About Context-sensitive Help

About this Help file

This Help file contains context-sensitive Help for dialog boxes. You can view this Help by clicking the ? button in a dialog box. For overviews of features and help with specific tasks, in ISA Server Management, click F1.


Access Rule: Action Tab

Determines the action that will be taken if all the conditions specified in the rule are met.

Allow
Specifies that a request will be allowed if it meets the conditions of the rule.
Deny
Specifies that a request will be denied if it meets the conditions of the rule.
Redirect HTTP requests to this Web page
Specifies that when a Hypertext Transfer Protocol (HTTP) request is rejected, ISA Server will return an object at a different URL to the user.
You must type the complete URL, using the following format:
http://URL. For example, type http://widgets.microsoft.com/Denied.htm.
Log requests matching this rule
Specifies that client requests that are allowed or denied by this rule will be saved in the applicable log.


Source Ports

Specifies if access should be limited based on the source port.
Allow traffic from any allowed source port
Specifies that traffic will be allowed from any source port. Traffic will be allowed from any port on the allowed source clients, as specified on the From page.
Limit access to traffic from this range of source ports
Specifies that only traffic from a range of ports will be allowed. Only traffic from ports on the allowed source clients, as specified on the From page, will be allowed.


Access Rule: Protocol

Access Rule: Protocols

This rule applies to

Specifies if IP traffic using the selected protocols will be allowed or denied.

All outbound traffic. Select this option to apply the rule to all outbound IP traffic.

Selected protocols. Select this option to apply the rule to specific IP traffic.

All outbound traffic except selected. Select this option to apply the rule to IP traffic other than traffic sent using the selected protocols.

Protocols
Lists the protocols selected for this rule.

Add. Click to specify a protocol.

Edit. Click to open the properties of a selected protocol. User defined protocols may be edited.

Remove. Click to delete a selected protocol from the list.

Ports
Click to limit access based on source port.

For protocols used in access rules, protocol direction should be outbound. This allows traffic from the network entities specified as the rule sources to the network entities specified as the rule destinations.


Network Interfaces

Network Adapters

Name
Displays a list of the network adapters on the ISA Server computer. To add a network adapter to the network configuration, select the check box.


Network Entities

List of network entities
Shows the list of network entities that may be selected. To view all the network entities available in a folder, click the expand icon.
Add
Click to define a new network entity.
Edit
Click to modify the properties of a selected network entity. Some built-in network entities cannot be modified.
Delete
Click to delete a selected network entity.


Address Range: General

Defines a set of IP addresses as an address range network object. You can apply access rules or publishing rules to the address range.

Name
Provides a space to type the name.
Start Address
Provides a space to type the first address in the address range.
End Address
Provides a space to type the last address in the address range.
Description
(Optional) Provides a space to type a description.


Set Account

Alerts: Set Account

Specifies the account details used to run a program when the alert is triggered.

Local System Account
Specifies that the local system account will run the program. You can configure which credentials will be used when an application is run.
User name
Specifies that a user account will run the program. You can configure which credentials will be used when an application is run. The specified user should have Logon as batch job privileges.
Browse
Click to select the user name.
Password
Provides a space to type the password for the user account.
Confirm Password
Provides a space to confirm the password for the user account.


Alerts: Actions

Specifies the alert action that will occur when the event triggers the alert.

Send e-mail
Specifies that an e-mail message will be sent when the alert conditions are met.
SMTP Server
Provides a space to type the IP address or name of the Simple Mail Transfer Protocol (SMTP) server.
From
Provides a space to type the e-mail address of the sender.
To
Provides a space to type the e-mail address of the recipient.
Cc
Provides a space to type the e-mail address of the person who receives a copy of the e-mail message.
Test
Click to send a test e-mail message. A test e-mail message will be sent, as specified. You will be notified whether the e-mail message was successfully sent.
Run Program
Specifies that a program will be executed when the alert conditions are met.
Run this program
Provides a space to type the location and name of the program you want to run. If you are not sure of the program's location or file name, click Browse.
Browse
Click to browse through folders to find the file you want.
Use this account
Displays the name of the selected user account or local system account that will be used to run the specified program.
Set account
Click to select which account to use when running the specified program.
Report to Windows event log
Specifies that the event will be written to the Windows event log when the alert conditions are met.
Stop selected services
Specifies that the selected services will be stopped when the alert conditions are met. If you set the alert actions to stop and start a service, the service is first stopped and then restarted.
Select
Click to select which services to stop.
Start selected services
Specifies that the selected services will be started when the alert conditions are met. If you set the alert actions to stop and start a service, the service is first stopped and then restarted.
Select
Click to select which services to start.


Alert: Events

Alerts: Events

An event is an action that occurs as the result of an exception in ISA Server. When an event occurs, an alert is triggered according to the conditions and trigger thresholds specified for the event.

Event
Displays a list of events defined by ISA Server.
Description
Displays a description of the event.
Additional condition
When applicable, displays a list of additional keys for the selected event. An additional key means an additional condition that must be fulfilled for the alert to be triggered.

Specify how many times the event will occur before the alert is triggered. Select one or more of the following:

Number of occurrences
Specifies a threshold level of how many events will pass before the alert is reissued. If a value is entered, and a value is also entered in Number of events per second, both limits must be reached before an alert is reissued.
Number of events per second
Specifies that the alert will be reissued if the specified number of events occur per second. If a value is entered, and a value is also entered in Number of occurrences, both limits must be reached before an alert is reissued.

Each recurring time the threshold are met, specify when the alert will be triggered.

Immediately
Specifies that the action will be executed immediately after the specified conditions occur.
Only if the alert was manually reset
Specifies that the action will be executed only after the alert is manually reset.
If time since last execution is more than
Specifies that the action will be executed, if it was executed before the specified number of minutes.
In the minutes text box, specify how many minutes will pass before the action will be executed again.


Rule: Content Groups

Alerts: Alert Definitions

Displays the full list of ISA Server alerts. An alert notifies you when specified ISA Server events occur. Alerts can be configured to trigger a series of actions as a result of these events.

Add
Click to define a new alert for a specified event and condition. When you add a new alert, you also configure the conditions that trigger the alert and the actions that will occur as a result.
Edit
Select an alert definition from the list, then click to modify the alert definition properties.
Remove
Click to delete a selected alert definition.
Refresh
Refreshes and updates the list from the COM.


Alerts: General

An alert notifies you when specified events occur. Alerts can be configured to trigger a series of actions as a result of these events.

Name
Provides a space to type the name of the alert.
Description
(Optional) Provides a space to type a description of the alert.
Category
Select the category to which this alert belongs: Security, Cache, Routing, Firewall Service, or Other. You can use the Monitoring view to sort and analyze all similarly categorized alerts, to help you troubleshoot the cause of the event.
Severity
Select the severity of the alert: Error, Warning, or Information.
Enable
Specifies that the alert is enabled. When the alert is enabled, the alert is triggered when the trigger thresholds are met.


Select ISA Server Services

Services
Displays a list of ISA Server services. To select a service, select the check box.


Application Usage Reports: Client Applications

This report shows the client applications which generated the largest amounts of network traffic during the report period. Application traffic includes all traffic except Web traffic.

Include this number of applications
Specify how many client applications will be included in the report. Client applications generating the largest amount of traffic will be listed first.
Sort Order
Select the criteria used to sort the columns in the report tables.

Requests. Sort according to the number of requests sent by a client application.

Users. Sort according to the number of users using a client application.


Application Usage Reports: Top Destinations

This report shows destinations most frequently requested by clients during the report period.

Include this number of destinations
Specify how many destinations will be included in the report. Destinations most frequently requested will be listed first.
Sort Order
Select the criteria used to sort the columns in the report tables.

Requests. Sort according to the number of requests sent to a destination.

Users. Sort according to the number of users who sent requests to a destination.

Bytes in. Sort according to the number of bytes received by a destination.

Bytes out. Sort according to the number of bytes sent from a destination.

Total bytes. Sort according to the total number of bytes sent to and received from a destination.


Application Usage Reports: Operating Systems

This report shows the operating systems that were most often used by computers accessing content through ISA Server during the report period.

Include this number of operating systems
Specify how many operating systems will be included in the report.
Sort Order
Select the criteria used to sort the columns in the report tables.

Requests. Sort by the number of requests sent by an operating system.

Users. Sort by the number of users using an operating system.


Application Usage Reports: Top Protocols

This report shows the communication protocols used most often to carry network traffic through ISA Server during the report period. This report will not include Web traffic, which is provided in the Web Usage report.

Include this number of protocols
Specify how many protocols will be included in the report. Protocols that were used most often will be listed first.
Sort Order
Select the criteria used to sort the columns in the report tables.

Requests. Sort according to the number of requests sent using a protocol.

Users. Sort according to the number of users who sent requests using a protocol.


Application Usage Reports: Top Users

This report shows the users who generated the largest amounts of application traffic through ISA Server during the report period.

Include this number of users
Specify how many users will be included in the report. Users who generated the most traffic will be listed first.
Sort Order
Select the criteria used to sort the columns in the report tables.

Requests. Sort according to the number of requests sent by a user.

Bytes in. Sort according to the number of bytes received by a user.

Bytes out. Sort according to the number of bytes sent by a user.

Total bytes. Sort according to the total number of bytes sent from and received by a user.


Network: Auto Discovery

Automatic discovery allows a seamless failover to an alternative server in case of failure in the main server. Automatic discovery also helps assure that roaming clients will get the best configuration possible whenever they log on, reducing time-consuming adjustments.

Publish automatic discovery information
Select this check box to specify that ISA Server will support automatic discovery for Web Proxy clients and Firewall clients.

When this option is selected, you should configure the DNS or DHCP server to include Web Proxy Automatic Discovery (WPAD). Web Proxy clients and Firewall clients will use the WPAD feature to automatically discover which ISA Server computer to use.
Use this port for automatic discovery requests
Provides a space to type the port that ISA Server will use to listen for automatic discovery requests. Typically, this is port 80.

If WPAD is configured through DNS, the default port must not be changed. With DHCP, you can publish automatic discovery information on an alternative port. In addition, ISA Server always listens on the Web Proxy HTTP listening port (when enabled) for automatic discovery requests (the default for this port is 8080).

  • To configure automatic detection for Web Proxy clients that are not configured as Firewall clients, enable automatic detection of settings in Internet Explorer. This option is relevant only to Internet Explorer 5 and later supporting browsers.


Cache Settings: Active Caching

Objects requested from the cache before they expire are considered active. Active objects in the cache can be automatically updated, as specified on this property page. ISA Server can automatically cache new content when expiration of old content is near, thus ensuring freshness of the most popular Internet objects. Active caching is configured according to the chosen policy.

Enable active caching
Specifies that ISA Server automatically caches new content when expiration of old content is near, thus ensuring freshness of the most popular Internet objects. If a dial-up connection is in use, the computer will dial out to the ISP to retrieve the content.
Frequently
Specifies that ISA Server will precache frequently. In this way, the client response will be faster, although the network performance may degrade.
Normally
Specifies that ISA Server will precache. Clients will perceive fast response, without degrading network performance.
Less frequently
Specifies that ISA Server will precache infrequently. In this way, the network performance will not degrade, although objects that are requested by the client may not be in the cache.
Restore Defaults
Click to reset active caching to disabled, which is the default setting.


Cache Settings: Advanced

Cache objects that have an unspecified last modification time
Specifies that ISA Server can cache objects that do not have a last modification time in the header. Dates and times in the header indicate when a request is received and a time for the request to expire on the network.
Cache objects even if they do not have an HTTP status code of 200
Specifies that ISA Server can cache objects that do not include an OK response (HTTP code 200). The applies to response codes: 203, 300, 301 and 410.
Maximum size of URL cached in memory
Provides space to type the maximum size of a URL in the memory cache (RAM).
Do not return the expired object (return an error page)
Specifies that if the source Web server of an expired object cannot be contacted, ISA Server will return an error page.
Return the expired object only if expiration was
Specifies that ISA Server will return the object only if it is in the cache. If it is not in the cache, it does not connect to the Internet to retrieve the object, and an error message is returned to the client. If you select this option, select one of the following:
  • At less than this percentage of original Time-to-Live. Type the maximum period in which ISA Server returns the expired object. The period is expressed in a maximum percentage of the original Time-to-Live (TTL) setting.
  • But no more than. Specifies that the expired object will not be returned if it expired more than the specified number of minutes ago, even if it is within the Time-to-Live specified above.
Percentage of free memory to use for caching
Provides space to type the percentage of available memory (RAM) that will be used for caching. The default is is 10 percent.
Restore Defaults
Click to set the following default policy:
  • Cache items if the last modification time is not specified.
  • Cache items that do not have a 200 OK response.
  • Return the expired object only if it expired less than 50 percent of the original Time-to-Live (TTL), but no more than 60 minutes.


Cache Drives

Enables caching by configuring the cache drives on the server.

Maximum cache size
Provides a space to type the size of the cache on the selected drive in the drive table. Only NTFS drives can be used for caching. Caching is enabled by defining cache size on at least one drive.
Set
Click to set the cache drive with the new value.
Reset
Click to set the cache drive size to 0.
Total disk space on NTFS drives
Displays the total space on all NTFS disk drives on the server.
Current total cache size
Displays the total size of all the cache drives on the server. If the total cache size is 0, caching is disabled.


Cache Rule: FTP

Enable FTP caching
Specifies that File Transfer Protocol (FTP) caching is enabled. When FTP caching is enabled, FTP objects are stored in the cache and expire in accordance with the specified Time to Live (TTL) settings.
Time-to-Live for FTP objects
Type the amount of time that FTP objects will remain valid in the cache. Also, select the time unit: Seconds, Minutes, Hours, Days, or Weeks.
Restore Defaults
Click to reset FTP expiration policy back to the default TTL setting (1 day).


Cache Configuration: General

Total cache size on the server
Shows the total amount of space allocated for the cache on the ISA Server computer.

If the total cache size on the server equals 0, then caching is disabled. Cache drive size is defined in the Cache Drives properties.


Cache Rule: HTTP

Enable HTTP caching
Specifies that Hypertext Transfer Protocol (HTTP) caching is enabled. When caching is enabled, HTTP objects are stored in the cache and expire in accordance with the specified policy.

Specify the Time to Live (TTL), which is the amount of time that content will remain valid in the cache before it expires.

Set TTL of objects
Provides a space to specify how long the HTTP objects remain in the cache, expressed as a percentage of the time of the content's existence. The higher the percentage, the less frequently the cache is updated.
No less than
Type the minimum amount of time that the HTTP objects remain in the cache. Select the time unit: Seconds, Minutes, Hours, Days, or Weeks.
No more than
Type the maximum amount of time that the HTTP objects remain in the cache. Select the time unit: Seconds, Minutes, Hours, Days, or Weeks.
Also apply these TTL boundaries to sources that specify expiration
Specifies that even if the source contains expiration data, its TTL will be overridden if it is not within the specified TTL boundaries.
Restore Defaults
Resets the settings to their defaults.


Cache Rule: Store and Retrieval

Specifies if and when objects in the cache will be retrieved from the cache.

Only if a valid version of the object exists in cache. If no valid version exists, route the request.
Specifies that ISA Server will only retrieve the object from the cache if it has not expired. If it has expired, it will be retrieved from the Internet according to the Web chaining rule.
If any version of the object exists in cache. If none exists, route the request.
Specifies that ISA Server will retrieve the object from the cache when available, even if it has expired. If the object is not found in the cache, it will be retrieved from the Internet, according to the Web chaining rule.
Any version of the requested object. If none exists, drop the request.
Specifies that the object will only be retrieved if it is in the cache, even if it is expired or invalid. If the object is not in the cache, an error page is returned.

Specify if and when objects will be stored in the cache.

Never, no content will ever be cached.
Specifies that ISA Server will not cache any content. This means that ISA Server will always request objects from the specified destination.
If source and request headers indicate to cache.
Specifies that ISA Server stores the object in the cache only if the source and request headers specifically indicate that the object can be cached.
If you select this option, you can also specify to cache one or more of the following:
  • Dynamic content. Specifies that ISA Server will cache retrieved objects even if they are marked as non-cacheable.
  • Content for offline browsing.
  • Content requiring user authentication for retrieval.


Cache Rule: General

Name
Provides a space to type the name.
Description
Provides a space to type a description.
Type
Displays the type of rule.
Evaluation order
Displays the order in which this rule is evaluated.
Enable
Specifies that the rule is enabled.


Cache Rule: Destination

Cache Rule: To

List of Destinations
Specifies that the cache rule will apply to content requested from the destinations listed.
Add. Click to specify a destination for the rule.
Edit. Click to view or edit the properties of a selected destination.
Remove. Click to delete a destination from the list.
List of Exceptions
Specifies that the cache rule will not apply to content requested from the destinations listed.
Add. Click to specify a destination as an exception for the rule.
Edit. Click to view or edit the properties of a selected destination.
Remove. Click to delete an destination from the list.


