Isa 2006 lab p1

ISA Server Tài liệu thực hành dành cho học viên

VSIC Education Corporation Trang 1

Mục lục

Module 1: Overview of Microsoft ISA Server 2004............................................................. 2

Module 2: Installing and Maintaining ISA Server ................................................................ 2

Module 3: Enabling Access to Internet Resources ............................................................. 17

Module 4: Configuring ISA Server as a Firewall ............................................................... 33

Module 5: Configuring Access to Internal Resources......................................................... 40

Module 6: Integrating ISA Server 2004 and Microsoft Exchange Server .......................... 79

Module 7:Advanced Application and Web Filtering .......................................................... 96

Module 8: Configuring Virtual Private Network Access for Remote Clients and Networks......................................................................... 103

Module 9: Implementing Caching .................................................................................... 141

Module 10: Monitoring ISA Server .................................................................................. 150



ISA 2006

Module 1: Overview of Microsoft ISA Server 2004

Module 2: Installing and Maintaining ISA Server Xaây döïng moâ hình vaø khai baùo ip cho caùc pc nhö hình veõ.

Lab 1: Caøi ISA server

1. Vaøo thö muïc chöùa source ISA double click vaøo file ISAAutorun.exe



2. Xuaát hieän cöûa soå Microsoft ISA server 2006 setup, choïn Install ISA server 2006 next

3. Choïn option I accept the terms in the license agreement next





Nhaäp vaøo CD key next

4. Choïn option Typical hay Custom ñeàu ñöôïc next next

5. Aán add roài aán add range nhaäp vaøo daõy ip internal cuûa ISA ok next



6. Taát caû caùc cöûa soå coøn laïi aán next cho ñeán khi caøi ISA xong

Lab 2: Taïo access rule cho internal vaø maùy ISA ra internet. 1. Vaøo start programs Microsoft ISA server ISA server management, Click

phaûi vaøo Firewall Policy choïn New Access Rule, ñaët teân cho access rule next

2. Choïn Option Allow next, choïn Selected protocols aán Add choïn caùc protocol nhö

hình veõ next



3. Taïi cöûa soå Access Rule Sources aán Add choïn Internal vaø Local Host next

4. Taïi cöûa soå Access Rule destinations aán Add choïn External next



5. Taïi cöûa soå user sets choïn All users next finish

6. Aán Apply



Lab 3: Client truy caäp internet duøng SecuNat

1. Taïi maùy client khai baùo Ip ñaày ñuû caùc thoâng tin sau ok

2. Vaøo IE truy caäp thöû vaøo trang http://www.vsic.com vaø caùc trang web khaùc



Lab 4: Client söû duïng proxy 1. Taïi maùy client khai baùo ip nhö sau: (khoâng coù GW vaø DNS)

2. Vaøo IE, vaøo menu tools choïn Internet Options, Choïn theû Connections, aán LAN

Setting



3. Check vaøo Use a proxy server for your LAN, nhaäp vaøo IP cuûa card INT ISA port

8080 ok ok

4. Truy caäp thöû vaøo trang http://www.vsic.com hay trang http://www.vsic.com/forum

Lab 5: Client söû duïng firewall client 1. Taïi maùy client khai baùo nhu hình veõ:



2. Vaøo oå ñóa chöù source ISA server 2006 choïn thö muïc Client, double click vaøo file

setup.exe hay file MS_FWC.MSI ñeå caøi firewall client.

3. Choïn option I accept the terms in the license agreement next next



4. Choïn option Connect to this ISA server computer, nhaäp vaøo IP internal cuûa maùy

ISA next ( neáu coù DNS server, taïo alias laø WPAD cho card internal cuûa ISA thì ôû cöûa soå naøy choïn option Automatically detect the appropriate ISA server computer)

5. Truy caäp vaøo trang http://www.vsic.com hay trang http://www.vsic.com/forum ñeå

kieåm tra. Lab 6: Backup and Restore

1. Click phaûi vaøo firewall policy choïn Export next



2. Coù theå ñaët password cho file backup next

3. Choïn oå ñóa caàn löu file backup next Finish. 4. Choïn access rule Allow Internet choïn delete



5. Click phaûi vaøo firewall policy choïn Import next, choïn file caàn restore next

6. Tieáp tuïc aán next finish





Module 3: Enabling Access to Internet Resources Xaây döïng moâ hình nhö module 1, caøi ISA server vaø taïo rule ra internet Lab 1: Taïo theâm protocol

1. Ñöùng taïi maùy client truy caäp trang http://www.itvietnam.com.vn:8099/feedback, khoâng truy caäp ñöôïc vì trang naøy söû duïng port 8099 caàn phaûi taïo theâm protocol cho port naøy.

2. Choïn Firewall policy choïn theû Toolbox , choïn protocols new protocol (nhö hình veõ)

3. Goõ vaøo teân cuûa protocol next

4. Aán nuùt New



5. Choïn Protocol type, Direction, vaø Port range ( nhö hình veõ) next

6. Tieáp tuïc aán next



7. Taïi cöûa soå Secondary Connections choïn Option No next finish

8. Click phaûi vaøo Rule Allow Internet choïn Properties, choïn theû Protocols, aán nuùt add

choïn User-Defined choïn port vöøa taïo aán add



9. Ok Apply. Ñöùng taïi maùy client truy caäp thöû vaøo trang

http://www.itvietnam.com.vn:8099/feedback luùc naøy ñaõ truy caäp thaønh coâng

Lab 2: Taïo URL set

1. Ví duï ta caàn caám khoâng cho Client internal truy caäp vaøo trang http://www.tuoitre.com.vn tröôùc tieân ta phaûi taïo URL set

