Alexander’s Blog

Check out these MSDN Virtual Labs and TechNet Virtual Labs if you haven’t already. These are a series of guided, hands-on labs which can be completed in 90 minutes or less. The best part is these labs don’t require any installation and are available to you immediately for FREE. Here are the topics that are currently available to you.

MSDN Virtual Labs

ASP.NET 2.0
ASP.NET
BizTalk Server
Commerce Server
Fritz Onion’s Intro to ASP.NET
Internet Information Services (IIS)
JPlusN (J+N)
Microsoft Expression
.NET Framework 3.0
Soup to Nuts
Visual Studio
Visual Studio 2008
Visual Studio Team System
Visual C#
Visual J#
Visual Basic
Visual C++
Connected Systems
Data Access and Storage
Office
Security
Smart Client
SQL Server 2005
SQL Server 2005 Upgrade
Visual SourceSafe
Web Services
Windows Embedded CE 6.0
Windows Live
Windows Mobile
Windows Vista
Windows XP Embedded
TechNet Virtual Labs

TechNet Virtual Labs

Antigen
BizTalk Server
Configuration Manager
Enterprise Search
Exchange Server
Forefront Security
Groove Server
Identity Integration Server (MIIS)
Internet Information Services (IIS)
Internet Security and Acceleration (ISA) Server
Office Communications Server
Office System
Operations Manager
SQL Server 2005
SQL Server 2000
SharePoint Server
Systems Management Server (SMS)
Windows Mobile
Windows Rights Management Services (RMS)
Windows Server 2003 R2
Windows Server 2008
Windows SharePoint Services
Windows Small Business Server
Windows Vista

With the release of ISA Server 2004 Service Pack 2 (SP2), Microsoft extends branch office interoperability with several new features that can help companies quickly, efficiently, and securely integrate branch offices into an organization’s computing ecosystem.

ISA Server 2004 SP2 also includes a number of additional updates and changes to elivate the performance and usability of ISA Server 2004. The following are technical changes included in ISA Server 2004 SP2:

1. Support for Microsoft Windows Server 2003 R2 and other R2-related releases (for example, Microsoft SQL Server 2005)

2. Improvements in the Cache Array Routing Protocol mechanism

3. New certificate alerts

4. Service Quality Monitoring (SQM) support (also known as Opt-in Customer Experience Improvement Program)

5. All accumulated Hotfixes through 11/1/2005

Microsoft has joined with key Original Equipment Manufacturers (OEMs) to bring Internet Security and Acceleration (ISA) Server 2004-based security appliances to market. These solutions combine the best of ISA Server 2004 with a hardened version of Microsoft Windows Server 2003 and optimized hardware so they are ready to deploy right out of the box.

Key benefits include:

1. Hardware comes preloaded, preconfigured, and pretested with ISA Server 2004.

2. Hardened configuration for reduced attack surface.

3. Easy to purchase, set up, and deploy.

4. Out-of-box configuration tools and Web-based administration available (on some models from some OEMs).

A list of hardware vendors that have partnered with Microsoft is available here. For hardware FAQs for ISA Server 2004, click here.

More info…

Microsoft has just released three updated tools for ISA Server 2004.

MSDEToText.vbs tool allows you to display the contents of an MSDE Firewall and Web Proxy log on screen, or you can write it to a text file.

CacheDir.exe is an updated version of the previous tool that allows you to view the ISA Server 2004 cache contents in real-time. You can also save the contents of your cache to a file and mark items as obsolete so they are no longer served to the clients.

Remote Access Quarantine Tool for ISA Server 2004 is meant to prepare your ISA Server 2004 running on Windows Server 2003 as an RQS listener component.

ISA Server allows you to configure Virtual Private Networks (VPNs) so you can create a Point-to-Point Protocol (PPTP) or Layer 2 Tunneling Protocol (L2TP) over IPSec tunnels to the ISA Server. ISA Server also allows you to create site-to-site VPN tunnels. However, in some cases hosting VPNs on the ISA Server itself is not enough. In situations where you may be using a third-party VPN server, or if you want to host a VPN server on the internal network for your clients, you may be interested in setting up a VPN behind the ISA Server firewall on your private network.

You can configure VPN client access in ISA Server Management Console which allows VPN access to the ISA Server computer, not to another server on the private network. Normally you wouldn’t want your users to be tunneling into the ISA Server. You would want them to tunnel into a server behind the ISA Server firewall.

In this article we will learn how to configure a VPN server on the private network and configure ISA Server with the rules required to publish an internal VPN server. You can either use PPTP or L2TP over IPSec tunnel. Compared to L2TP over IPSec, PPTP is much easier to configure so we will use PPTP in this document.

Here’s what our scenario looks like.

The first thing you need to do is to install and configure your VPN server. The procedure for configuring a VPN server on a Windows Server 2003 is described in the KB article How To Install and Configure a Virtual Private Network Server in Windows Server 2003. Because we will use server publishing feature on the ISA Server, the VPN server should be using the private interface of ISA Server as its default gateway. In our scenario this will be the interface using IP address 10.0.0.1.

Creating a Server Publishing Rule
As mentioned above, we will use PPTP to publish our VPN server. This requires a server publishing rule on the ISA Server computer.

1. Open ISA Server Management console and select Firewall Policy.

2. In the task pane on the right hand side click on the Tasks tab.

3. Click on Create New Server Publishing Rule.

We will use the screen shots to look at the rest of the steps.

10.0.0.2 is the IP address of the internal VPN server that you are publishing through the ISA Server.

Selecting PPTP Server will configure inbound TCP port 1723 for VPN. It will also use the built-in PPTP filter on the ISA Server.

If you have more than one IP addresses on your external interface and you want to publish VPN server on all of them then you need to make sure that ISA Server listens on all of those networks. In our example we are only using one IP address on the external interface so will only configure ISA Server to listen on the External network.

Don’t forget to enable VPN access for clients either through Remote Access policy or through Active Directory in the users’ account properties or else users will not be able to create VPN connections.

For a printer friendly version of this article, click here.