Cache Rule: Advanced

Do not cache objects larger than
Click to limit the size of objects that ISA Server will cache. Then, specify the maximum size of objects that ISA Server will cache.
Cache SSL responses
Specifies that SSL content will be cached.


Connect To

Local computer
Specifies that ISA Server Management will be used to manage the local computer.
Another computer (remote management)
Specifies that ISA Server Management will be used to remotely manage the specified computer. To specify the credentials for remote management, select one of the following:
  • Connect using the credentials of the logged on user. Select this option to administer the remote ISA Server computer, using the credentials of the user currently logged on.
  • Connect using other user credentials. Select this option to specify the name of a different user, who will remotely manage the ISA Server computer. Then, type the user name, password, and domain for the user who will remotely manage the ISA Server computer.


Network: Addresses

Address ranges
Displays a list of IP addresses from all the addresses included in the network. Each IP address can be included in only one network.
Add
Click to add a computer or range of computers to the network.
Edit
Click to modify a computer or range of computers in the network.
Remove
Click to remove a computer or range of computers from the network.
Add Adapter
Click to add addresses associated with a specific network adapter. (Not applicable for VPN remote site networks.)
Add Private
Click to add private addresses to the network. The private IP address ranges, as defined by the Internet Assigned Numbers Authority (IANA) in RFC 1918, will be added to the selected network. These three blocks of addresses are reserved for private intranets only and are never used on the public Internet. (Not applicable for VPN remote site networks.)


Network: Domains

Specifies the domain names that ISA Server should include in the local domain table (LDT).

The LDT is used by Firewall clients and Web browser clients to determine if name resolution should be done locally or forwarded to ISA Server.

When a Firewall client or Web browser client attempts to resolve a name, it checks the LDT. If the name is in the LDT, the client resolves the name directly. Otherwise, it requests that ISA Server resolve the name by passing the request to a DNS server on the Internet.

Domains
Displays the list of domain names included in the network.
Add
Click to add a domain to the network.
Edit
Click to modify a domain in the network.
Remove
Click to remove a domain from the network.


Network: Firewall Client

Enable Firewall Client support for this network
Specifies that Firewall clients can connect to this network.

Firewall client configuration:

ISA Server name or IP address
Provides a space to type the name of the ISA Server computer to which Firewall clients will connect. The server name should be unique. Using the fully qualified domain name (FQDN) will avoid any conflict with duplicated server names. Click Browse to find a computer to which Firewall clients will connect.

Web browser configuration on the Firewall client computer:

Automatically detect settings
Specifies that the client computer will automatically attempt to find the ISA Server computer.
When enabled, you can configure the DNS or DHCP server to include Web Proxy Automatic Discovery (WPAD). The Web Proxy client will use the WPAD feature to automatically discover which ISA Server computer to use for Web requests. This assures that roaming clients will always connect to the appropriate ISA Server computer when logging on to the Internet, reducing time-consuming adjustments. This is relevant only to Internet Explorer 5 and future supporting browsers.
Use automatic configuration script
Specifies that the Web browser of the client will use configuration information that is contained in the specified file, the automatic configuration script. This configuration script will automatically be available to the Web browser, and means you can update all Web browser settings without having to reconfigure each individual Web browser.

If you select this option, specify one of the following:
  • Use default URL. Specifies that the default client configuration script will be used. During setup, ISA Server creates a default URL that points to the location of the automatic configuration script. This default configuration script will automatically be available to the Web browser, and means you can update all client Web browser settings without having to reconfigure each individual Web browser.
  • Use custom URL. Specifies that a custom client configuration script will be used. As an alternative to the default configuration script, you can manually construct your own configuration script. When the Web browser looks for the configuration script, your custom script will be returned to the browser.
Use a Web proxy server
Specifies that Firewall clients connecting to this network will connect through a Web proxy server. When a Firewall client connects to the Web proxy server, its Web browser configuration will be updated.

ISA Server name or IP address
Provides a space to type the name or IP address of the ISA Server computer that will be used as the Web proxy server. Click Browse to find the Web proxy server to which Firewall clients will connect.


Set Account

User
Provides a space to type the user name. Or, click Browse to search for a specific user.
Password
Provides a space to type the user password.
Confirm password
Provides a space to confirm the user password.


Computer: General

Defines a specific computer as a network object. You can apply access rules or publishing rules to the computer.

Name
Provides a space to type the name for the network object.
Computer IP address
Provides a space to specify the IP address of the computer. Click Browse to find the internal IP address of a specific computer.


Computer Set: General

Defines a group of computers, address ranges, or subnets as a network object. You can apply access rules or publishing rules to the computer set.

Name
Provides a space to type the name of the computer set.
Computers, address ranges, and subnets included in the computer set
Displays the list of computers, address ranges, and subnets included in the computer set.
Add
Click to select a network object to add to the computer set: Computer, Address Range, or Subnet.
Edit
Click to modify the selected network object.
Remove
Click to remove the selected network object from the computer set.
Description
Provides a space to type a description for the computer set.


New/Edit Protocol Connection

Protocol type
Displays a list of low-level protocols. Select which low-level protocol to use for this protocol definition: ICMP, IP-level, TCP, or UDP.
Protocol number
Provides a space to type the protocol number, if you select IP-level. Otherwise, displays the protocol number associated with the low-level protocol.
Direction
Select the direction of the traffic. Direction options depend on the protocol type:
  • TCP. Outbound, Inbound
    For protocols used in access rules, direction should be outbound (from the traffic source to the destination). For protocols used in server publishing rules, direction must be inbound (from the traffic source to the published server).
  • UDP. Send, Receive, Send/Receive, Receive/Send
  • ICMP. Send, Send/Receive
  • IP Level. Send, Send/Receive
Port Range
In From, provides a space to type the first port in the port range. In To, provides a space to type the last port in the port range.
ICMP code
If the ICMP protocol type was selected, provides a space to type the ICMP code.
ICMP type
If the ICMP protocol type was selected, provides a space to type the ICMP type.


Connectivity Verifier: Properties

Specifies how connectivity between the ISA Server computer and a specific computer or URL will be verified.

Monitor connection to this server
Provides a space to type the name of the server for which to monitor connectivity. If the specified server does not respond, an appropriate alert will be triggered.
Group type
Select the category to which the monitored server belongs: Active Directory, DHCP, DNS, Web (Internet), Published servers, or Others.
Select the method used to verify the connection:
Select which method to use to determine connectivity:
  • Send an HTTP GET request. When this method is selected, an HTTP GET request is sent to the specified computer or URL. When you select this option, all HTTP and HTTPS traffic between the ISA Server computer and the "All Networks" network object is automatically allowed. This is required for ISA Server to perform the verification.
  • Send a PING request. When this method is selected, a PING request is sent to the specified computer or URL.
  • Establish a TCP connection. For this selection, you should also specify the TCP connection type and port number.
Specify the timeout response
Provides a space to type how long to wait for the server to respond before triggering an alert indicating that the server is not responsive.
Trigger an alert if the server response is not within the specified timeout
Specifies that if the server does not respond, trigger an alert.


Connectivity Verifier: Properties

Connectivity Verifier: General

Name
Provides a space to type the name of the connectivity verifier.
Description
Provides a space to type a description.
Enables
Specifies that the connectivity verifier is enabled.


Connection Limits

Limits the number of connections allowed, reducing the possibility of an attack that will overwhelm the system.

Limit the number of connections
Specifies that the number of connections created per second, for each rule (non-TCP), and the number of concurrent connections per client will be limited.
Connections created per second, per rule (non-TCP):
Specifies the maximum number of connections that can be established per second, per rule. When this limit is met, new requests will not be allowed. The value specified must be at least 100. This option applies to non-TCP connections (e.g., UDP, Raw IP).
Connection limit per client (TCP and non-TCP):
Specifies the maximum number of concurrent connections allowed per client. For TCP client connections, when this limit is met new connections are not allowed. For non-TCP client connections (mappings), when the limit is met new connections are allowed; the oldest connections are dropped.
Custom Connection Limit
Provides a space to specify a connection limit that will be applied to specified computer sets.
Add
Click to select the computer sets to which the custom limit will apply.
Edit
Click to edit a computer set included in the list (pre-defined computer sets cannot be modified).
Remove
Click to delete a computer set from the custom connection limits list.


Rule: General

Content Download Job Rule: General

Name
Provides a space to type a name for the content download job.
Description
Provides a space to type a description for the content download job.
Enable this job
Specifies that content download job is enabled.


Content Types: Content Types

Rule: Content Type

This rule applies to
Specify if the rule should apply to all content types or to selected content types only.

If you apply the rule to selected content types, the rule is applicable only to HTTP traffic of the selected content types. As a result, if you have specified any protocols other than HTTP in this rule, the rule action (allow or deny) will not be applied to them.
Content types
Displays the list of file types and MIME types to include in the content types for this rule. If you are applying the rule to selected content types, select the check boxes for these content types.
New
Click to add a file type or MIME type to the content types.
Details
Click to view the specific file and MIME types included in the selected content type.


Content Types: General

Name
Specifies the content type. For user-defined content types, you can edit the name.
Description
Provides a description of the content type. For user-defined content types, you can edit the description.


New Content Type Set

Content Type Set: New

Allows you to create a new content type set.

Name
Provides a space to type the name of the new content type set.
Description
Provides a space to type a description of the content type set.
Available types
Provides a menu of available file types and Multipurpose Internet Mail Extensions (MIME) types.
Add
Click to add the selected file type or MIME type to the content type set.
Selected types
Displays a list of file types and MIME types to include in the content type set.
Remove
Click to remove a file type or MIME type from the content type set.


Content Types: Content Types

Available types
Displays a list of available file types and Multipurpose Internet Mail Extensions (MIME) types.
Add
Click to add a file type or MIME type to the content types.
Remove
Click to remove a file type or MIME type from the content types.
Selected types
Displays a list of file types and MIME types to include in the content type set.


Authentication: OWA Forms-Based

Specifies how long an Outlook Web Access session can remain idle before it times out and the user is required to log back in to the Outlook Web Access server. Also specifies if Outlook Web Access clients are allowed to receive attachments.

Idle session timeout
Used to specify the amount of time that client sessions on public and private computers may remain idle before they time out. When a session reaches the time-out threshold, clients are required to log back into the session using their user credentials.
Block e-mail attachments
Specifies if Outlook Web Access clients are allowed to receive attachments on public or private computers. To block attachments, select the check box.
Log off OWA when the user leaves OWA site
Specifies that whenever the OWA user closes or navigates away from the site, or refreshes the page, the session will log off and the user will be required to re-authenticate.

For more information, see Deployment scenario: Publishing Outlook Web Access servers.


Certificate Revocation List

Certificate Validation: Validation

Verify that incoming client certificates are not revoked
Select this check box to specify that when ISA Server receives a certificate from a client, it will automatically check if the certificate is revoked. If the certificate is revoked, the client request will be denied.
Verify that incoming server certificates are not revoked in a forward scenario
Select this check box to specify that ISA Server will automatically check if incoming server certificates, in an SSL bridging scenario, are revoked. If the certificate is revoked, the request will be denied.
Verify that incoming server certificates are not revoked in a reverse scenario
Select this check box to specify that ISA Server will automatically check if server certificates, in a Web publishing scenario, are revoked. If the certificate is revoked, the request will be denied.


Log Summaries

The ISA Server reporting mechanism collates data from ISA Server logs into a database on each ISA Server computer. Use this page to specify when and where the data will be collected.

Enable daily and monthly summaries
Specifies that log data will be saved in daily and monthly summaries. At least 35 daily summaries, and at least 13 monthly summaries must be saved. If you are not using reports, this check box should not be selected.
Generate daily at
Provides a space to type the time at which data for the daily and monthly summaries should be generated.
ISASummaries folder
Specifies that ISA Server saves the daily and monthly summary database to the \ISA\ISASummaries folder.
Other folder
Specifies that the daily and monthly summary database is saved to the selected folder. Click Browse to find a location.
Daily summaries
Provides a space to type how many daily summaries will be saved. To save disk space, when this number is reached, old summaries are deleted as new summaries are saved.
Monthly summaries
Provides a space to type how many monthly summaries will be saved. To save disk space, when this number is reached, old summaries are deleted as new summaries are saved.


Administration Delegation

Group (recommended) User
Provides a space to type the group name or user name that you are delegating a role to. Click Browse to select a group or user.
Role
Select the role you are delegating to the group or user.
ISA Server Basic Monitoring
Users and groups assigned this role can monitor the ISA Server computer and network activity, but cannot configure specific monitoring functionality.
ISA Server Extended Monitoring
Users and groups assigned this role can perform all monitoring tasks, including log configuration, alert definition configuration, and all the monitoring available to the ISA Server Basic Monitoring role.
ISA Server Full Administrator
Users and groups assigned this role can perform any ISA Server task, including applying network templates and network configuration, rule configuration, and monitoring.

For more information, see Administrative roles.


Dialing Configuration

Specifies the dial-up connection used to connect through ISA Server to a specific network. Automatic dialing can be used for one network only.

I will dial the connection myself
Specifies that a manual connection will be used.
Allow automatic dialing to this network
Specifies that a dial-up connection will be used whenever users connect through ISA Server to a specific network. Select the network that ISA Server will connect to using the automatic dial-up connection (select External for dialing out to the Internet).
Configure dial-up connection to be the default gateway
Specifies that when using this dial-up connection, the External network will also be reached through the dial-up adapter.
Dial-up connection
Provides a space to type the name of the network dial-up connection. Click Select to select a dial-up connection.
Dial-up account
Provides a space to type the user name for a user who has permission to access the dial-up connection. Click Set Account to select a user account for use with a dial-up connection.


Intrusion Detection: DNS Attacks

Enable detection and filtering of DNS attacks
Select this option to enable DNS filtering. The DNS intrusion detection filter intercepts and analyzes DNS traffic destined for the Internal network. If DNS attack detection is enabled, you can specify the types of suspicious activities that the filter will check for. Suspicious activities trigger alerts.
DNS host name overflow
Specifies that the filter will check for DNS host name overflow intrusion attempts. The DNS intrusion detection filter intercepts and analyzes DNS traffic destined for the Internal network. A DNS host name overflow intrusion occurs when a DNS response for a host name exceeds a certain fixed length.
DNS length overflow
Specifies that the filter will check for DNS length overflow intrusion attempts. A DNS length overflow intrusion occurs when a DNS response for IP addresses exceeds a specified length of 4 bytes.
DNS zone transfer
Specifies that the filter will check for DNS zone transfer intrusion attempts. A DNS zone transfer intrusion occurs when a client system uses a DNS client application to transfer zones from an internal DNS server.


Domain Name Set: General

Defines one or more domain names as a single set, so that you can apply firewall policy to the specified domains.

Name
Provides a space to type the name of the domain name set.
Domain names included in this set
Displays a list of the domain names included in the domain name set.
New
Click to add a domain name to the domain name set.

When specifying the domain name, you can use an asterisk (*) to specify a set of computers. For example, to specify all computers in the microsoft.com domain, type the domain name as *.microsoft.com. Note that the asterisk can appear only at the start of the domain name, and can be specified only once in the name.

When you specify a domain name, specify the computer name using the fully qualified domain name (FQDN). For example, write computer_name.microsoft.com, and not //computer_name.
Rename
Click to rename the selected domain name.
Delete
Click to remove the selected domain name from the domain name set.
Description
Provides a space to type a description for the domain name set.


Log and Sessions query dialog

Edit Filter

Limits the number of entries displayed to entries matching specified criteria.

Filter list
Shows the currently defined expressions by which the data will be queried.
Filter by
Displays the list of available filter by options.
Condition
Provides a list of available conditions for the query expression. The available conditions depend on the current filter by selection.
Values
Provides a space to type the value for the expression. The format of the value entry depends on the current filter by and condition selections.
Remove
Deletes the selected expression from the list of defined expressions.
Update
Allows you to modify an expression. To modify an expression, select it from the list of expressions and make the necessary changes. Then, click Update to refresh the expression with the new definitions.
Add To List
Saves the current expression to the list of defined expressions.
Start Query
Closes the Edit Filter dialog box and runs the query. The results of the query are shown in the details pane.

For more information, see Log viewer.


Find Internal IP Address

Server name
Provides a space to type the name of the server whose IP address you want to find. Click Browse to find a server. Click Find to locate the IP address of the specified server.
IP addresses
Displays a list of IP addresses that are associated with the specified computer.


FTP Filter dialog

FTP Filter

Read Only
Specifies that FTP traffic will be read-only. With this option selected, FTP content can be downloaded from an FTP site, but cannot be saved (uploaded) to the site.


Firewall Client: Connections

Connections between Firewall clients running the latest version of the Firewall Client for ISA Server 2004 and ISA Server 2004 use an encrypted channel. This provides a higher level of security. The option in this page allows Firewall clients running earlier versions of the Firewall Client software to connect to ISA Server 2004. However, encryption will not be used for these connections.

Allow non-encrypted Firewall client connections
Specifies that ISA Server 2004 will accept connections from Firewall clients running earlier versions of the Firewall client software (encryption will not be used).


