Isa 2006

Mc lc
Mclc ...................................................................................................................1
CHNGI ...................................................................................................5
GiithiuhthngVietCERTvcuhnhccdchvcnthit...............5
1.
CitWebServerIIS6.0................................................................................. 6
2.
CitvcuhnhDNS ................................................................................. 14
3.
CitvcuhnhCertificateAuthoritiveServer ..................................... 28
4.
XincpphtmtCertificatechoWebServer .............................................. 35
5.
CuhnhWebServersdngSSL................................................................ 50
6.
XydnghthngActiveDirectory ............................................................ 56
7.
CuhnhdchvchngthcbngRADIUS............................................... 64
CHNGII................................................................................................73
CitISAServer2006 .....................................................................................73
8.
Giithiumhnhthchnh ........................................................................ 74
9.
CitServicePackchoWindows ............................................................... 74
10.
CuhnhTCP/IPcnthitchoISAServer ............................................... 79
11.
CiISAServer2006 ...................................................................................... 97
12.
Nhngcngviccnlmsaukhicit ................................................. 98
CHNGIII ............................................................................................101
CuhnhOutboundInternetAcccess ..........................................................101
13.
Mhnhchobithchnh ....................................................................... 102
14.
CclaiClientscaISAServer2006 ....................................................... 102
15.
CbnvcuhnhtrnISAServer2006................................................ 110
16.
ToAccessRulechoClientstruycpInternet....................................... 151
17.
BackupAccessRule.................................................................................... 211
Telecom Network Solutions

18.
ImportccAccessRule .............................................................................. 216
19.
PhntchcchNATcaNetworkRule ............................................... 221
20.
PhntchcchRoutingcaNetworkRule.......................................... 223
CHNGIV ............................................................................................225
CuhnhcctnhnngFirewalltrnISAServer2006..............................225
21.
Phntchcutrccamtgitin ........................................................... 226
22.
PhnlaiccFirewall ................................................................................ 233
23.
CuhnhPerimeterNetwork ................................................................... 234
24.
SdngNetworkTemplates.................................................................... 234
25.
CuhnhSystemPolicies .......................................................................... 240
26.
CuhnhhthngInstrusionDetectionService ................................... 251
27.
CuhnhtnhnngFloodMitigationcaISAServer2006.................. 260
28.
Bt/TtcctnhnngbomtchoIP ...................................................... 264
CHNGV..............................................................................................271
CuhnhPublishingviISAServer2006 ...................................................271
29.
CuhnhDNSchoPublishingRule ........................................................ 272
30.
ToWebPublishingRule .......................................................................... 273
31.
ToSecureWebPublishingRule ............................................................. 289
32.
CuhnhServerPublishingRule ............................................................. 289
33.
PublishingcchthngServerMultiMedia .......................................... 297
CHNGVI ............................................................................................309
KthpISAServer2006vExchangeServer2003 ....................................309
34.
Mhnhchung............................................................................................ 310
35.
CuhnhSMTPPublishingRule ............................................................. 311
36.
CuhnhSMTPFiltering........................................................................... 316
37.
CuhnhOWAPublishingRule .............................................................. 318
Tiliu:PublishingbiVietCERTVietnamLABmikinnggpxingiv: 2
Email:info@VietCERT.comPhone:0916721672Mr:TrnQucTon
ISA Server 2006
38.
CuhnhRPCPublishingRule ................................................................ 335
39.
CuhnhPublishingRulechoClientssdngPOP3vIMAP4 ....... 339
CHNGVII ..........................................................................................349
SdngccblctrnISAServer2006......................................................349
40.
TmhiuApplicationFiltertrnISAServer2006 ................................. 350
41.
CuhnhHTTPWebFilter ....................................................................... 355
42.
CuhnhFTP,SOCKSApplicationFilter ............................................... 366
CHNGVIII.........................................................................................373
CuhnhVPNtrnISAServer2006 .............................................................373
43.
Mhnhthchnh ..................................................................................... 374
44.
CuhnhcpphtIPngchoVPNClients ......................................... 374
45.
CuhnhAuthentication ........................................................................... 376
46.
CuhnhUserAccountchoVPNClients ............................................... 378
47.
CuhnhVPNtrnISAServer(ClienttoGateway) ............................. 383
48.
TovktniVPNClientstWindows................................................ 386
49.
CuhnhVPNSitetoSiteviISAServer2006...................................... 395
CHNGIX ............................................................................................456
TrinkhaiCachingtrnISAServer2006.....................................................456
50.
TmhiuvCaching .................................................................................. 457
51.
CuhnhISAServer2006thnhProxyServer ...................................... 459
52.
CuhnhClientsdngISAlmProxyServer .................................... 467
53.
TmhiuDefaultCacheRule.................................................................... 475
54.
ToCacheRule ........................................................................................... 476
55.
CuhnhSchedulerDownloadJob ......................................................... 492
CHNGX ..............................................................................................503
MonitorISAServer2006 .................................................................................503
PublishingBy:VietCERT.com,VietnamLAB.com,ICTExpress.com

56.
TngquanvhthngMonitor .............................................................. 504
57.
CuhnhAlert ............................................................................................ 507
58.
SessionMonitor .......................................................................................... 520
59.
CuhnhLogging....................................................................................... 527
60.
CuhnhReport.......................................................................................... 542
61.
MonitorConnectivities .............................................................................. 567
62.
QunlccdchvcaISAServer......................................................... 575
63.
QunlServerPerformance..................................................................... 576
ISA Server 2006
CHNGI
Gii thiu h thng VietCERT v cu hnh
cc dch v cn thit
Trong chng ny thc hnh cu hnh cc dch v c bn, cn thit cho cc bi thc hnh
trong cc chng sau nh Web Server, Mail Server, Certificate Authoritive Server.