2. Choïn Firewall policy, choïn theû Toolbox, choïn network Objects New URL set



3. Goõ vaøo teân cho URL set aán nuùt Add goõ vaøo trang web caàn caám next

4. Neáu muoán caám theâm trang naøo chæ caàn aán nuùt Add vaø goõ vaøo ñòa chæ cuûa trang ñoù 5. Click phaûi vaøo Firewall policy choïn New Access rule goõ vaøo teân rule ví duï laø

Deny Tuoitre next choïn Option Deny next



6. Taïi cöûa soå Protocols choïn All Outbound traffic next

7. Taïi cöûa soå Access Rule Sources aán nuùt Add choïn Internal next



8. Taïi cöûa soå Access Rule Destinations aán nuùt Add choïn URL sets choïn tuoitre

next

9. Tieáp tuïc aán next finish Apply



10. Taïi maùy client truy caäp vaøo trang http://www.tuoitre.com.vn luùc naøy khoâng theå truy

caäp ñöôïc nöõa Lab 3: Taïo computer vaø Computer set

1. Giaû söû ta caàn caám PC10 coù IP laø 200.200.200.10, PC11 coù IP laø 200.200.200.11 vaø PC12 ñeán PC15 coù IP töø 200.200.200.12 – 200.200.200.15 truy caäp Internet ta caàn phaûi taïo Computer hay Computer set.

2. Choïn Firewall policy, choïn theû Toolbox, choïn Network Objects computer

3. Goõ vaøo teân pc name vaø Ip cuûa PC caàn taïo Ok



4. Töông töï nhö böôùc 1 nhö choïn Computer set, nhaäp vaøo teân aán add choïn Computer

nhaäp vaøo pc11 vaø IP cuûa PC11, tieáp tuïc aán nuùt add choïn address range nhaäp vaøo daõy IP töø Pc12 ñeán pc15 OK



5. Baây giôø ta ñi taïo access rule ñeå deny caùc computer vaø computer set. Click phaûi vaøo Firewall Policy New Access Rule ñaët teân cho rule next choïn All outbound traffic next

6. Choïn option deny next

7. Taïi cöûa soå Access rule source aán Add choïn Computers double click vaøo PC10,

choïn Computer sets doublr click vaøo PC11—pc15 close next



8. Taïi cöûa soå Access Rule Destinations aán Add choïn External next next

Finish

9. Aán Apply



10. Ñöùng taïi PC10 truy caäp thöû internet, luùc naøy PC10 khoâng truy caäp ñöôïc nöûa

Lab 4: Taïo Schedule 1. Giaû söû ta muoán cho caùc user internal chæ ñöôïc pheùp truy caäp internet töø 8 :00 –

12 :00. Ta taïo Schedule 2. Choïn Firewall Policy, choïn Schedules new, nhaäp vaøo teân vaø thôøi gian cho pheùp

truy caäp OK



3. Click phaûi vaøo rule Allow Internet choïn Properties

4. Choïn theû Schedule, choïn Schedule8h-12h ok, Apply



5. Taïi maùy client chænh laïi giôø laø 9:00 sau ñoù truy caäp thöû internet, luùc naøy khoâng truy

caäp ñöôïc nöûa Lab 5: Taïo Network vaø network set

1. Choïn Configuration, choïn networks, choïn theû networks, choïn tieáp theû tasks ôû cöûa soå beân phaûi choïn Create a new network choïn Internal network next



2. Taïi cöûa soå Network Address aán Add range, nhaäp vaøo daõy IP caàn duøng ok next

finish Apply

3. Choïn theû Network sets, ôû theû tasks beân phaûi cöûa soå choïn Create a new netword set

Ñaët teân cho network set next



4. Check vaøo internal vaø internal2 next finish apply



Module 4: Configuring ISA Server as a Firewall Xaây döïng moâ hình nhö hình veõ

Lab 1: Duøng Templates Muïc ñích: Caáu hình isa server baèng template

1. Vaøo Isa, Choïn Configuration\networks, ôû cöûa soå beân phaûi choïn tab templates choïn template Edge Firewall.

2. Xuaát hieän maøn hình welcome next



3. Neáu isa ñaõ ñöôïc caáu hình tröôùc ñoù muoán löu laïi caáu hình ñoù aán export choïn oå ñóa

vaø file caàn löu. Neáu khoâng muoán löu caáu hình tröôùc ñoù aán next

4. Nhaäp vaøo daõy IP cuûa internal next



5. Choïn firewall policy phuø hôïp, trong tröôøng hôïp naøy choïn Allow limited web

access (Taïo rule ra net) next finish .

6. Caùc rule ñaõ ñöôïc taïo töï ñoäng.



7. Truy caäp thöû web site http://www.vsic.com/forum --> truy caäp thaønh coâng

8. Töông tö nhö treân neáu caàn xaây döïng moâ hình 3-leg ta cuõng coù theå söû duïng template

cho moâ hình naøy, chæ ñònh daõy IP cho ineternal, daõy Ip cho perimeter.



9. Choïn firewall policy phuø hôïp

10. Vaø cuõng seõ coù nhöõng rule ñöôïc taïo saün



Lab 2: System policy.

1. Vaøo ISA, choïn Firewall policy, ôû cöûa soå beân phaûi choïn Show System Policy Rules, seõ xuaát hieän 30 system policy.

2. Aán Edit system policy khi caàn chænh söûa policy system



3. Giaû söõ caàn cho caùc maùy internal ping ñeán ISA, choïn rule ICMP (ping) choïn theû

From add Internal, local host ok apply. Luùc naøy töø maùy client coù theå ping maùy ISA

Lab 3: Configuring Intrusion Detection (Xem lab 3 module 10)

Technology

Isa 2006 lab p1