General

Name
Provides a space to type the name.
Description
(Optional) Provides a space to type a description.
Type
Indicates the rule type. Rules are processed according to their type.
Rule Order
Indicates the order in which this rule will be processed, out of the total number of rules matching this rule type.


H.323 Filter: Call Control

Use this gatekeeper
Select this check box to assign a gatekeeper, and then specify the gatekeeper. The gatekeeper must be installed separately on the ISA Server computer or on a computer in the Internal network.
Use DNS gatekeeper lookup and LRQs for alias resolution
Specifies that when alias DNS lookup is unresolved, the filter will use DNS for gatekeeper lookup, and then perform a location request (LRQ) to the gatekeeper for alias resolution.
Allow audio
Select this option to allow audio.
Allow video
Select this option to allow video.
Allow T120 and application sharing
Select this option to allow T120 (data conferencing) and application sharing.


HTTP Filter: Extensions

Specifies if this rule will block HTTP requests based on a requested file extension, such as .exe or .asp.

Specify the action taken on file extensions
Specifies how ISA Server will handle requests for file extensions.
Allow all extensions. Specifies that no blocking based on requested file extensions will be applied.
Allow selected extensions. Specifies that only requests with specific file extensions will be allowed.
Block specified extensions (allow all others). Specifies that all requests will be allowed, except those with specified extensions.
Extensions List
Add. Click to add an extension to the list.
Edit. Click to edit the selected extension.
Remove. Click to delete the selected extension.
Block requests with ambiguous extensions
Select this check box to block requests when the file extension cannot be determined.


HTTP Filter: General

Specifies general parameters used to block HTTP traffic for the selected rule.

Request headers
Specifies the maximum number of bytes that a request can have in its headers (URL and headers) before it is blocked. This setting applies to all rules.
Maximum Headers Length. Provides a space to type the number of bytes allowed in the request headers before a request is blocked.
Request Payload
Specifies if requests will be blocked based on the payload length (HTTP request body).
Allow any payload length. When this check box is not selected, requests exceeding the specified maximum payload length will be blocked.
URL protection
Maximum URL length (bytes). Provides a space to type the maximum URL length allowed. Requests with URLs exceeding this value will be blocked.
Maximum query length (bytes). Provides a space to type the maximum query length allowed in a request. Requests with queries exceeding this value will be blocked.
Verify normalization. Select this check box to specify that requests with URLs containing escaped characters after normalization will be blocked.
Block high bit characters. Select this check box to specify that URLs with high-bit characters will be blocked.
Executables
Select this check box to specify that responses containing Windows executable content (.exe) will be blocked.


HTTP Filter: Headers

Specifies that requests or responses will be blocked if specific headers are present.

Headers
Lists the headers that will be blocked.
Add. Click to add a new header to the list.
Edit. Click to edit a selected header.
Remove. Click to remove a selected header.
Server Header
Specifies how the server header will be returned in the response.
Send original header. The original header will be returned in the response.
Strip header from response. No header will be returned in the response.
Modify. A modified header will be returned in the response. If you select this option, in the Change to box, type the value that will appear in the response.
Via Header
Specifies how the Via Header will be forwarded in the request or returned in the response.
Send default. The default header will be used.
Modify header in request and response. The Via Header will be replaced with a modified header. If you select this option, in the Change to box, type the header that will appear instead of the Via Header.


HTTP Filter: Methods

Specifies whether the rule will block HTTP requests based on the request method, such as POST, GET, or HEAD.

Specify the action taken on methods
Allow all methods. Specifies that no blocking according to method will be applied.
Allow selected methods. Specifies that all requests will be blocked except those with specified methods.
Block specified methods (allow all others). Specifies that all requests will be allowed, except those with methods specified in the list.
Methods List
Provides a list of methods specified for the selected action.
Add. Click to add a method to the list.
Edit. Click to edit the selected method.
Remove. Click to delete the selected method.


HTTP Filter: Signatures

Specifies that requests or responses will be blocked if specific strings are present in the headers or body.

Signatures List
Shows the signatures that have been defined for the rule. If any of these signatures are present in the headers or body, the request or response will be blocked.
Add. Click to define a new string that will be blocked.
Modify. Click to edit a selected signature string.
Delete. Click to remove a selected signature string.
Show only enabled search strings
Select to display in the list box only search strings for which the filter is searching. If this is not selected, all defined search strings are listed in the list box.


HTTP Filter: Signatures

Name
Provide a name for the signature search
Description
Provide a description for the signature search.
Search in
Specify whether you want to search in the request URL, request headers, request body, response headers, or response body.
HTTP header
If you chose to search in either request headers or response headers, specify the header.
Signature
Specify the signature (string) to block.
Byte Range
If you chose to search in either request body or response body, specify the byte range in which you want to search.
Format
You can select to provide the signature in Text or Binary (hexadecimal) format.


IP Preferences: IP Fragments

Block IP fragments
Select to block all traffic with IP fragments. Fragmented packets may represent a security threat.


IP Address Range Properties

Specifies the first and last addresses in the IP address range.

Starting address
Provides a space to type the first IP address in the IP address range.
Ending address
Provides a space to type the last IP address in the IP address range.

When defining an IP address range for a network, the address range cannot intersect with an address range already specified in a different network.


IP Preferences: IP Routing

Enable IP routing
Specifies that routing of IP packets is enabled.

When IP routing is enabled, ISA Server sends the original network packet to the destination. Although IP routing improves performance, disabling IP routing is considered more secure. When IP routing is disabled, ISA Server sends only the data (not the entire packet) to the destination.


Web Filter: General

ISA Server features can be extended by installing Web filters developed by other vendors. Web filters can monitor, evaluate, and intercept Hypertext Transfer Protocol (HTTP) communication between an internal network and the Internet.

Description
Displays a description of the Web filter.
Vendor
Displays the name of the vendor that developed this Web filter.
Version
Displays the Web filter version.
Relative path
Displays the name of the folder, under the ISA Server installation folder, in which the Web filter is located.
Direction
Specifies that the Web filter applies to incoming requests, outgoing requests, or both.
Enable this filter
Select to enable the Web filter.


Domain Properties

Enter a domain name to include
Provides a space to type the name of a domain or server. The server name should be unique. Using the fully qualified domain name (FQDN) will avoid any conflict with duplicated server names.


Browse for Domain

Domains
Provides a list of domains available for the server. Select a domain to include it in the network.


Link Translation: Content Groups

Link Translation: Content Types

Selected content types
Displays a list of file types and Multipurpose Internet Mail Extensions (MIME) types to which link translation can be applied. By default, if link translation is enabled, the translation is applied only to HTML content. To apply link translation to additional content types, select its check box.

The selections in this page are applicable to all Web publishing rules for which link translation is enabled.

For more information, see Link translation.


Link Translation

Web Publishing Rule: Link Translation

Replace absolute links in Web pages
Specifies that ISA Server will scan Web pages on the published website for absolute links and replace them with the external name and path. This option is only applicable when the website has absolute links, and the website you are publishing specifies an explicit public domain name—the path does not include an asterisk (*).
Dictionary entries
Provides a space to define how specific links (strings) should be searched for and replaced during link translation. To define a new string for the dictionary, click Add.
Content Types
Specifies the content types for which link translation will be applied. The selected content types are global to all Web publishing rules for which link translation is enabled.


Listener: IP Selection

Listen for requests on
Specifies the IP addresses from which ISA Server will listen for incoming requests.
All IP addresses in the network. Specifies that ISA Server will listen for requests from all IP addresses in the selected network. This is the default.
Default IP addresses for the network adapter. Specifies that ISA Server will listen for requests only on the default network adapter IP address for the selected network.
Selected IP addresses in the network. Specifies that ISA Server will listen for requests on selected IP addresses in the network.
Available IP addresses
Shows all the IP addresses included in the selected network.
Click Add to specify that a selected IP address should be used.
Selected IP addresses
Shows the IP addresses that are selected for this listener.


Publishing Rule: Network Listener

Publishing Rule: Networks

Selected networks for this listener
Specifies the networks or network sets that will listen for requests intended for the published server.
Address
Click to limit which adapters associated with the network or network set will listen for incoming requests, and select IP addresses of specific network adapters in the network.


Logging: Fields

Specifies the fields included in the log files.

Fields in the log
Displays a list of available fields for the log files. Only information for selected fields will be included. To select a field, select its check box.
Restore Defaults
Click to return the list of selected fields to the default selection.
Select All
Click to select all of the check boxes.
Clear All
Click to clear all of the check boxes.


Logging: Options

Use this page to select where and how to save the log file.

Store the log file in
ISALogs folder. Specifies that log files will be saved to the default log file directory in the default ISA Server installation directory.
This folder. Specifies the location that will be used to save the log files. To search for a folder, click Browse.

Log file storage limits control the amount of space on the disk that can be used for log files.

Limit total log file size
Specifies how many gigabytes (GB) of disk space that the log files can use. Each log file is limited to 2 GB. When a log file reaches 2 GB, a new file is automatically created. When the total log file size reaches its limit, it is maintained according to the selected method.
Maintain free disk space
Specifies the minimum amount of disk space that must kept free. When the amount free disk space reaches the limit, it is maintained according to the selected method.
Maintain log storage limits by
Deleting older log files as necessary. Specifies that when the storage limits are met, older files will be deleted as newer files are saved.
Discarding new log entries. Specifies that when the storage limits are met, new entries will not be saved until the limits are changed, or old files are deleted.
Delete log files older than
Determines how long log files will be stored before they are automatically deleted. To delete old files from the log file storage, decrease this number.
Compress Log Files
Specifies if the log files should be compressed to reduce the disk space required. This option is only available for logs stored on NTFS partitions.


Logging: Log

Logging: Log Location

Specifies the location used for storing the log files.

Directory list
Click to browse to the directory and folder that will be used for storing the log files. To create a new folder in the selected directory, click Make New Folder.


Logging: Log

Specifies the format in which the log information will be stored.

MSDE Database
Specifies that ISA Server will save the log information in MSDE format. When saved in this format, the file can be viewed online in the log viewer.
Name
Displays the name of the log file.
yyyy represents the year that the log was created.
mm represents the month that the log was created.
dd represents the day that the log was created.
FWS, or WEB, or EML, where FWS represents Firewall log, WEB represents Web Proxy log, and EML represents e-mail (SMTP) log.
nnn represents multiple log files created on the same day.
Options
Click to specify the file location and file storage options.
File
Specifies that ISA Server will save the log information to a file.
Format
Displays a list of available file formats for the log. You can choose between World Wide Web Consortium (W3C) format or ISA Server format.
Name
Displays the name of the log file.
yyyy represents the year that the log was created.
mm represents the month that the log was created.
dd represents the day that the log was created.
FWS, or WEB, or EML, where FWS represents Firewall log, WEB represents Web Proxy log, and EML represents e-mail (SMTP) log.
nnn represents multiple log files created on the same day.
Options
Click to specify the file location and file storage options.
SQL Database
Specifies that ISA Server will save log information to an ODBC-compliant database.
OBDC Data source (DSN)
Provides a space to type the ODBC data source name for the log database.
Table Name
Provides a space to type the name of the database table for the ISA Server log. The table name must not include spaces.
Use this account
Provides a space to type an account name to use when logging on to the log database.
Set Account
Click to specify a user account for logging on to the database.
Enable logging for this service
Specifies whether logging is enabled for this component. If not selected, no events are recorded in the log.

The SMTP Message Screener log information is saved by default in file format. It cannot be saved to a database.

For details, see Log storage format.


User Mapping

Enables user mapping from non-Windows namespaces to the Windows namespace.

Enable user mapping for this namespace
Click to specify that the VPN users from a non-Windows namespace (RADIUS or EAP) will be mapped to the Windows namespace.
When user name does not contain a domain, use this domain
Click to specify that user names which do not include a domain will be treated as if they belong to a specified domain.
Domain name
Provides a space to specify the domain name that will be used for user names that do not include a domain name.


Rule: General

Name
Provides a space to type a name. For built-in networks, the provided name cannot be edited.
Description
Provides a space to type a description. For built-in networks, the provided description cannot be edited.


Network: Network Relationships

Specifies the type of connectivity between networks (source and destination).

Network Address Translation
Specifies that a network address translation (NAT) relationship will be used from the source network to the destination network.

In a NAT relationship, IP addresses of computers on the source network are replaced by an IP address of an adapter on the ISA Server computer that is connected to the destination network. NAT relationships are unique and unidirectional. If a NAT relationship is defined between Network A (source network) and Network B (destination network), no network relationship can be defined between Network B (as the source) and Network A (as the destination).
Route
Specifies that a route relationship will be used between the source network and the destination network.

In a route relationship, ISA Server routes the traffic between computers on the source and destination networks. IP addresses of computers on both networks are visible. Routed relationships are bidirectional. If a routed relationship is defined for traffic from Network A (source network) to Network B (destination network), a routed relationship also exists for traffic sent from Network B (as the source) to Network A (as the destination).


Network Rule: General

Name
Provides a space to type the name.
Description
Provides a space to type a description.
Type
Displays the type of rule.
Evaluation order
Shows the order in which this rule is evaluated.
Enable
Specifies that the rule is enabled.


Network Rule Destination Networks

Network Rule: Destination Network

Displays a list of networks and network sets defined as destination networks for this rule.
Add. Click to add another network object to the list of networks.
Edit. Click to view or edit the selected network object's properties.
Remove. Click to delete a selected network object from the list.
Exceptions
Specifies users from the list who are exempt from the network rule.


Network Rule Source Networks

Network Rule: Source Network

Displays a list of networks and network sets defined as source networks for this network rule. Select the network or network set to use as the source network.
Add. Click to add another network to the list.
Edit. Click to view or edit the selected network object's properties.
Remove. Click to delete a selected network object from the list.
Exceptions
Specifies users from the list who are exempt from the network rule.


Network Set: General

Name
Provides a space to type a name. For built-in network sets, the provided name cannot be edited.
Description
Provides a space to type a description. For built-in network sets, the provided description cannot be edited.


Network Set: Networks

Defines several networks as a single set. This set can be used in firewall policy rules to apply rules to all the networks in the set.

There are two types of network sets, "Exclude" and "Include". Exclude network sets are defined by selecting a set of networks excluded from the network set. This means that the network set is actually comprised of all the other, non-selected, networks. Include network sets are defined by selecting the networks that are included in the network set.

Name
Displays a list of all ISA Server networks. The check box shows which networks are selected for the network set. Depending on the network set type, the selected networks are either included or excluded from the network set.

Network set type is defined when creating the network set, using the New Network Set wizard.


Network: Web Proxy

Enable Web Proxy clients
Specifies that ISA Server will listen for Transmission Control Protocol (TCP) requests from Web Proxy clients.
Enable HTTP
Specifies that ISA Server will listen for HTTP requests. In HTTP port, type the port number on which ISA Server listens for requests.
Enable SSL
Specifies that ISA Server will listen for Secure Sockets Layer (SSL) requests. In SSL port, type the port number on which ISA Server listens for SSL requests.
Click Select to select a certificate to use for SSL requests.
Authentication
Click to configure how to authenticate clients connecting to this network. Authentication is required when access or publishing rules apply to specific users or groups, rather than IP addresses.
Advanced
Click to configure the maximum number of client connections allowed simultaneously.


Add/Edit Dictionary Item

Replace this text
Provides a space to type the link that will be translated. ISA Server searches the published website for the string.
With this text
Provides a space to type the text that will replace the original link.


Add Server

IP addresses within this range
Specifies which servers the client can access directly. Specify the following:
  • From. Provides a space to type the first IP address in the range of computers that the client can access directly.
  • To. Provides a space to type the last IP address in the range of computers that the client can access directly.
Domain or Computer
Specifies that the computers in the domain are accessed directly and not through the ISA Server computer. Click Browse to select a domain for direct access.


RPC: Enter UUID Manual

RPC: Add/Edit Interfaces

Interface UUID
Provides a space for you to type the UUID interface. The interface must be typed in a valid GUID format.
Interface name
Provides a space to type a name identifying the UUID interface.
Interface publishing port
Specifies if the port will be dynamically assigned or if a static port will be used.


Adding Dial-up Connections

There is no Help available on this topic.


Export: Password

Export: Set Password

Specifies the password that will be required for opening and importing the file.

Password
Provides a space to type the password required for importing the file.
Confirm
Provides a space to confirm the password required for importing the file.


Import: Password

Open the Imported File

Password
Provides a space to type the password required for importing the file. This password was set when the file was exported.


Path Mapping

Specify the folder on the Web site that you want to publish
Provides a space to type the path on the (published) Web server.
Same as published folder
Specifies that the path in the user request will be identical to the path on the published Web server.
The following folder
Specifies that the path in the client request will be mapped to the path that you specify.


Intrusion Detection: Common Attacks

With the intrusion detection feature of ISA Server, an alert can be generated if an attempted intrusion is detected. Although an event is generated when the attack occurs, you must specifically enable and configure an alert to trigger an action.