1.
Ci t Web Server IIS 6.0

WebServersccitchungviCertificateServerbithchnhs5.
PhnnychngtitrnhbycchciringIISServer.IISServertchhpsn
trongWindowsServer2003vccitthngquaphnAdd/Remove
WindowsComponents
VoControlPanelchnAdd/RemovePrograms
SdngAdd/RemoveProgramscithmdchvWebServerchoWindows
ChntipmcAdd/RemoveWindowsComponents
Add/RemoveWindowsComponents
ClickchnApplicationServer
ISA Server 2006
WebServerIIS6.0trnWindows2003nmtrongphnApplicationServercaWindows.
ClickNext
Ghich:cginnchducheckFTPvSMTP,NNTPkhngbtlntrongApplicationServerv
chngtichaciExchangeServer2003.Nhngdchvnyrtddngbtncngnnchbtln
khinothcscnthit.
Khaibongdni386caWindows2003vclickOK
CitdchvthmyucuphicSourcecaWindows2003Windowschpthmtptin
CthsphikhaibongdnnynhiulntrongqutrnhciIIS6.0
ChngtisdngInternetInformationServiceConsolequnlWebServer

IIStrnWindows2003.VersioncaIIStrnWindows2003l6.0
InternetInformationServiceManagersdngqunlWebServertrnWindow2003
GiaodincaInternetInformationServiceConsolenhtronghnhsau.Ttccc
trangwebtrnServernyuchatrnWebServer.TrnIISkhiciluncmt
WebSitemcnhctosnmangtnDefaultWebSite.cgikhngnn
xaWebSitenyvncdngchonhiumcch.Microsoftsdngweb
sitenycuhnhccdchvtrnWebcamnhnhSharePointPortal,CRM
...vcCertificateServicenhchngtaangthchnhy.
ISA Server 2006
DefaultWebSitemtwebsitectosnvsdngchoccdchvkhccaWindows
CuhnhtotrangwebtrnIISServer6.0
TonhiutrangwebtrnIISServercngsdngport80chngtisdngHost
Headerttnchocctrangweb.phngiictncacctrangweb
ny,chngtiphicuhnhDNSServertrongvngDMZphngiictn
min.ChngtascpnphncuhnhDNSsau
Ghich:BniphttrinphnmmcaVietCERTcungcpchochngtibSourcevcisn
csdliuchytrnnnSQL2005chochngti.Tonbnidungtrangwebchngtilutimt
thmctrnLocal:D:\WebSites
ClickphivoWebSiteschnNewWebSite
ClickchnNewWebSitetomtWebSitemitrnIISServer
DescriptiongHocMng.com
DescriptionmtchotrangwebHcMng.com
Phnmtchotrangweb,chcgitrhinthnhngsclinunhquntrbittndng
ClickNext
ISA Server 2006
KhaibochoWindowsthngsktnichoWebSiteny.Chngtisdng
HostHeaderchotrangweb,bucngidngphighttp://www.hocmang.com
micthtruycpcvotrangwebcachngti.
HostHeadervthngtincatrangweb.MtkhicuhnhHostHeaderchotrangWeb,ngi
dngphigngtnHostHeaderkhaibotrongtrangwebmicthtruycpngcWeb
Server.
ClickNext
HomeDirectorychngticlickBrowsevchnE:\WebSiteslnichatrang
webhocmng.com
KhaibongdnchotrangWebchatrnLocal.Nidungtrangwebchngticbnthitk
11

Webcungcpsn.
ClickNext
CuhnhPermissionchotrangweb.ChngtimcnhReadchottcmingi.Khngnn
quynBrowsevExecutenukhngsdngCGIchoWebbomtmccbn.
DefaultccthngsvclickNext
ClickFinish
Tiptheochngtiquynhtrangwebindex.hmlscnpkhiUservo
trangwebhttp://hocmang.comhaycngiltrangch.McnhkhithuHost
chngtaccuhnhsn,cctptinlmtrangchthngphilindex.*
hocdefault.*
ClickphivotrangwebHocMng.comvchnProperties
ClickchnTabDocuments
Kimtratptinindex.htmchaycha,Removenhngtnkhngcnthitra
ISA Server 2006
TabDocumentstrongIISchophpnhquntrchntrangwebnosltrangchchotanbtrang
web.Trangch(haycngilhomepage)scnputinkhingidngg
www.hocmang.com
KimtralitrangwebvatobngcchclickphichnBrowse
ClickphichnBrowsethhinthnidungtrangwebtrnIISServerConsole
13

