is to match ISA Server client capabilities with your user requirements and policy dictates. The second step is to match ISA Server client availability with your client operating systems. Where these two matching decisions cannot be both resolved, that is, where you'd like to use a particular ISA Server client but you can't with the current client OS, you must make a decision regarding accepting less functionality, or upgrading or changing the client OS.
There are three ISA Server client types:
SecureNAT clientWeb proxy client
Firewall client
Table 13.1 summarizes the ISA Server client types.
Table 13.1 Distinguishing Client Types
|
Client Type |
Client Configuration Necessary |
Protocols That Can Be Used to Access Internet Resources |
Client OS Required |
Requirements |
ISA Server Mode |
|
SecureNAT |
Possible -- client default gateway set to ISA Server internal interface |
Requires ISA Server application filters |
Any |
TCP/IP; Internet requests are routed to ISA Server; |
Firewall, Integrated |
|
Web proxy |
Configure browser |
HTTP, HTTPs, FTP, Gopher |
Most any |
Web application can be configured to use proxy |
Caching, Integrated |
|
Firewall |
Install client |
Winsock applications |
Win32 |
Configuration file |
Firewall, Integrated |
SecureNAT Client
Every client computer on the internal network that does not have the firewall client installed and can access the Internet through the ISA Server is a SecureNAT client. This includes servers that are published through ISA Server publishing rules. SecureNAT clients are not supported in Caching mode. While the SecureNAT client does not allow for user-level authentication, many of the benefits afforded to Firewall and Web proxy clients are also available to them. Specifically:
HTTP requests are cached affording faster retrieval and efficient use of Internet access
Most access control features. HTTP requests are passed to the Web proxy service for site and content rule application.
ISA Server Applications filters can be used to access complex protocols.
NOTE
NAT vs. SecureNAT The name SecureNAT was chosen because it extends Windows 2000 NAT by enforcing ISA Server policies. SecureNAT hooks into the Windows 2000 NAT service.
Changes to the network infrastructure to support SecureNAT clients are minimal. You must ensure that all requests for Internet access from the client are routed to the internal network interface of the ISA Server. This may mean router changes, or changes to the client network configuration.
Web Proxy Client
Potential Web proxy clients are those that run Web access applications, such as a Web browser, that can be directed to a proxy server. There are no special network infrastructure changes due to the use of Web proxy clients. However, several techniques may be used to reduce the efforts necessary to configure Web proxy clients. Configuration can be done by:
Visiting clients and manually modifying browser configuration.
Using ISA Server Management to set automatic configuration for firewall clients (the Web proxy configuration is downloaded during installation of firewall client software).
Using Group Policy I.E. settings to manage Web proxy configuration.
Using ISA Server Management to enable automatic discovery and modifying Web browsers to use automatic discovery. If the ISA Server cannot respond directly to client requests, DHCP servers and/or DNS servers can be configured to provide Web proxy Autodiscovery Protocol (WPAD).
NOTE
Not Just for Browsers Any application that accesses the Internet is potentially a Web proxy client. It must, however, have the capability to use a proxy server and be compliant with Hypertext Protocol 1.1. You can determine if your application can use a Web proxy by investigating if it has a place to input the IP address of a Web proxy server. If it does, configure the application with the internal network IP address of the ISA Server and the 8080 port and attempt access to the Internet.
Firewall Client
A client can only be a firewall client if they have ISA Server firewall client software installed. This client runs Winsock applications that use the ISA Server firewall service. The firewall client is not supported in cache mode. Firewall clients software is installed from a network installation share and may be installed on Windows operating systems including:
Windows 2000
Windows NT 4.0
Windows Me
Windows 98
Windows 95
Support is available for 16-bit (Windows NT 4.0 and Windows 2000 only) and 32-bit Winsock applications. Firewall clients will first determine the location of the object they need by looking at a copy of the ISA Server LAT. If the computer on which the object is located is itself located in the internal network, then the client will access it directly, if not, it will forward its request to the ISA Server. Installing the firewall client installs several components:
mspclnt.ini. Client configuration file and copy of the local domain table (LDT).
msplat.txt. Copy of LAT. This file is updated regularly so that it matches the ISA Server LAT.
The firewall client application.
Using Multiple Clients on a Single Computer
Multiple ISA Server clients can be used on a single computer. This allows the ISA Server client to obtain the best benefits of all the clients.
Configuring the client computer as a SecureNAT client enables basic Web access and caching, as well as allows the client to utilize application filters to access other objects on the Internet. Although the SecureNAT client cannot provide authentication, access rules can restrict client access by IP address, schedule, protocol, and destination requested.
Adding the Web proxy client information to the Web browser provides more direct, efficient access to the Web proxy service. (SecureNAT clients use the firewall service and Web protocols are then passed to the Web proxy service.) Web proxy clients can also provide authentication information if required to do so by the ISA Server.
By installing the Firewall client, authentication will always be passed to the ISA Server, and the client can directly inform the firewall service of the needs of the application it is using. (Ports required for Firewall client access can be dynamically opened and closed; ports required by SecureNAT client requests must be statically configured.)
Migrating Proxy 2.0 Clients
Proxy 2.0 clientseither used the Proxy 2.0 Web proxy service or the Proxy 2.0 Winproxy service. Winproxy clients required the installation of the winproxy client application. Web proxy clients had their browsers pointed to the Proxy 2.0 server.
If Proxy 2.0 Winproxy clients were configured for automatic discovery, then it may not be necessary to reconfigure these clients to enable them to use the ISA Server, or to install the Firewall client. You may only need to assure that the ISA Server is configured correctly and that Winproxy clients are able to locate the server.
Web proxy clients may need to have their browsers specially pointed at the ISA Server and reconfigured to use port 8080.
You may also want to upgrade Winproxy clients by installing the Firewall client. This provides a more efficient processing of requests and the capability to use information in the LDT.