Enable intrusion detection
Specifies that intrusion detection is enabled.
Windows out-of-band (WinNuke)
Specifies that ISA Server will generate an event if an out-of-band denial-of-service attack is attempted against a computer protected by ISA Server.
Land
Specifies that ISA Server will generate an event if a TCP SYN packet is sent with a spoofed source IP address and port number that matches that of the destination IP address and port number.
Ping of death
Specifies that ISA Server will generate an event if a large amount of information is appended to an Internet Control Message Protocol (ICMP) echo request (ping) packet.
IP half scan
Specifies that ISA Server will generate an event if repeated attempts to connect to a destination computer were made and no corresponding ACK packets were communicated.
UDP bomb
Specifies than an event will be generated if there is an attempt to send an illegal User Datagram Protocol (UDP) packet. Although an event will be generated when the attack occurs, you must specifically enable and configure an alert to trigger an action.
Port scan
Specifies that ISA Server will generate an event if an attempt is made to count the services running on a computer by probing each port for a response. If you select this option, also specify the following:
  • Detect after attacks on well-known ports. Provides a space to type the maximum number of well-known ports that can be scanned before generating an event when a port scan attack is detected. A well-known port is any port in the range from 1 through 2048.
  • Detect after attacks on ports. Provides a space to type the maximum number of ports that can be scanned before generating an event when a port scan attack is detected.


IP Preferences: IP Options

Enable IP Options Filtering
Specifies that IP packets will be allowed to pass through ISA Server, depending on the access policy configured, regardless of which IP options are specified.
Displays a list of IP options. Click Select All to select all the options displayed in the list. Click Clear All to clear all the options displayed in the list.
Show only selected IP options
Specifies that only IP option numbers that are defined will be displayed in the list.
Show undefined IP options
Specifies that all IP option numbers will be displayed in the list, even those that are not defined.


Application Filters: General

Description
Displays a description of the filter.
Vendor
Displays the name of the vendor that developed this filter.
Version
Displays the filter version.
Enable this filter
Select to enable the filter.


Rule: General

Name
Provides a space to type the name.
Description
Provides a space to type a description.
Type
Displays the type of rule. Evaluation order applies to all rules of a specific type.
Evaluation order
The order in which this rule is evaluated.
Enable
Specifies that the rule is enabled.


Content Download Job: Cache

Cache content options specify the type of content stored in the cache.

All content will be cached
Specifies that all content is cached, even if the source and request headers indicate that it is not cacheable content. Redirection responses 301, 302, and 307 will also be cached.
If source and request headers indicate to cache, or if content is dynamic...
Specifies that the content will be cached if the source and request headers indicate that the content can be cached, or if the content is dynamic (i.e., headers specify that content is uncacheable).
If source and request headers indicate to cache, ...
Specifies that the content will be cached only if the source and request headers indicate that the content can be cached.

Time to Live (TTL) options determine how long content in the cache remains valid, as a function of its TTL settings.

Expire content according to cache rule TTL settings
Specifies that the TTL will be determined according to the response headers and the cache rule settings.
Set TTL if not defined in response
Specifies that download job will override the TTL of an object only if the object does not have a response header that sets the TTL. If the object does have a TTL-related header, it is handled according to the cache rule.
Override object's TTL
Specifies that downloaded content will be marked with a new TTL. The TTL setting defines how long the downloaded content will remain in the cache. In Mark downloaded objects with a new TTL, type the desired TTL (in minutes).


Content Download Job: Content

Specifies the location from which content will be downloaded (URL), and the download preferences.

Download content from this URL
Provides a space to type the URL from which to begin downloading content.
Do not follow links outside the specified URL domain name
Specifies that content will be downloaded only from the domain specified in Download content from this URL.
Maximum depth of links per page
Specifies the total number of links that can be followed from the first page.
Maximum number of concurrent TCP connections to create for this job:
Specifies the maximum number of URL objects that will be downloaded simultaneously. Downloading a large number of objects at the same time requires more system resources.
Limit number of objects retrieved to maximum of:
Provides space to type the total number of objects that can be stored in the cache.


Content Download Job: Schedule

Specifies how frequently the job will run.

Start Downloading
In Date, provides a space to type the date, and in Time, provides a space to type the time when the content will be copied from the computer on the Internet to the ISA Server cache.
Download Frequency
Specifies when content will be downloaded from the Internet. Select one of the following:
  • Once. Specifies that the content will be downloaded from the Internet only once, at the specified date and time.
  • Daily. Specifies that the content will be downloaded from the Internet daily, at the specified time.
  • Weekly. Specifies that the content will be downloaded from the Internet on the selected days.
Run the job one time every day
Select to schedule the content download job to run daily at the specified time.
Repeat every
Select to schedule the content download job to run at the specified periodic times. Then, type how often to run the job.
Do not start a new run of the job after
Provides a space to type a time from which a new instance of the job should not start running.


Protocol Definition: Parameters

Specifies the connections and application filters associated with the protocol. When adding or editing protocols, direction must be specified as follows:

  • For protocols used in access rules, protocol direction must be defined as outbound. This allows traffic from the network entities specified as the rule sources to the network entities specified as the rule destinations.
  • For protocols used in server publishing rules, protocol direction must be defined as inbound. This allows traffic from the network entities specified as the network sources to the published service on the server.
Primary connections
Displays a list of the primary connections for the protocol definition. Click Add, Edit, or Remove to modify the primary connections for the protocol definition.
Secondary Connections
Displays a list of the secondary connections for the protocol definition. Click Add, Edit, or Remove to modify the secondary connections for the protocol definition.
Application Filters
Displays a list of application filters that can be applied to the protocol definition. Select the application filter to apply it. Click Show only selected application filters to list only the application filters that apply to the protocol definition.


Protocol: General

Name
Provides a space to type a name. For predefined protocols, the provided name cannot be edited.

Protocols used for server publishing include "Server" as part of their name and are always inbound. For example, "FTP Server" protocol is an inbound protocol used for server publishing, while "FTP" protocol is outbound.
Description
Provides a space to type a description. For predefined networks, the provided description cannot be edited.


Public Name

Public name or IP address
Type the public name or IP address that users will type to reach your published site. Typically, the public name is the external domain name or IP address of the ISA Server computer.


Publishing: Action

Allow
Specifies that a request will be allowed if it meets the conditions of the rule. You can configure rule conditions to meet specific security needs.
Deny
Specifies that a request will be denied if it meets the conditions of the rule. You can configure rule conditions to meet specific security needs.
Log requests matching this rule
Specifies that client requests that are allowed or denied by this rule will be saved in the applicable log.


Add RADIUS Server

Server name
Provides a space to type the DNS name or IP address of the Remote Authentication Dial-In User Service (RADIUS) server. IP addresses must be typed in dotted decimal notation.
Server description
Provides a space to type a description for the server.
Shared secret
Displays the obscured shared secret that is used for secure communications between ISA Server and the RADIUS server. You must configure the same shared secret on both ISA Server and the RADIUS server for successful RADIUS communications to occur. The shared secret is case-sensitive.
Port
Provides a space to type the User Datagram Protocol (UDP) port that is used by the RADIUS server for incoming RADIUS authentication requests. The default value of 1812 is based on RFC 2138. For older RADIUS servers, set the port value to 1645. For RADIUS accounting, the port number will automatically be set to the authorization port plus one.
Time out (seconds)
Provides a space to type the amount of time (in seconds) that the remote access server will try to obtain responses from the RADIUS server before trying another RADIUS server. You can click the arrows to select a new setting.
Always use message authenticator
Specifies that a message authenticator based on the shared secret is sent with each RADIUS message. Extensible Authentication Protocol (EAP) messages are always sent with a message authenticator. Make sure that your RADIUS servers are capable of receiving and configured to receive message authenticators. You must select this option if your RADIUS server is running Internet Authentication Service (IAS), and the RADIUS client that is configured for this server has the Request must contain the Message Authenticator attribute option selected.


RADIUS Servers

RADIUS Servers List
Shows the list of Remote Authentication Dial-In User Service (RADIUS) servers available for RADIUS user authentication. RADIUS servers are queried according to the order in which they are listed. The RADIUS server at the top of the list is queried first.
Add
Click to add a new RADIUS server to the list.
Edit
Click to modify the properties of the selected RADIUS server.
Remove
Click to remove the selected RADIUS server from the list.
Up Arrow
Moves the selected RADIUS server one position up in the list so it is queried before the servers below it. This button is not available until you click a server other than the bottom server in the list.
Down Arrow
Moves the selected RADIUS server one position down in the list so it is queried after the servers above it. This button is not available until you click a server other than the top server in the list.


User Sets: RADIUS (non-Windows)

Defines the non-Windows authenticated users (RADIUS or EAP) to include in the user set.

All users in namespace
Select to include all users from non-Windows namespaces in this user set.
Specified user name
Select to add a specific user to the user set. Then, type the user name.


Report Properties

Top number
Specifies how much information will be included in each report type.

Depending on the report types, you specify the number of top protocols, users, sites, browsers, object types, operating systems, destinations, and client applications. In addition, for security reports, you specify top clients who generated the largest number of dropped packets, and the top users who generated the largest number of authorization failures.
Sort Order
Select the option that should be used to sort the data in the report.


Report Job: Action

Report Job: Notification

Send e-mail
Specifies that when a report is generated, an e-mail notification should be sent automatically to a specified e-mail recipient.

SMTP Server. Provides a space to type the name of the mail server to use for sending the e-mail notification. To select a server, click Browse.

From, To, CC. Provides a space to type the e-mail addresses of the sender and recipients.

Message. Provides a space to type a message to include in the body of the e-mail notification.

Include a link to the completed report in the message
With this option selected, a link to the report will be included in the e-mail notification.


Report Job: Content

Report Types
Specifies the information that will be included in the report.

Summary. Includes details about protocol usage, websites accessed, cache information, and general traffic activity.

Web usage. Includes details such as top Web users, common responses, and which browsers are being used.

Application usage. Shows details about Internet application usage, including incoming and outgoing traffic, top users, client applications, and destinations.

Traffic and utilization. Shows total Internet usage by application, protocol, and direction. It also shows average traffic and peak simultaneous connections, cache hit ratio, errors, and other statistics.

Security. Shows possible attempts to breach network security.

Select a period to base a report on
Specifies how the information will be organized, either by day, week, month, or year.


Rule: General

Report Job: General

Name
Provides a space to type the report job name.
Description
Provides a space to type a description.
Enable
Specifies that the report job is enabled. When a report job is enabled, it runs according to the schedule defined for it.


Report Job: Action

Report Job: Published Report

Publish report to a directory
Saves the report in HTML format to the specified published reports directory.
Published reports directory
Enter the directory the report will be saved to. It is recommended that you publish reports to a network share rather than to a local path. To select a directory, click Browse.
Set Account
Specifies the user name that will be used when saving the file to the specified directory. The specified user must have write-permissions on the computer the file is saved to. Click Set Account to enter the user name and user password.

In order for the report to be saved to the specified directory, the Windows Workstation service must be running on the ISA Server computer. In addition, the Server service must be enabled on the computer specified for saving the file.


Report Job: Published Reports

Report Job: Published Report

Publish report to a directory
Saves the report in HTML format to the specified published reports directory.
Published reports directory
Provides a space to type the directory that the report will be saved to. We recommend that you publish reports to a network share rather than to a local path. To select a directory, click Browse.
Set Account
Specifies the user name that will be used when saving the file to the specified directory. The specified user must have write permissions on the computer that the file is saved to. To enter the user name and user password, click Set Account.

For the report to be saved to the specified directory, the Windows Workstation service must be running on the ISA Server computer. In addition, the Server service must be enabled on the computer specified for saving the file.


Report Job: Schedule

Specifies how frequently the report job will run. Select one of the following:

Every day
Click to generate a daily scheduled report.
On the following days
Click to generate a scheduled report on specified days. Then, select the days on which the report will run.
Every month on this date
Click to indicate that a scheduled report will be generated once a month. Then, type the day of the month on which the report will run. To generate a report that covers an entire month, enter 1.

Specifies the time and date on which the report job will be generated.

Generation hour
Provides a space to type the time at which ISA Server will begin generating the report. By default report jobs are run at 1:00 A.M. so that the entire previous day is included in the report.
Start Date
Provides a space to type the date on which ISA Server will run the first instance of the report job. After the start date, the report job will run on the specified generation hour according to the recurring schedule.


Reports: Report Jobs

Displays the list of defined report jobs.

Add
Click to define a new report job. After the report job is run and a report is generated, an entry for the completed report will be listed in the Reports tab details pane.
Edit
Select a report job from the list, then click to modify the report job properties.
Remove
Click to delete a selected report job.
Run Now
Click to run the report job immediately and generate a report. Subsequent runs of the report job will be according to the report job schedule.


Web Chaining Rule: Action

Routing rules determine if a Web Proxy client request is retrieved directly, or is sent to another upstream proxy server or to an alternate destination.

Retrieving them directly from the specified destination
Specifies that ISA Server will send requests from Web Proxy clients directly to the Internet.
Routing them to a specified upstream server
Specifies that ISA Server will send requests from Web Proxy clients to an upstream server for processing. The upstream server will determine if the request is allowed or denied.
Allow delegation of basic authentication credentials
Allows the Web server to which the request is redirected to authenticate the client.
Upstream server setting
Click Settings to configure which upstream server fulfills the requests.
Backup route
Lists ISA Server options for fulfilling requests if the primary route is unavailable. If you select upstream proxy server, you must specify which server will be used.
Click Settings to configure which upstream server will be used for the backup route.
Redirecting them to a hosted site
Specifies that ISA Server routes requests from Web Proxy clients to an alternate destination.
  • In Site, type the URL of the alternate destination for the request.
  • In Port, type the port number of the alternate destination.
  • In SSL Port, type the Secure Sockets Layer (SSL) port number of the alternate destination.
Use a dial-up entry for primary route
Specifies that ISA Server will use a dial-up connection when connecting to the primary route.
Use a dial-up entry backup route
Specifies that ISA Server will use a dial-up connection when connecting to the backup route.


Upstream Server Setting

Server
Provides a space to type the name of the upstream server. The server name should be unique. Using the fully qualified domain name (FQDN) will avoid any conflict with duplicated server names. The upstream server must be an ISA Server 2004 computer, ISA Server 2000 computer, or a Microsoft Proxy Server 2.0 computer.
Click Browse to find an upstream server or an ISA Server array.
Port
Provides a space to type the port to use when connecting to the upstream server.
SSL Port
Provides a space to type the Secure Sockets Layer (SSL) port that will be used when connecting to the upstream server.
Automatically poll upstream server for configuration
Specifies that ISA Server will determine the configuration of the upstream server. The local ISA Server uses this information to retrieve objects from the upstream server.
URL
Provides a space to type the URL to use when checking the upstream server. ISA Server automatically constructs a URL if you type the server name. You can then modify this URL, if needed.
Use this account
Specifies that credentials will be used when communicating with the upstream server.
Click Set Account to select a user account for accessing the upstream server.
Authentication
Displays the authentication types to use when communicating with an upstream server. You can select Basic authentication or Microsoft Challenge Handshake Authentication Protocol (MS-CHAP).


Web Chaining Rule: To

List of destinations
Specifies that the Web chaining rule will apply to Web requests sent to the network entities listed.

Add. Click to add a destination to the list.

Edit. Click to edit a selected destination. The properties for some network entities can be viewed only.

Remove. Click to delete a destination from the list.

Exceptions
Specifies that the rule will not apply to Web requests sent to the network entities listed as exceptions.

Add. Click to add a destination to the list of exceptions.

Edit. Click to edit the properties of a selected destination. The properties for some network entities can be viewed only.

Remove. Click to delete a destination from the list.


Web Chaining Rule: Bridging

Redirect HTTP requests as
Select one of the following options:
  • HTTP requests. Specifies that Hypertext Transfer Protocol (HTTP) requests will be redirected as HTTP requests.
  • SSL requests. Specifies that HTTP requests will be redirected as Secure Sockets Layer (SSL) requests. In this case, ISA Server opens a secure channel to the server.
Redirect SSL requests as
Select one of the following options:
  • HTTP requests. Specifies that SSL requests will be redirected as HTTP requests.
  • SSL requests. Specifies that SSL requests will be redirected as SSL requests. In this case, ISA Server opens a secure channel to the server.
Require secure channel
Click to require access through an SSL channel only.
Require 128-bit encryption
Click to select 128-bit encryption.
Use a certificate to authenticate to the SSL Web server
Click to use a certificate to authenticate to the SSL server.
Certificates act as an added security mechanism between ISA Server and an SSL Web server.


RPC: Enter UUID Manual

RPC: Add/Edit Interfaces

Interface UUID
Provides a space to type the UUID interface. The interface must be typed in a valid GUID format.
Interface name
Provides a space to type a name identifying the UUID interface.
Interface publishing port
Specifies if the port will be dynamically assigned or if a static port will be used.


RPC: Protocol Filter

Depending on the location from which this page is accessed, one of the following options is available.

Enforce encryption
Click to specify that mail sent from Outlook clients will be encrypted.

When this option is selected, clients must configure their Outlook settings to use encryption. Otherwise, they will be unable to connect to the Exchange server.

Enforce strict RPC compliance
Specifies that strict RPC compliance is enforced for RPC protocols. If you disable this option, RPC-type protocols, such as DCOM, will be allowed through ISA Server.


RPC: Interfaces

List of Interfaces
Lists the RPC interfaces (UUIDs) defined for this RPC protocol definition. The interface must be typed in a valid GUID format.
Add
Click to add an interface to this protocol definition.
Edit
Click to modify the selected interface.
Delete
Click to delete the selected interface.


Web Listener: RSA SecurID

Cookie expiration control

A Web access authentication cookie is valid only during the browsing session for which it was created. Setting expiration constraints can help reduce the likelihood that an unauthorized user will gain access to protected pages through a Web browser that was left unattended.

Cookies expire if not used within the specified time
With this option selected, ISA Server validates the client's cookie and sends back a response with a new cookie and a new expiration time with each new request. A cookie expires only when the amount of time between requests exceeds the expiration time.
Cookies always expire after the specified time
With this option selected, a cookie is not renewed. The same cookie is used again and again until it expires. The first request after the expiration time causes a request from ISA Server to reauthenticate. This option is more secure than the Cookies expire if not used within the specified time option.
Expiration time
Provides a space to type the number of minutes that must elapse before the cookie expires. The minimum expiration time is 1 minute. The maximum expiration time is 1440 minutes (1 day).
Manage domain configuration
Click to open the Domain Cookies page, used to enable domain cookies.

By default, Web access authentication distributes cookies that are valid only on the Web server from which they are issued. To issue cookies that are valid on multiple servers in the same Web domain or across multiple domains, you can enable the Domain Cookie option. When this option is enabled, you can specify a domain cookie that will be used for all requests from the Web listener to a specified domain. In addition, you can define a domain secret for the domain cookie.

Advanced settings

Prevent caching of protected pages on clients
Select this option to prevent caching of all content retrieved through the Web listener.
Ignore browser IP address for cookie validation
Select this option to allow clients to use the same cookie from different IP addresses.
Send RSA SecurID cookie to upstream server
Select this option to forward the cookie to the upstream server where the request is retrieved.
Use RSA ACE/Server 5.0 Name Locking feature
Select this option to enable the RSA ACE/Server 5.0 Name Locking feature. This option prevents the same PASSCODE from being used twice. When this option is selected, we recommend that you also select the Use separate user name and PASSCODE pages option.
Use separate user name and PASSCODE pages
Select this option to specify that instead of sending a single form for entering a user name and PASSCODE, the user will first get an HTTP form for entering a user name, and then another form for entering the PASSCODE.


Rule: To

List of destinations
Specifies that the rule will apply to requests sent to the network entities listed.

Add. Click to specify a destination for the rule.

Edit. Click to edit the properties of a selected destination. The properties for some network entities can be viewed only.

Remove. Click to delete a destination from the list.

Exceptions
Specifies that the rule will not apply to requests sent to the network entities listed as exceptions.

Add. Click to specify an exception for the rule.

Edit. Click to edit the properties of a selected exception. The properties for some network entities can be viewed only.

Remove. Click to delete an exception from the list.


Rule: Users

Rule:

This content is not yet available.


Rule: From

List of network sources
Specifies that the rule will apply to requests from the network entities listed.

Add. Click to specify traffic sources for the rule.

Edit. Click to edit the properties of a selected traffic source. The properties for some network entities can be viewed only.

Remove. Click to delete a source from the list.

Exceptions
Specifies that the rule will not apply to requests from the network sources listed as exceptions.

Add. Click to specify an exception for the rule.

Edit. Click to edit the properties of a selected exception. The properties for some network entities can be viewed only.

Remove. Click to delete an exception from the list.


Server Publishing Rule: From

List of network sources
Specifies that the server publishing rule will apply to requests from the network sources listed.
Add. Click to specify a source for the rule.
Edit. Click to view the properties of a selected source.
Remove. Click to delete a source from the list.
Exceptions
Specifies that the server publishing rule will not apply to requests from the network sources listed as exceptions.
Add. Click to specify an exception for the rule.
Edit. Click to view the properties of a selected exception.
Remove. Click to delete an exception from the list.


Web Publishing Rule: From

List of network sources
Specifies that the Web publishing rule will apply to requests from the network entities listed. Network entities specified as the traffic sources in a Web publishing rule must be included in the Web listener selected for the rule.

Add. Click to specify traffic sources for the rule.

Edit. Click to edit the properties of a selected traffic source. The properties for some network entities can be viewed only.

Remove. Click to delete a source from the list.

Exceptions
Specifies that the Web publishing rule will not apply to requests from the network sources listed as exceptions.

Add. Click to specify an exception for the rule.

Edit. Click to edit the properties of a selected exception. The properties for some network entities can be viewed only.

Remove. Click to delete an exception from the list.


Rule: Schedule

A schedule determines when a rule is put into effect.

Schedule
Shows the schedule currently selected for the rule and displays a list of defined schedules.
New
Click to create a new schedule.
Description
Displays a description of the schedule, if one exists.
Schedule table
Displays the schedule. A dark cell means the rule is in effect during that hour on that day. A white cell means the rule is not in effect.

You cannot edit a schedule from this page. To edit a schedule, on the Toolbox, select Schedules, then right-click on the selected schedule and select Properties.


Rule: Users

Displays the user sets to which the rule applies.

Add
Click to add a new user set to the list.
Edit
Click to edit the selected user set.
Remove
Click to delete the selected user set from the list.
Exceptions
Specifies the user sets that are exempt from the rule.


Unsaved Changes

Apply Changes
Saves all changes made to the ISA Server firewall policy configuration and closes the ISA Server Management console. It may take several minutes for the changes to be saved to persistent storage.
Discard Changes
Closes the ISA Server Management console without saving changes made to the ISA Server firewall policy configuration.
Cancel
Closes the Unsaved Changes dialog box and returns you to ISA Server Management console.


Rule: General

Schedule: General

Name
Provides a space to type a name.
Description
Provides a space to type a description.


Schedule: New

You can define a schedule for specific days and hours. Adding a schedule to a rule specifies when the rule is active.

Name
Provides a space to type the name of the schedule.
Description
Provides a space to type a description for the schedule.
Schedule table
Provides a schedule table to create or modify a schedule. A dark cell (active) means that the rule is in effect during that hour on that day. A white cell (inactive) means the rule is not in effect.
Active
Click to toggle to active mode. When in active mode, clicking inactive cells will change them to active.
Inactive
Click to toggle to inactive mode. When in inactive mode, clicking active cells changes them to inactive.


Schedule: Schedule

A schedule determines when a rule is put into effect.

Schedule table
Provides a schedule table showing the times and days that the schedule is in effect.
Active
A dark cell in the table means that the rule is active during that hour.
Inactive
A white cell in the table means that the rule is inactive during that hour.


Security Reports: Authorization Failures

This report shows the users who had the highest number of authorization failures during the report period.

Include this number of users
Specify how many users should be included in the report. Users who had the most dropped packets are listed first.


Security Reports: Dropped Packets

This report shows the clients who had the highest number of dropped network packets during the report period.

Include this number of clients
Specify how many clients should be included in the report. Clients who had the most dropped packets are listed first.


Select Server

Select one of the following servers
Displays a list of alternate ISA Server computers to which client requests can be redirected.


Select Certificate

Certificates
Displays a list of certificates stored in the certificate store of the ISA Server computer. Select a certificate from the list, and then click OK.

When selecting a certificate for remote site VPN, for negotiation between the local and remote server, both servers must have proper computer certificates.


Select Domain

Provides a space to specify the name of a domain that should be used for basic authentication if the client does not specify a domain name when providing credentials during basic authentication.

Domain Name
Specify the domain name. To select the domain name from a list of available domains, click Browse.


Select Network Dial-Up Connection

Network Dial-up connection
Displays the list of dial-up connections defined on the ISA Server computer. Select the dial-up connection that will be used for automatic dialing, and then click OK.


Select User Sets

Available User Sets
Lists all the currently defined user sets. To select a user set, select its check box.
New User Set
Click to define a new user set. Clicking this button opens the New User Set Wizard. When you complete the wizard, the new user set will be added to the list of defined user sets.


Server: General

Name
Provides a space to type the name of the server.
Description
(Optional) Provides a space to type a description.
ISA Server Version
Displays the version of ISA Server that is installed on the computer.
Product ID
Displays the product identification number of the ISA Server software.
Created
Displays the creation date.
Installation directory
Displays the name of the folder where ISA Server is installed.


SMTP Filter: Attachments

Specifies the types of attachments that the SMTP Message Screener will refer to in the process of filtering e-mail messages. When the SMTP Message Screener encounters an attachment that matches the criteria you define, it either deletes, holds, or forwards the message, based on the configuration. The SMTP Message Screener can look for attachments based on name, extension (such as .exe or .mpg), or size.

Attachments
Lists the attachments that the SMTP Message Screener will block. Attachments are blocked and handled according to the order in which they are listed.
Add
Click to specify an attachment type and configure if an e-mail message containing the attachment will be deleted, held, or forwarded.
Edit
Click to change how the SMTP Message Screener handles e-mail messages containing the selected attachment.
Remove
Click to remove a selected attachment from the list of blocked attachments.


SMTP Filter: Commands

Specifies the SMTP commands that are accepted by the SMTP filter, and the maximum length of the command that is accepted. When a client uses a command that is not accepted by the SMTP filter, the filter closes that connection.

Commands List
Shows the lists of commands that are currently accepted by the SMTP filter.
Add
Click to add a command. Only simple SMTP commands can be added. When you add a command, you specify the command name and maximum allowed length. In addition, you specify whether filtering for the command is enabled or disabled.
Edit
Click to modify the command configuration.
Remove
Click to remove a user-defined command (predefined commands cannot be removed).

Note that when a client uses a command that is unrecognized by the SMTP filter, no filtering is performed on that message. Also, when a client uses a command that is defined but disabled, the filter closes that connection.


SMTP Filter: Commands

SMTP Filter: General

Enable support for Message Screener
Click to enable filtering of e-mail messages by the Message Screener.

For filtering to occur, Message Screener must be installed, and the ISA Server SMTP Filter must be enabled.


SMTP Filter: Keywords

Specifies the keywords that the SMTP Message Screener will refer to in the process of filtering e-mail messages. When the SMTP Message Screener encounters a keyword, it will either delete, hold, or forward the message, based on the configuration. The SMTP Message Screener can look for the keyword in the header of the e-mail message, the body of the e-mail message, or both.

Strings
Lists the strings that the SMTP Message Screener will refer to as keywords. Keywords are blocked and handled according to the order in which they are listed.
Add
Click to specify a keyword and configure if an e-mail message containing the keyword will be deleted, held, or forwarded.
Edit
Click to change how the SMTP Message Screener handles e-mail messages containing the specified keyword.
Remove
Click to remove a keyword from the list.


SMTP Filter: Users/Domains

Specifies the sender's e-mail addresses and domain names for the SMTP Message Screener. E-mail messages that arrive from those e-mail addresses and domain names will be blocked.

Blocked Senders
Lists the e-mail addresses of senders whose mail will be blocked by the message screener.
Sender
Specify an e-mail address in the format user@domain.com.
Add
Click to add the specified sender to the list of rejected senders.
Remove
Click to remove a sender from the list of rejected senders.
Blocked Domains
Lists the domains whose e-mail messages will be blocked by the message screener.
Domain name
Specify a domain in the format domain.com.
Add
Click to add the domain name to the list of blocked domains.
Remove
Click to remove a domain name from the list of blocked domains.


Filter: Networks

Port
Specifies the port number on which ISA Server listens for requests for this filter.
Network list
Specifies the networks from which ISA Server will accept requests.


Ports

Specifies that ports, other than default ports defined in the protocol definitions, will be used by the firewall or by the published server.

Firewall port
Specifies that ISA Server will accept incoming client requests on the default port, as indicated in the protocol definition, or on a port other than the default port. If an alternate port is selected, ISA Server receives client requests for the published service on the nonstandard port, and then forwards requests to the designated port on the published server.
Published server port
Specifies that the published server will accept client requests for the published service on the default port as indicated in the protocol definition, or that requests for the service will be accepted on an alternative port.
Source ports
Specifies a range of ports from which the ISA Server will accept client requests.


Server Publishing Rule: To

Specify the network address of the server to publish
Provides a space to type the IP address of the server that will be published.
Requests appear to come from the ISA Server computer
Specifies that the IP address making the request will appear to be the ISA Server computer. In this way, you effectively hide the address of the client making the request.

This option is applicable if there is a network address translation (NAT) relationship between the published server and at least one client computer. This option does not apply if a route relationship exists between the published server and all possible clients.

Requests appear to come from the original client
Specifies that the IP address making the request will appear to be the client.
Some applications require actual identification by the real requesting client. When you publish these applications, you can configure ISA Server to forward requests with the IP address of the requesting (source) client.


Server Publishing: Traffic

Server Publishing Rule: Traffic

Allow network traffic using the following protocol
Specifies that the rule applies to the protocols selected. All IP traffic includes all communication with the ISA Server computer, even using protocols not specifically defined and listed by ISA Server. Selected protocols can include protocols defined by ISA Server, or customized protocols. Protocols defined by ISA Server for use in server publishing rules are inbound and include the word server, for example, L2TP Server.
Properties
Click to view or modify the selected protocol definition.
Filtering
Click to apply additional application filtering. This option is available for specific protocols only (e.g., Exchange RPC, FTP, SMTP).
Ports
Click to override the default ports used to connect to the published server, and to specify ports from which clients can make requests.
New
Click to create a new protocol definition.


Subnet: General

Defines a subnet (network IP addresses and network mask) as a subnet network object. You can apply access rules or publishing rules to the subnet.

Name
Provides a space to type the name of the subnet.
Network address
Provides a space to type the first address in the address range comprising the subnet.
Number of IP addresses
Provides a space to type the number of IP addresses to include in the subnet. You can type a number to limit the range of addresses in the subnet. Alternatively, you can specify a Network mask.
Network mask
Provides a space to type the network mask. The mask is ANDed with the first address in the subnet (specified in Network address) to determine the range of addresses in the subnet.
Alternatively, specify the number of IP addresses in the subnet.


Summary Reports: Cache Hit Ratio

This report summarizes how requested Web objects were returned from the cache or from another destination.

Sort Order
Select the criteria used to sort the columns in the report tables.

Requests. Sort according to the number of Web requests.

Bytes. Sort according to the number of bytes received.


Summary Reports: Top Protocols

This report summarizes the communication protocols used most often to carry network traffic through ISA Server during the report period. This report includes both Web and non-Web traffic.

Include this number of protocols
Specify how many protocols will be included in the report. The most frequently used protocols will be listed first.


Summary Reports: Top Sites

This report summarizes the websites that were most frequently requested by clients during the report period.

Include this number of sites
Specify how many websites will be included in the report. Websites that were most frequently requested will be listed first.
Sort Order
Select the criteria used to sort the columns in the report tables.

Requests. Sort according to the number of requests sent to a website.

Users. Sort according to the number of users sending requests to a website.

Bytes in. Sort according to the number of bytes received from a website.

Bytes out. Sort according to the number of bytes sent to a website.

Total bytes. Sort according to the total number of bytes sent to and received from a website.


Summary Reports: Top Users

This report summarizes the users who generated the largest amounts of network traffic through ISA Server during the report period. This report includes both Web and non-Web traffic.

Include this number of users
Specify how many users will be included in the report. Users who generated the largest amount of network traffic will be listed first.
Sort Order
Select the criteria used to sort the columns in the report tables.

Requests. Sort according to the number of requests sent by a user.

Bytes in. Sort according to the number of bytes received by a user.

Bytes out. Sort according to the number of bytes sent by a user.

Total bytes. Sort according to the total number of bytes sent to and received by a user.


System Policy: From

Specifies the network entities allowed to access services associated with the selected configuration group on the ISA Server computer.

List of network entities
Shows the network entities currently selected for this configuration group. These network entities will be used in the system policy rules for this configuration group.

Add. Click to add a network entity to the list.

Edit. Click to edit the properties for the selected item. The properties for some network entities can be viewed only.

Remove. Click to remove the selected item from the list.

Exceptions
Provides a space to specify that specific computers, or other network entities, are not included in the allowed network entities.


System Policy: To

Specifies the network entities that ISA Server is allowed to access for the network services associated with the selected configuration group.

List of network entities
Shows the network entities currently selected for this configuration group. These network entities will be used in the system policy rules for this configuration group.

Add. Click to add a network entity to the list.

Edit. Click to edit the properties for the selected item. The properties for some network entities can be viewed only.

Remove. Click to remove the selected item from the list.

Exceptions
Provides a space to specify that specific computers, or other network entities, are not included in the allowed network entities.


System Policy

When you install ISA Server, a system policy is configured by default. The system policy creates a set of rules that stipulate how the ISA Server computer interacts with other network resources.

Configuration Groups
Displays each configuration group, categorized by network service type. To edit how ISA Server interacts with network resources required for the network services, select the configuration group from the list. Then, click the To or From tab to select the network resources.
General tab
Specifies if system policy rules for the selected configuration group are enabled or disabled. If the check box is selected, access to the specified network resources is allowed, as specified in the To or From tab, and all related system policy rules are marked as enabled.
To/From tab
Depending on the selected configuration group, you either specify the network resources that the ISA Server computer is allowed access to, or the network resources that are allowed access to the ISA Server computer. When you install ISA Server, default To and From values are provided.

Each system policy configuration group has its own system policy rules, specifying access conditions. To view the entire set of system policy rules, in the Firewall Policy task pane, click Show System Policy Rules.

For more information, see System policy.


Rule: General

Name
Specifies the name of the system policy rule. This name cannot be edited.
Description
Provides a description of the system policy rule. The description includes the system policy configuration group that the rule belongs to.
Enable
Specifies if the system policy rule is enabled. System policy rules are enabled when their corresponding configuration group is enabled in the System Policy Editor. Rules that are crucial for ISA Server operation are enabled by default.

System policy rules cannot be edited directly. You must use the System Policy Editor to modify system policy settings.


Traffic Reports: Cache Hit Ratio

This report shows how requested Web objects were returned either from the ISA Server cache or from the network.

Cache hit ratio is the ratio between the number of objects requested and the number of objects returned from the cache.

Sort Order
Select the criteria used to sort the report data.

Requests. Sort according to number of objects requested.

Bytes in. Sort according to number of bytes received as a result of a request.


Traffic Reports: Top Protocols

This report shows the communication protocols that were used to carry network traffic through ISA Server during the report period. This report includes both Web traffic and non-Web traffic.

Include this number of protocols
Specify how many protocols will be included in the report.


URL Set: General

URL sets specify one or more URLs grouped together to form a set. URL sets can be used in access rules to allow or deny access to specified websites.

Name
Provides a space to type the name of the URL set.
URLs included in this URL set
Displays the list of URLs included in the URL set.
Add
Click to type a new URL for the URL set. The URL must be typed in valid Uniform Resource Locator (URL) format, specifying the protocol (such as http:), the name of the server on which the resource resides (such as //www.wingtiptoys.com), and optionally, the path to a resource (such as an HTML document or a file on that server).
Rename
Click to modify the selected URL.
Delete
Click to remove the selected URL from the URL set.
Description
Provides a space to type a description for the URL set.


User Password

Enter the user credentials required for remote management.

User Name
Provides a space to type your user name.
Password
Provides a space to type your password.
Domain
Provides a space to type the name of the domain of which you are a member (if applicable).


Rule: General

User Set: General

Name
Provides a space to type a name. For built-in user sets, the provided name cannot be edited.
Description
Provides a space to type a description. For built-in user sets, the provided description cannot be edited.


Users: Users

Users
Displays a list of users in the user set, together with the namespace in which each user is defined.
Add
Click to add a user to the user set.
Remove
Click to remove a user from the user set.


Authentication Methods

Authentication methods typically use an authentication protocol that is negotiated during the authentication process. ISA Server offers support for the following authentication protocols.

Highly secure authentication protocols:

Microsoft Challenge Handshake Authentication Protocol Version 2 (MS-CHAPv2)
Specifies that version 2 of the Microsoft Challenge Handshake Authentication Protocol (MS-CHAPv2) will be used. This protocol provides mutual authentication, strong initial data encryption keys, and different encryption keys for sending and receiving. To minimize the risk of password compromise during MS-CHAP exchanges, MS-CHAPv2 drops support for the MS-CHAP password change and does not transmit the encoded password. MS-CHAPv2 uses a two-way challenge/response exchange of credentials, utilizing encryption of the password on the responses. In this way, the connecting client sends proof of the client password without actually sending the password, and the access server sends proof that it has access to the client password without actually sending the password.
Extensible Authentication Protocol (EAP)
Specifies that Extensible Authentication Protocol (EAP) will be used. EAP extends Point-to-Point Protocol (PPP) by allowing arbitrary authentication methods that use credential and information exchanges of arbitrary lengths. By using EAP, you can support additional authentication schemes, known as EAP types. These schemes include token cards, one-time passwords, public key authentication using smart cards, and certificates.

Less secure authentication protocols (not recommended):

Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)
Specifies that Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) will be used. Microsoft created MS-CHAP to authenticate remote Windows workstations, providing the functionality to which LAN-based users are accustomed, while integrating the hashing algorithms used on Windows networks. Like CHAP, MS-CHAP uses a challenge/response mechanism to keep the password from being sent during the authentication process. MS-CHAP is supported by certain Microsoft Windows access clients and access servers. Enable MS-CHAP if your access clients require MS-CHAP authentication.
Challenge Handshake Authentication Protocol (CHAP)
Specifies that Challenge Handshake Authentication Protocol (CHAP) will be used. CHAP uses a challenge/response exchange of credentials with Message Digest 5 (MD5) hashing on the response. In this way, the connecting client sends proof of the client password without actually sending the password. CHAP is widely supported by both access clients and network access servers. Enable CHAP if your access clients require CHAP authentication. CHAP requires the storage of reversibly encrypted passwords for user accounts in the domain.
Shiva Password Authentication Protocol (SPAP)
Specifies that the Shiva Password Authentication Protocol (SPAP) will be used. SPAP sends the password over the connection in an encrypted form. Enable Password Authentication Protocol (PAP) or SPAP only when required by your access clients.
Unencrypted Password (PAP)
Specifies that Password Authentication Protocol (PAP) will be used. PAP sends the password over the connection in an unencrypted form. Enable PAP or SPAP only when required by your access clients.

Other settings:

Allow custom IPSec policy for L2TP connections
Specifies that a Layer Two Tunneling Protocol (L2TP) VPN connection can use a custom Internet Protocol security (IPSec) policy. If you select this check box, you must specify a pre-shared key for use by incoming L2TP site-to-site and L2TP remote client VPN connections.
Pre-shared key
Provides a space to type the preshared key for use by all connections that use this custom IPSec policy.


Network: Addresses

VPN: Network Addresses

Address ranges
Displays a list of IP addresses from all the addresses included in the network. Each IP address can be included in only one network.
Add
Click to add a computer or range of computers to the network.
Edit
Click to modify a computer or range of computers in the network.
Remove
Click to remove a computer or range of computers from the network.


@@Title@@

Dialog Box

This content is not yet available.


VPN: General

Enable VPN Client Access
Provides a check box that is used to enable the ISA Server computer for VPN client connectivity. This check box must be selected for VPN client connections.
Maximum number of VPN clients allowed
Limits the number of concurrent VPN client connections that are allowed at any given time.


VPN Clients: Users

VPN Clients: Groups

Select the domain groups for which remote access is allowed:
Displays a list of users with permission to access ISA Server remotely.
Add
Click to add a user to the list of users allowed to access ISA Server remotely.
Remove
Click to remove a user.


IPSec Configuration: Phase I

Specifies the algorithms used to maintain security and confidentiality during Internet Key Exchange (IKE) main mode (Phase I) negotiation.

Encryption algorithm
Specifies the encryption algorithm that will be used during IPSec Phase 1.

3DES. Select to use Triple Data Encryption Standard (3DES) algorithm, and three unique 56-bit keys. This option offers higher security.

DES. Select to use the DES algorithm and a single 56-bit key.

Integrity algorithm
Specifies the integrity algorithm that will be used during IPSec Phase I.

MD5. Select to specify that a 128-bit key should be used (faster).

SHA1. Select to specify that a 160-bit key should be used (stronger).

Diffie-Hellman
Specifies the Diffie-Hellman group that will be used during IPSec Phase I.

Group 1 (768 bit). Select to specify that 768 bits of master key keying material will be generated.

Group 2 (1024 bit). Select to specify that 1024 bits of master key keying material will be generated (stronger security).

Group 3 (2048 bit). Select to specify that 2048 bits of master key keying material will be generated (strongest security).

When you use a stronger group, the secret key derived from the Diffie-Hellman exchange has greater strength. Use Group 2 when required for interoperability with Windows 2000 and Windows XP.

Authenticate and generate a new key every
Causes a reauthentication and new master key generation at the specified time interval (seconds). Type the time interval.
  • Note that on computers running Windows 2000, the settings specified in this page will be applied to all IPsec IKE Phase I settings on this computer.


IPSec Configuration: Phase II

Specifies the algorithms used to maintain security and confidentiality during Internet Key Exchange (IKE) quick mode (Phase II) negotiation.

Encryption algorithm
Specifies the encryption algorithm that will be used during IPSec Phase II.

3DES. Select to use Triple Data Encryption Standard (3DES) algorithm and three unique 56-bit keys. This option offers higher security.

DES. Select to use the Data Encryption Standard (DES) algorithm and a single 56-bit key.

Integrity algorithm
Specifies the integrity algorithm that will be used during IPSec Phase II.

MD5. Select to specify that a 128-bit key should be used (faster).

SHA1. Select to specify that a 160-bit key should be used (stronger).

Session key settings
Limits key reuse before reauthentication is required. You can specify Bytes, Seconds, or both. If you specify both, whichever interval is reached first will start a new key.

Bytes. Click to specify the number of bytes that can be sent before new master key generation occurs and reauthentication is required.

Seconds. Click to specify the time interval (seconds) before new master key generation occurs and reauthentication is required.

Use Perfect Forward Secrecy
Specifies that master key keying material cannot be used to generate more than one session key. Enabling Perfect Forward Secrecy (PFS) requires reauthentication and may affect performance.
Diffie-Hellman
Specifies the Diffie-Hellman group that will be used during IPSec Phase II.

Group 1 (768 bit). Click to specify that 768 bits of master key keying material will be generated.

Group 2 (1024 bit). Click to specify that 1024 bits of master key keying material will be generated (stronger security).

Group 3 (2048 bit). Click to specify that 2048 bits of master key keying material will be generated (strongest security).

When you use a stronger group, the secret key derived from the Diffie-Hellman exchange has greater strength. Use Group 2 when required for interoperability with Windows 2000 and Windows XP.


Address Assignment

Specifies the method used to assign IP addresses to connecting virtual private network (VPN) clients.

Static address pool
Specifies that addresses will be assigned based on the IP address range defined for the static address pool. To define the range of IP addresses, click Add.
Dynamic Host Configuration Protocol (DHCP)
Specifies that DHCP will be used to obtain IP addresses for VPN clients.
Use this network to obtain DHCP, DNS, and WINS services
Specifies the network where DHCP, DNS, and WINS services reside.
Advanced settings
Click to specify advanced name resolution configuration settings.


VPN: IPSec Authentication

Specifies how authentication is negotiated between the local and remote virtual private network (VPN) servers.

Use a certificate from this certificate authority
Specifies that a certificate will be used to negotiate authentication between the local and remote VPN servers. This certificate must be recognized on both VPN servers.
Browse
Click to display a list of available certificates stored in the certificate store of the ISA Server computer.
Use pre-shared key for authentication
Specifies that a preshared key will be used to negotiate authentication between the local and remote VPN servers, and provides a space to type the preshared key.


VPN: IPSec Connection

Specifies the local and remote tunnel endpoints.

Remote VPN gateway IP address
Provides a space to type the IP address of the remote site virtual private network (VPN) server that you are tunneling to.
Local VPN gateway IP address
Provides a list from which you can select the IP address of the network adapter associated with the local VPN server. This list shows all networks that currently allow VPN access.
Networks...
Displays the list of ISA Server networks specifying which networks are allowed VPN access.
IPSec Settings
Click to modify Internet Protocol security (IPSec) advanced configuration settings.


IPSec Summary

The page shows the Internet Protocol security (IPSec) network configuration settings. The information in this page can be copied and pasted to a file, so that you can use the information when configuring IPSec on the remote computer that will be connecting to this network.


VPN Access Networks

Specifies the networks from which VPN clients and remote sites can initiate virtual private network (VPN) connections. For site-to-site (remote) connections, the access network is the network where the remote VPN server is located.

List of Networks
Displays a list of all the networks and network sets defined in your network configuration. From the list, select the network, or networks, from which clients can initiate VPN connections.

To allow VPN clients to connect through the Internet, select the External network.

If you are defining remote site access, select the networks containing the remote site gateways.

For more information, see VPN access networks.


Name Resolution

Specifies that Dynamic Host Configuration Protocol (DHCP) will be used to obtain IP addresses for virtual private network (VPN) clients.

Obtain DNS Server addresses using DHCP configuration
Click to use a DNS server, which VPN clients can use to resolve TCP/IP names of any computer resource on the destination network.
Use the following DNS server addresses
Primary. Provides a space to type the IP address of a DNS server, which VPN clients can use to resolve names for computers on the destination network. Click Browse to select a computer.
Backup. Provides a space to type the name of a backup DNS server, which VPN clients can use to resolve TCP/IP names of any computer resource on the destination network. Click Browse to select a computer.
Obtain WINS server addresses using DHCP configuration
Click to use a WINS server, which VPN clients can use to resolve TCP/IP names of any computer resource on the destination network.
Use the following WINS server addresses
Primary. Provides a space to type the IP address of the WINS server, which VPN clients can use to resolve names for computers on the destination network. Click Browse to select a computer.
Backup. Provides a space to type the name of a backup WINS server, which VPN clients can use to resolve TCP/IP names of any computer resource on the destination network. Click Browse to select a computer.


VPN Protocols

Enable PPTP
Select to enable Point-to-Point Tunneling Protocol (PPTP) for remote client connections to the ISA Server computer. PPTP is a tunneling protocol used to manage tunnels and encapsulate data.
Enable L2TP/IPSec
Select to enable Layer Two Tunneling Protocol (L2TP) over Internet Protocol security (IPSec) authentication and encryption protocol for remote client connections to the ISA Server computer.


Quarantine

ISA Server provides a predefined Quarantined VPN Clients network. This network can be used in rules to apply policies to clients held in quarantine. Quarantine mode is a set of network restrictions that are configured in Internet Authentication Service (IAS) and implemented on the remote access server. Quarantine mode also requires configuration on each virtual private network (VPN) client. Quarantine Control is available only when ISA Server is installed on a computer running Windows Server 2003.

Enable Quarantine Control
Specifies that Quarantine Control for VPN clients connecting to ISA Server will be enabled. When Quarantine Control is enabled, VPN clients are placed in the Quarantined VPN Clients network, until the configuration of the client computer has been examined and validated by an administrator provided script.
Quarantine according to RADIUS server policies
With this option selected, when a VPN client attempts to connect to the ISA Server computer, Routing and Remote Access policy determines whether the connection request is passed to ISA Server. After Routing and Remote Access policy has been verified, the client unconditionally joins the VPN Clients network.
Quarantine according to ISA Server policies
With this option selected, when a VPN client attempts to connect to the ISA Server computer, Routing and Remote Access unconditionally passes the request to ISA Server. ISA Server places the connecting client in the Quarantined VPN Clients network, subjecting the client to the firewall policy defined for that network. When the client clears quarantine, it moves into the VPN Clients network. When you select this option, you must disable the Routing and Remote Access quarantine feature so that the VPN connection can be established.
Disconnect quarantined users after (seconds)
Provides a space to type the number of seconds that will pass before a client will be removed from the Quarantined VPN Clients network and disconnected from ISA Server.
Exception list
Provides a space to select clients that will be exempt from quarantine.


RADIUS

Specifies whether Remote Authentication Dial-In User Service (RADIUS) will be used to authenticate or log clients connecting through a site-to-site or demand dial connection.

Use RADIUS for authentication
Specifies that ISA Server uses a RADIUS server to authenticate remote access or demand dial connection credentials.
Use RADIUS for accounting (logging)
Specifies that ISA Server should send connection accounting information to the RADIUS server.
RADIUS Servers
Click to open the RADIUS Servers dialog box to view or modify the RADIUS server configuration. Any changes made to the RADIUS server configuration will be applied globally to your ISA Server configuration.

For more information, see RADIUS authentication for remote VPN clients.


Rule: General

VPN Site-to Site Network: General

Name
Provides a space to type a name.
Description
Provides an editable description for the network.
Enable the VPN site-to-site connection
Specifies that the VPN connection is enabled. When the check box is not selected, the connection is disabled and remote site connections are not allowed.


VPN Remote Site Protocol

L2TP/IPSec
Select to use Layer Two Tunneling Protocol (L2TP) over Internet Protocol security (IPSec) as the VPN site-to-site tunnel protocol.
Allow pre-shared key IPSec authentication as a secondary (backup) authentication method
Click to specify that a preshared key will be used for secondary authentication. The preshared key will be used if a certificate is not configured.
Use pre-shared key for authentication
Provides a space to type a preshared key for use with a custom IPSec policy. This preshared key must match the key configured on the remote site for incoming VPN connections.
PPTP
Select to use Point-to-Point Tunneling Protocol (PPTP) over Internet Protocol security (IPSec) as the VPN site-to-site tunnel protocol.


Remote Site Authentication

Authentication methods typically use an authentication protocol that is negotiated during the authentication process. ISA Server offers support for the following authentication protocols.

You can either select Extensible Authentication Protocol (EAP), or one or more other authentication protocols. When a VPN connection is initiated, the local server and remote server negotiate authentication, using the most secure authentication method which they both support.

Extensible Authentication Protocol (EAP)
Specifies that Extensible Authentication Protocol (EAP) will be used. EAP extends Point-to-Point Protocol (PPP) by allowing arbitrary authentication methods that use credential and information exchanges of arbitrary lengths. By using EAP, you can support additional authentication schemes, known as EAP types. These schemes include token cards, one-time passwords, public key authentication using smart cards, and certificates.
Allow these protocols
Specifies the protocols that can be used for negotiation during the authentication process.
Microsoft Challenge Handshake Authentication Protocol Version 2 (MS-CHAPv2)
Specifies that version 2 of the Microsoft Challenge Handshake Authentication Protocol (MS-CHAPv2) will be used. This protocol provides mutual authentication, strong initial data encryption keys, and different encryption keys for sending and receiving. To minimize the risk of password compromise during MS-CHAP exchanges, MS-CHAPv2 drops support for the MS-CHAP password change and does not transmit the encoded password. MS-CHAPv2 uses a two-way challenge/response exchange of credentials, utilizing encryption of the password on the responses. In this way, the connecting client sends proof of the client password without actually sending the password, and the access server sends proof that it has access to the client password without actually sending the password.
Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)
Specifies that Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) will be used. Microsoft created MS-CHAP to authenticate remote Windows workstations, providing the functionality to which LAN-based users are accustomed, while integrating the hashing algorithms used on Windows networks. Like Challenge Handshake Authentication Protocol (CHAP), MS-CHAP uses a challenge/response mechanism to keep the password from being sent during the authentication process. MS-CHAP is supported by certain Microsoft Windows access clients and access servers. Enable MS-CHAP if your access clients require MS-CHAP authentication.
Challenge Handshake Authentication Protocol (CHAP)
Specifies that Challenge Handshake Authentication Protocol (CHAP) will be used. CHAP uses a challenge/response exchange of credentials with Message Digest 5 (MD5) hashing on the response. In this way, the connecting client sends proof of the client password without actually sending the password. CHAP is widely supported by both access clients and network access servers. Enable CHAP if your access clients require CHAP authentication. CHAP requires the storage of reversibly encrypted passwords for user accounts in the domain.
Shiva Password Authentication Protocol (SPAP)
Specifies that Shiva Password Authentication Protocol (SPAP) will be used. SPAP sends the password over the connection in an encrypted form. Enable Password Authentication Protocol (PAP) or SPAP only when required by your access clients.
Unencrypted Password (PAP)
Specifies that Password Authentication Protocol (PAP) will be used. PAP sends the password over the connection in an unencrypted form. Enable PAP or SPAP only when required by your access clients.


VPN: Remote Connection

Remote gateway name or IP address
Provides a space to type the IP address of the remote site virtual private network (VPN) server.
Local site can initiate connection to remote site
Specifies the user credentials required for connecting to the remote site.
User name. Provides a space to specify the name of the local site user account allowed to connect to the remote site.
Domain. Provides a space to specify the domain to which the user account belongs.
Password. Provides a space to specify the password defined for the user account that will be connecting to the remote site.
Confirm password. Provides a space to confirm the password defined for the user account.
Incoming Connection
When creating a site-to-site network for remote access, you must create a user account for initiating the remote access dial-up connection. For the site-to-site connection to succeed, the name of the user account and the name of the site-to-site network must be identical, and the remote access user dial-in properties must be set to allow remote access.
Terminate inactive connections after
Specifies how long connections may remain idle before being automatically terminated.


VPN: Remote Site Authentication

Authentication methods typically use an authentication protocol that is negotiated during the authentication process. ISA Server offers support for the following authentication protocols.

Highly secure authentication protocols:

Microsoft Challenge Handshake Authentication Protocol Version 2 (MS-CHAP v2)
Specifies that version 2 of the Microsoft Challenge Handshake Authentication Protocol (MS-CHAP v2) will be used. This protocol provides mutual authentication, strong initial data encryption keys, and different encryption keys for sending and receiving. To minimize the risk of password compromise during MS-CHAP exchanges, MS-CHAP v2 drops support for the MS-CHAP password change and does not transmit the encoded password. MS-CHAP v2 uses a two-way challenge/response exchange of credentials, utilizing encryption of the password on the responses. In this way, the connecting client sends proof of the client password without actually sending the password, and the access server sends proof that it has access to the client password without actually sending the password.
Extensible Authentication Protocol (EAP)
Specifies that Extensible Authentication Protocol (EAP) will be used. EAP extends Point-to-Point Protocol (PPP) by allowing arbitrary authentication methods that use credential and information exchanges of arbitrary lengths. By using EAP, you can support additional authentication schemes, known as EAP types. These schemes include token cards, one-time passwords, public key authentication using smart cards, and certificates.

Less secure authentication protocols (not recommended):

Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)
Specifies that Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) will be used. Microsoft created MS-CHAP to authenticate remote Windows workstations, providing the functionality to which LAN-based users are accustomed, while integrating the hashing algorithms used on Windows networks. Like CHAP, MS-CHAP uses a challenge/response mechanism to keep the password from being sent during the authentication process. MS-CHAP is supported by certain Microsoft Windows access clients and access servers. Enable MS-CHAP if your access clients require MS-CHAP authentication. For more information, see MS-CHAP in Help.
Challenge Handshake Authentication Protocol (CHAP)
Specifies that Challenge Handshake Authentication Protocol (CHAP) will be used. CHAP uses a challenge/response exchange of credentials with Message Digest 5 (MD5) hashing on the response. In this way, the connecting client sends proof of the client password without actually sending the password. CHAP is widely supported by both access clients and network access servers. Enable CHAP if your access clients require CHAP authentication. CHAP requires the storage of reversibly encrypted passwords for user accounts in the domain.
Shiva Password Authentication Protocol (SPAP)
Specifies that Shiva Password Authentication Protocol (SPAP) will be used. SPAP sends the password over the connection in an encrypted form. Enable Password Authentication Protocol (PAP) or SPAP only when required by your access clients.
Unencrypted Password (PAP)
Specifies that Password Authentication Protocol (PAP) will be used. PAP sends the password over the connection in an unencrypted form. Enable PAP or SPAP only when required by your access clients.

Other settings:

Allow custom IPSec policy for L2TP connections
Specifies that a Layer Two Tunneling Protocol (L2TP) connection can use a custom Internet Protocol security (IPSec) policy. If you select this check box, you must specify a preshared key for use by all connections that use this custom IPSec policy.


VPN: Remote Site Protocol

L2TP/IPSec
Select to use Layer Two Tunneling Protocol (L2TP) over Internet Protocol security (IPSec) authentication and encryption protocol as the VPN site-to-site protocol.
Allow preshared key IPSec authentication as a secondary (backup) authentication method
Click to specify that a preshared key will be used for secondary authentication.
Use pre-shared key for authentication
Provides a space to type a preshared key for use with a custom IPSec policy. This preshared key must match the key configured on the remote site for incoming VPN connections. The preshared key will be used if a certificate is not configured.
PPTP
Select to use Point-to-Point Tunneling Protocol (PPTP) as the VPN site-to-site protocol.


Network: Web Browser

Bypass proxy for Web servers in this network
Specifies that the client will bypass the ISA Server computer when accessing the local server.
Directly access computers specified in the local domain table (LDT)
Specifies that the client can directly access computers defined in the LDT.
If ISA Server is unavailable, use this backup route to connect to the Internet
Specifies that a backup route will be used to service client requests if the ISA Server computer is not available.
Select one of the following options:
  • Direct access. Specifies that for a backup route, the Web Proxy client will retrieve the request directly from the Internet, if the ISA Server computer is unavailable.
  • Alternative ISA Server. Specifies that for a backup route, the request will be sent to an alternate server, if the ISA Server computer is unavailable.


Web Listener: General

Name
Provides a space to type a name for the Web listener.
Description
Provides a space to type a description for the Web listener.


Listener: Preferences

Enable HTTP
Specifies that ISA Server will listen for HTTP requests. In HTTP port, type the port number on which ISA Server listens for requests. The default port number for incoming Web requests is 80. The default port number for outgoing Web requests is 8080.
Enable SSL
Specifies that ISA Server will listen for Secure Sockets Layer (SSL) requests. In SSL port, type the port number on which ISA Server listens for SSL requests. Most Web browsers can only use port 443 for SSL requests.
Click Select to select a certificate to use for SSL requests.
Authentication
Click to configure how to authenticate clients connecting to this network. Authentication is required when access or publishing rules apply to specific users or groups, rather than IP addresses.
Advanced
Click to configure the maximum number of client connections allowed simultaneously.


Authentication

Authentication methods
Displays a list of authentication methods that may be used to authenticate clients connecting to the ISA Server computer.
Ask unauthenticated users for authentication
Specifies that unauthenticated users will be required to authenticate themselves using one of the selected authentication methods.
Select Domain
Provides a space to specify the domain name. Users who log on to the network with the Basic authentication methods must belong to a specific domain. Usually, the Windows domain that is used for Basic authentication is the local domain in which the Web server is active. A different domain can be specified, if required.
RADIUS Servers
Provides a list of RADIUS servers that can be used for RADIUS authentication.
Configure
Opens the OWA Forms-Based Authentication page, used to configure OWA forms-based authentication settings.


Advanced Settings

Specify the maximum number of Web Proxy clients that can connect to the server at any one time simultaneously and the length of time in seconds before the server disconnects an inactive user.

Unlimited
Click to specify an unlimited number of Web Proxy clients connecting to the server at any one time.
Maximum
Click to specify a maximum number of Web Proxy clients connecting to the server at any one time. Type the maximum number of connections.
Connection timeout
Provides a space to enter the number of seconds before the server disconnects an inactive user.


Web Publishing Rule: Listener

Specifies the networks or network sets from which the Web publishing rule will listen for incoming Web requests.

This rule applies to requests received on the following listener
Shows the selected Web listener and provides a list of all Web listeners defined on the server.
Properties
Click to edit the selected listener.
New
Click to create a new listener.


Web Publishing Rule: Users

This rule applies to requests from the following user sets
Specifies the user sets to which the rule applies. By default, rules apply to the built-in "All Users" user set representing both authenticated and unauthenticated users.

Add. Click to add user sets to which the rule is applied. You can also create new user sets.

Edit. Click to modify the selected user set. Only user-defined user sets can be modified.

Remove. Click to remove the selected user set.

Exceptions
Displays a list of user sets to which the rule will not be applied.

Add. Click to add user sets to the exceptions.

Edit. Click to modify the selected user set. Only user-defined user sets can be modified.

Remove. Click to remove the selected user set.

Forward Basic authentication credentials (Basic delegation)
Specifies that if the client performed basic authentication, these credentials will be forwarded to the published server.

ISA Server also includes a built-in "All Authenticated Users" user set representing all authenticated users and the "System and Network Services" user set representing the Local System service and the Network service on the ISA Server computer (used for system policy).


Web Publishing Rules: Paths

List of paths
Displays a list of path names that the client specifies in the request. Also displays a corresponding list of subdirectories on the published Web server.
For example, to direct all client requests for http://www.widgets.microsoft.com/Sales.htm to the main directory on the published Web server, specify the following: External Path as http://www.widgets.microsoft.com/Sales.htm, Internal path as /*.
Add
Click to add a subdirectory to map to a path specified in the client request.
Edit
Click to modify the selection.
Remove
Click to remove an entry from the list.


Web Publishing Rule: Public Name

This rule applies to
Select if this rule applies to all requests, or only to requests for specific websites.
Web sites and IP addresses
Displays a list of IP addresses and public names (DNS names or URLs) to which the rule is applied.
Add
Click to add an IP address or public name to which the rule will be applied.
Edit
Click to edit the selected IP address or public name.
Remove
Click to remove the selected IP address or public name.


Web Publishing Rule: Bridging

Web server
Specifies that the rule is applied to a Web server.
If you select this option, client requests will be redirected to a Web server. By default, the client request will be redirected to port 80, as a Hypertext Transfer Protocol (HTTP) request.
Redirect requests to HTTP port
Click if the client request will be forwarded as an HTTP request.
If you select this option and if the client requests HTTP, after ISA Server passes the request to the internal Web server, the communication will be redirected using HTTP.
If you do not select Redirect request as SSL, the Secure Sockets Layer (SSL) requests are also redirected using HTTP.
Redirect requests to SSL port
Click if the client request will be forwarded as an SSL request.
If you select this option, even if the client request uses HTTP, after ISA Server passes the request to the internal Web server, the communication will be redirected using SSL and the packets are encrypted.
Use a certificate to authenticate to the SSL Web server
Click to use a certificate to authenticate to the SSL server. Certificates act as an added security mechanism between ISA Server and an SSL Web server.
Click Select to select a certificate.
FTP server
Specifies that the rule is applied to a File Transfer Protocol (FTP) server.
If you select this option, client requests will be redirected to a Web server. By default, the client request will be redirected to port 21, as an FTP request.
In Use this port when redirecting FTP requests, specify the port to which FTP requests will be redirected.


Web pub To dialog

Web Publishing Rule: To

Server
Specifies the name or IP address or name of the computer (Web server) on which the website is located. To search for the Web server, click Browse.
Forward the original host header instead of the actual one
Click to configure ISA Server to pass on the original host header information. By default, when ISA Server receives an incoming Web request, it does not pass the host header included in the client request on to the publishing Web server. This means that all requests that are routed to a particular computer must be routed to the same (default) website on the computer. When ISA Server passes host header information, client requests are routed to a particular site on the published computer.

Specify how ISA Server forwards proxy requests to the published server.

Requests appear to come from the ISA Server computer
Select if you want ISA Server to substitute the original IP address sent with the packet with its own IP address.
Requests appear to come from the original client
ISA Server forwards requests with the source IP address of the requesting original client. When you select this option, ISA Server should be configured as the gateway for the published Web server. Alternatively, ISA Server can be configured as the default gateway for the IP address of the requesting client. Otherwise, IP packets returned by the Web server will not reach the ISA Server computer.


Web Publishing Rule: Traffic

Specifies the protocols to which the rule applies.

Filtering
Click to apply additional policy to HTTP traffic. Additional policy includes blocking specific methods, extensions, headers, and signatures.
Notify HTTP users to use HTTPS instead
Click to specify that users attempting to connect to the website using HTTP will be notified that they must use HTTPS instead.
Require 128-bit encryption for HTTPS traffic
Click to specify that HTTPS requests that do not use 128-bit encryption will be blocked.


Web Chaining Rule: General

Name
Provides a space to type the name.
Description
Provides a space to type a description.
Type
Displays the type of rule.
Evaluation order
Displays the order in which this rule is evaluated.
Enable
Specifies that the rule is enabled.


Web Usage Reports: Top Browsers

This report shows which Web browsers were most frequently used to connect to the Internet through ISA Server during the report period.

Include this number of browsers
Specify how many browsers will be included in the report.
Sort Order
Select the criteria used to sort the columns in the report tables.

Requests. Sort according to the number of requests sent by browsers.

Users. Sort according to the number of users using a browser.


Web Usage Reports: Object Types

This report shows the objects that were most frequently delivered by ISA Server in response to client requests during the report period.

Include this number of object types
Specify how many object types will be included in the report.
Sort Order
Select the criteria used to sort the columns in the report tables.

Requests. Sort according to the number of requests.

Users. Sort according to the number of users that sent requests.

Bytes in. Sort according to the number of bytes received in responses.


Web Usage Reports: Top Operating Systems

This report shows which operating systems were most frequently used to connect to the Internet through ISA Server during the report period.

Include this number of operating systems
Specify how many operating systems will be included in the report.
Sort Order
Select the criteria used to sort the columns in the report tables.

Requests. Sort according to the number of requests sent by an operating system.

Users. Sort according to the number of users using an operating system.


Web Usage Reports: Top Protocols

This report shows the Web protocols used most often to carry network traffic through ISA Server during the report period.

Include this number of protocols
Specify how many protocols used during the report period will be included in the report. Protocols that were used most often will be listed first.
Sort Order
Select the criteria used to sort the columns in the report tables.

Requests. Sort according to the number of requests sent using a Web protocol.

Users. Sort according to the number of users who sent requests using a Web protocol.

Bytes in. Sort according to the number of bytes received using a Web protocol.

Bytes out. Sort according to the number of bytes sent using a Web protocol.

Total bytes. Sort according to the number of bytes sent and received using a Web protocol.


Web Usage Reports: Top Sites

This report shows the websites that were most frequently requested by clients during the report period.

Include this number of sites
Specify how many websites will be included in the report. Websites that were most frequently requested will be listed first.
Sort Order
Select the criteria used to sort the columns in the report tables.

Requests. Sort according to the number of requests sent to a website.

Users. Sort according to the number of users who sent requests to websites.

Bytes in. Sort according to the number of bytes received by a website.

Bytes out. Sort according to the number of bytes sent from a website.

Total bytes. Sort according to the total number of bytes sent to and received from a website.


Web Usage Reports: Top Users

This report shows the users who generated the largest amounts of Web traffic through ISA Server during the report period.

Include this number of users
Specify how many users will be included in the report. Users who generated the most Web traffic will be listed first.
Sort Order
Select the criteria used to sort the columns in the report tables.

Requests. Sort according to the number of requests sent.

Bytes in. Sort according to the number bytes received from a website.

Bytes out. Sort according to the number of bytes sent to a website.

Total bytes. Sort according to the total number of bytes sent to and from a website.


Application Entry Setting

Application
Provides a space to type a section in an application entry setting.
Key
Provides a space to type a key to be included in the section.
Value
Provides a space to type a value for the key.


Firewall Client: Application Settings

Settings
Displays a list of application settings for the server copy of the Firewall client configuration file.
Application lists the sections in the file, Key lists the keys that can be included in each section, and Value describes the values to which the keys can be set.
New
Click to add a new application setting for the Firewall Client configuration file.
Edit
Click to modify an application setting for the Firewall Client configuration file.
Delete
Click to delete an application setting for the Firewall Client configuration file.


Firewall Chaining

Use primary connection
Specifies that the ISA Server computer will use its primary method of connecting to the Internet when retrieving objects for Firewall clients or SecureNAT clients.
Chain to this computer
Specifies that the ISA Server computer will forward requests from Firewall clients or SecureNAT clients to an upstream server.
If you select this option, type the name of the upstream server. The server name should be unique. Using the fully qualified domain name (FQDN) will avoid any conflict with duplicated server names.
Use this account
Specifies that credentials will be passed to the upstream server when chaining requests. If the upstream server requires authentication, you must select this option and specify a user account with permissions to access the upstream server.
Click Set Account to configure the user account with permissions to access the upstream server.


Configure Rules to Authentication Without Defining Authentication Method

Cause

If no authentication methods are selected, rules requiring authentication cannot be applied and requests will be denied.

Solution

Either select an authentication method, or modify authentication requirements on rules in accordance with your security policy.


Basic Authentication includes Clear Text

Cause

Some authentication methods, for example Basic authentication, result in clear text being passed over the network. You should be aware of this limitation when deciding how you want to authenticate users making HTTP requests to this network. Note that this is not the case if you have selected Enable SSL on the Web Proxy tab.


Authenticate Users Without Defining Authentication Method

Cause

If you require all users to authenticate, but do not select an authentication method, all access will be denied.

Solution

If you want to force user authentication, select an authentication method. Otherwise, clear Require all users to authenticate.

If you want to use Basic authentication, consider enhancing security by using an SSL connection to send the credentials.


Authenticate Server Running Routing and Remote Access in Active Directory

Cause

Before the server running Routing and Remote Access can authenticate domain accounts, it must be registered in Active Directory using an account with domain admin permissions.

Solution

  1. Log on to the computer with an account that has domain admin permissions.
  2. Launch the Active Directory Users and Computers MMC snap-in, and then double-click the domain name.
  3. Double-click the Users folder, and then double-click the RAS and IAS Servers security group.
  4. Select the Members tab, and add the server to this group. You will receive a message informing you whether registration is successful.


Error Message

Cause

The certificate that you have selected cannot be located in the certificate store.

Solution

For server certificates, check that the certificate is installed in the Personal certificate store of the Local Computer Certificates store. Client certificates should be located in the Personal certificate store of the Microsoft Firewall Service (fwsrv). If you have deleted a certificate from a store, you should reinstall it.


Enable CRL Download System Policy Rule

Cause

In SSL authentication, server and client certificates are checked against a certificate revocation list (CRL). If the CRL has expired, or the certificate appears on the revoked list, ISA Server will attempt to update the CRL. The system policy rule allowing ISA Server to download a CRL is disabled by default.

Solution

To ensure that certificates are checked against a valid, up-to-date CRL, enable the system policy rule by enabling the CRL Download system policy configuration group.

When you click Yes, the CRL Download configuration group, and its corresponding system policy rule, are automatically enabled.

Alternatively, perform the following step:

  • In the System Policy Editor, enable the CRL Download system policy configuration group. For instructions, see Enable system policy configuration group.

Note that the system policy rule allows HTTP traffic from the Local Host network to All Networks. For best practice, you should strengthen this system policy and specify only the sites needed to request CRLs required by your SSL configuration, instead of All Networks.

CRL download may also be done using other protocols, such as LDAP or FTP. You can see the CRL download site and protocol to use for a specific certificate by viewing the CRL distribution point property of the certificate.

If CRL verification is enabled, and ISA Server cannot retrieve the CRL required for verifying a certificate, the certificate is treated as revoked.


Error Message

Cause

The dial-up connection that you have specified does not exist on this computer.

Solution

Either click Select to choose a valid dial-up connection, or create a new connection.

Create a new dial-up connection on server computers running Windows 2000 Server as follows:

  1. Click Start, point to Settings, and then click Network and Dial-up Connections.
  2. Double-click Make New Connection, and follow the instructions in the wizard.

Create a new dial-up connection on server computers running Windows Server 2003 as follows:

  1. Click Start, and then click Control Panel.
  2. In Control Panel, double-click Network Connections, double-click New Connection Wizard, and follows the instructions in the wizard.


Disconnect Warning

Cause

If you choose to disconnect, you will no longer be able to manage the disconnected computer from ISA Server Management.

Solution

To reconnect, right-click Microsoft Internet Security and Acceleration Server in the ISA Server Management tree, and select Connect to. Then, connect to the local computer on which ISA Server is running, or to a remote computer. Management permissions are required on the remote computer. You can connect to the remote computer using the credentials with which you are logged onto the local computer, or specify alternative credentials.


IP Mask Configuration Error

Cause

You have specified an incorrect subnet mask value.

Standard IP address classes are restricted to default formats. For example, in Class B addresses, the first 2 bytes represent the network ID, and the last 2 bytes are used for host IDs. Subnet addressing extends this range by taking bits from the host part of the IP address, to divide the network into subnets.

A subnet mask is a 32-bit number that allows you to specify which bits in the base IP address identify the fixed network ID (set to 1) and which identify the variable host IDs (set to 0).

Solution

Define the subnet mask by one of the following methods:

  • In Network mask, specify the mask in a 32-bit format.
  • In Network address, in the dialog box next to the IP address, type the network prefix length in shorthand notation to indicate the number of bits in the subnet mask–the number of high-order (starting at the left end of the mask) bits set to 1. When you enter a value, the mask will display automatically in Network mask.

Examples

Example 1: You have a Class B address of 131.107.65.37 with a default subnet mask of 255.255.0.0, and you want to allocate 8 host bits for subnets. To do this, you would specify the mask 255.255.255.0 (11111111 11111111 11111111 00000000). By using 8 host bits for subnetting, you obtain 256 (that is, 28) subnet network IDs, supporting as many as 254 hosts per subnet. The number of hosts per subnet is 254 because 8 bits (28 minus 2) are reserved for the host ID. You subtract 2 because subnetting rules exclude the host IDs consisting of all ones or all zeros.

Example 2: You have a Class B address of 131.107.65.37 with a default subnet mask of 255.255.0.0, and anticipate needing only 32 subnets rather than 256. To do this, you would specify the mask 255.255.248.0 (11111111 11111111 11111000 00000000). In this scenario, each of the 32 subnets can support as many as 2,046 hosts (211 minus 2).

Example 3: To allocate 8 host bits for subnets in shorthand notation, set Network address to 131.107.65.37/24, indicating that 24 high-order bits will be set to 1 for the subnet mask, and leaving 8 bits (set to 0) for the host IDs.


Link Translation in Wildcard Domain

Cause

Web pages that include translated links may potentially pose a security threat. To minimize this risk, domain names including wildcard characters are not allowed when link translation is enabled. For example, *.microsoft.com is not permitted.

Solution

Do any of the following:

  • Disable link translation on the Link Translation tab of the Web publishing rule properties.
  • In the Public Name tab, specify each website to which the rule will apply. For example: www.microsoft.com, mail.microsoft.com.


Single Network Adapter Template

Cause

The single network adapter configuration is designed to be used for Web proxying and caching, and not as an edge firewall. If this is the configuration you require, you should uninstall or disable the unused adapters.

Solution

You can physically disconnect the network adapter, or disable it.

To disable an adapter on a computer running Windows 2000 Server, do the following:

  • Click Start, point to Settings, and then click Network and Dial-up Connections. Right-click the adapter, and then click Disable.

To disable an adapter on a computer running Windows Server 2003, do the following:

  • Click Start, point to Settings, and then click Network Connections in Control Panel. Right-click the adapter, and then click Disable.


No Dial-Up Connection is Defined for this Computer

Cause

No dial-up connections have been configured for this computer.

Solution

Create a new connection.

Create a new dial-up connection on server computers running Windows 2000 Server as follows:

  1. Click Start, point to Settings, and then click Network and Dial-up Connections.
  2. Double-click Make New Connection, and follow the instructions in the wizard.

Create a new dial-up connection on server computers running Windows Server 2003 as follows:

  1. Click Start, and then click Control Panel.
  2. In Control Panel, double-click Network Connections, double-click New Connection Wizard, and follows the instructions in the wizard.


Send a Test E-Mail

Cause

A test e-mail message can only be sent if the e-mail addresses specified for the sender and recipient can be resolved.

Solution

Check the e-mail configuration settings:

  1. Verify the name and location of the SMTP mail server.
  2. Check that the e-mail addresses specified are valid for the mail server.
  3. Check network status to ensure that the SMTP mail server is available.


Configure IPSecPol

Cause

To create a remote site network using Internet Protocol security (IPSec) protocol in tunneling mode on a server computer running Windows 2000 Server, you must install the IPSecPol tool. This is a command-line tool for configuring IPSec policy, and provides the same functionality as the IPSec MMC snap-in.

Solution

For the link to the download location of this tool, see IPSec tunneling protocol network.


Logging Filter Expression Requires MSDE

Cause

The Web Proxy or Firewall logging format does not support a query expression or condition in the log filter. Note that for all log formats except Microsoft Data Engine (MSDE), Log Time must be set to Live. In addition, there are some query expressions that are only supported for MSDE logging.

Solution

Change the Web Proxy or Firewall logging format to MSDE, or modify the filter expression or conditions for the required log format. For more information, see Log storage format.


Error Message

Cause

You have chosen to authenticate VPN connections using RADIUS authentication or log VPN connections using RADIUS accounting, but have not specified an available RADIUS server.

Solution

Click RADIUS servers in this dialog box to add a RADIUS server to the list, or modify an existing server list. Specify a valid RADIUS server by DNS name or IP address.


Error Message

Cause

A universally unique identifier (UUID) uniquely identifies an interface on a remote procedure call (RPC) server. After these interfaces are defined in an RPC protocol definition, you can then use the definition in a server publishing rule, to allow clients requesting RPCs on the RPC server to access procedures identified by the UUIDs.

Solution

If you know the RPC server on which the interfaces are defined, type in the server name or browse to its location. You can also choose to enter UUIDs manually, without specifying a server. If you choose to define interfaces manually, you can later specify the server address in the server publishing rule.


Invalid Permissions

Cause

You have attempted to perform an action for which you do not have the required permissions.

Solution

Check administrative permissions. By default, following installation, members of the Administrators group on the local ISA Server computer can configure firewall policy. In addition, ISA Server uses role-based administration to allow users to perform specific ISA Server tasks. For more information, see Administrative roles.


Protocol Outbound Direction

Cause

For access rules, protocols must be defined as outbound. This allows traffic from network sources to network destinations.

Solution

Select an outbound protocol. For more information, see Protocols.


Protocol Inbound Direction

Cause

For server publishing rules, protocols must be defined as inbound. This allows traffic from network sources to the published server.

Solution

Select an inbound protocol. For more information, see Protocols.


Configure Quarantine

Cause

Quarantine Control relies on the Connection Manager (CM) profile you create for your VPN clients. CM profiles are created with the Connection Manager Administration Kit (CMAK) provided in Windows Server 2003 and Windows 2000 Server.

Solution

To learn more about configuring ISA Server and remote clients for Quarantine Control, see Quarantine Control configuration steps.


Error Message

Cause

Before you can use this server to authenticate domain accounts, it must be registered in Active Directory using an account with domain admin permissions.

Solution

  1. Log on to the computer with an account that has domain admin permissions.
  2. Launch the Active Directory Users and Computers MMC snap-in, and then double-click the domain name.
  3. Double-click the Users folder, and then double-click the RAS and IAS Servers security group.
  4. Select the Members tab, and add the server to this group. You will receive a message informing you whether registration is successful.


Error Message

Cause

The Invalid DHCP Offer alert was triggered, and the invalid offer packet was dropped.

Solution

Following this event, you can choose to renew DHCP-assigned IP addresses for all network adapters. If you choose to renew, the DHCP client will accept any offered address from the DHCP server.

Before deciding whether to renew, you can use IPConfig to see if there is anything unusual in IP addresses assigned to network adapters. If you do renew, check IPConfig after the renewal to make sure IP addresses are assigned as expected.


Reset Alert Warning

Cause

If you choose to reset an alert group, all alerts in the group will be removed from the Alerts view of ISA Server Management. They will not be displayed again in the view until they are triggered again.


Routing and Remote Access Restart Warning

Cause

There are some configuration changes that require a restart of the Routing and Remote Access service. During a service restart, client sessions will be disconnected.

Solution

If you want to apply settings and continue with service restart, you can gauge the level of expected disruption by checking on active VPN sessions in the Sessions tab of the Monitoring node. You may also want to inform network administrators or users that VPN activity may be interrupted.


Backup Route Identical to Primary Route

Cause

When the backup route upstream proxy server is the same as the primary route, there is no alternative route for processing requests if the primary route does not respond.

Solution

For high availability, either specify an alternative upstream server as the backup route, or specify that if the primary route is unavailable, requests should be redirected directly to the Internet.


Send Simulated E-Mail

Cause

A test e-mail message can only be sent if the e-mail addresses specified for the sender and recipient can be resolved.

Solution

Check the e-mail configuration settings:

  1. Verify the name and location of the SMTP mail server.
  2. Check that the e-mail addresses specified are valid for the mail server.
  3. Check network status to ensure that the SMTP mail server is available.


Server Publishing with a Single Network Adapter

Cause

The single network adapter configuration is designed to be used for Web proxying and caching, and not as an edge firewall. Server publishing rules, which use network address translation (NAT) to protect the identity of internal publishing servers, are of no use in such a configuration.

Solution

If you want to use server publishing rules effectively, you should configure your ISA Server with an additional adapter.


No Valid Log Folder Prevents Firewall Service Start

Cause

If you specify an invalid folder location, ISA Server will not locate a valid folder for logging, and if the Microsoft Firewall service is later stopped, it cannot restart until the folder location can be resolved.

Solution

Specify a valid folder location. To create a new folder, select the Browse button in this dialog box. In the directory list, select the directory under which you want to create the new folder, and then click Make New Folder.


Returned Log Query Exceeds Maximum

Cause

When you filter the log viewer, a maximum of 10,000 results can be displayed.

Solution

Modify the filter expression or conditions to reduce the amount of results returned.


EAP Error Message

Cause

Extensible Authentication Protocol (EAP) authentication is not based on Windows, and access rules applied to Windows users or groups are not applied to users authenticating with EAP.

Solution

Enable user mapping for these users. Using ISA Server user mapping, you can map users that do not use Windows to Windows accounts. For instructions, see Enable user mapping. Alternatively, you can create a RADIUS user set for these users, so that access rules can be applied to them. For more information, see User sets.


VPN Network

Cause

The IP address range in the static pool for assignment to remote site VPN clients and roaming client connections is smaller that the maximum permitted number of VPN client connections.

Solution

Do either of the following:

  • Extend the static address pool IP range. Note that the addresses you assign to the pool must first be removed from other defined networks, because overlapping of IP addresses between networks is not allowed. The static address pool must provide one more address than the maximum number of VPN connections allowed.
  • Alternatively, on the Tasks tab of the Virtual Private Networks (VPN) node, click Configure VPN Client Access. On the General tab, reduce the number specified in Maximum number of VPN clients allowed.


Enable Scheduled Content Download Jobs

Cause

Scheduled content download jobs can only run if:

  • The Local Host network is configured to listen for Web Proxy client requests.
  • The system policy rules allowing content download are enabled. For more information about system policy, see System policy.
  • The Microsoft ISA Server Job Scheduler service must be running. For more information, see Services.

Solution

When you click Yes, these options are automatically enabled. However, you must also save the changes to the configuration by clicking the Apply button.

Alternatively, perform the following steps:

  1. Enable the Web Proxy client on the Local Host network. For instructions, see Listen for Web Proxy client requests.
  2. In the system policy editor, enable the Scheduled Download Jobs system policy configuration group. For instructions, see Enable system policy configuration group.