NidungtrangWebcahocmang.comcbnthitkWebSitecungcpcho
chngtihinthtrnmnhnhcaIIS.
Nidungtrangwebhcmng.comchinthngaytrongcasIISkhinhquntrsdngchc
nngTesttrnIISServer.
Ch:cthcgiblingayphnnyvkhngthBrowsecnidungcatrangwebvacu
hnh.Nguynnhncngkhngphctplm,doDNSccbnchacuhnhphngiitnHost
wwwcaDomainhocmang.com.cgiphickinthccbnvDNScuhnhDomainName
hocmang.comchahostwwwchvachIPcaWebServer.
2.
Ci t v cu hnh DNS
DNSServertrongmngLANvcDNSServertrongvngDMZNetwork.DMZ
NetworkDNSServerchophpISAServerthycwebsitecaIISServer
trongDMZ.
CitDNSServertrongmngLAN
VoAdd/RemoveWindowsComponentstrongControlPanel
ISA Server 2006
CitthmDNSServicebngWizardAdd/RemoveWindowsComponentscaWindows2003
ClickchnAdd/RemoveWindowsComponents
WindowsComponents
ClickchntipNeworkServices
ngclickchnphnNetworkServicesmbmchnDetailschnchititbn
trong.
15
KhngclickvoNetworkServicesmchnnutDetailshinthchititdchvnocncit
ClickDomainNameSystem(DNS)vClickOK
ChngtichciDNSServertrnServernyvkhngchnccdchvkhc.
ClickOK
TiptheocuhnhDNSServerchvchnhmnhtrnmysdngDNSServer.
ThcraDNSServerkhngcnthitphicitvchngtacthsdngDNS
ServertrnDomainControllers.KhilnDCPROMO,Windowsbtbucchngta
phicuhnhDNSServertrnDomainControllertndngtnhnngtchhp
ZonevoActiveDirectory.
ISA Server 2006
CuhnhTCP/IPtrnDNSServer.
TrnISAServerchngtasdng3Interfacegiaotipvi3Networksl
Internal,DMZNetworkvExternal,trongchcExternallcuhnhDefault
Gateway.ThcratrnISAServerchngtaphicuhnhRoutingTabletrong
dchvRoutingandRemoteAccess.
CuhnhDNSServerTCP/IPSettingstrnISAServer
ChngtachcuhnhDNStrnInternalinterfacecaISAServer,ttcccyu
cuvphngiitntrnISAServerscgivobntrongDNSServerca
mngLANvtDNSServernysthchinForwardernDNSServervng
DMZNetwork.
TrnExternalInterfacecaISAServerhantankhngcuhnhglinquann
DNS.ChngtaphicuhnhtrnInternalISAServercthtngkHost
RecordschomnhtrongDNSZone,htrchotnhnngAutoDiscoveryca
Clients.
17
ISAServersdngInternalInterfacesdngDNSServertrongmngnib.Ttccc
Clients/MemberServertrongmngLANusdngDNSServertrongmngnib.TrnLocal
DNSServersdngchcnngForwardernPublicDNSvnDNSServertrongvngmng
DMZ.
TrongDNSServermngInternalphicuhnhForwardernDNSServer
vngDMZphngiitnminchotrangWebVietnamLAB.com,VnCERT.comv
ICTExpress.com.ChngtisdngtnhnngConditionalForwardertrn
Windows2003
ClickphivoDNSServertrongLANchnProperties
ISA Server 2006
PropertiesDNSServercuhnhForwarder
ChntipTabForwarder
ClickNEW
CuhnhConditionalForwadertrnDNSServertrongLocal
19

Ghich:TnhnngConditionalForwaderchctrnWindows2003sForwardernccDNS
Serverkhcnhauphngiinhngtnminckhaibo.
GtnDomainVietnamlab.com
TnmintorachoForwaderlvietnamlab.com
ClickOK
insIPcaDNSServertrongvngDMZl203.162.23.35
CuhnhachIPcaDNSServersdngphngiitnminvietnamlab.com
ISA Server 2006
ClickADDthmIPnyvovssdngachIPcaDNSServernykhi
phngiitnminvietnamlab.com
TiptcclickNewDomainNamevgtnDomainICTExpress.com
ClickOK
ClickADD
LmtngtchoVnCERT.com
ClickOK
TiptccuhnhForwaderncctnmintrongvngmngDMZ
ClickOKngcasPropertiescaDNSServervtiptheolkimtra
ForwardercaDNSServer.
21
KimtraDNSServerForwarder
TrnISAServer2006chyNSLOOKUP
RUNgCMD
GlnhNSLOOKUP
GtiptnDomainca3DomaincuhnhForwardertrn
C:\>NSLOOKUP
DefaultServer:dc1.vietcert.com
Address:192.168.0.2
>vietnamlab.com
Server:dc1.vietcert.com
Address:192.168.0.2
Nonauthoritativeanswer:
Name:vietnamlab.com
Address:203.162.24.35
>VnCERT.com
Address:192.168.0.2
Name:VnCERT.com
Address:203.162.24.35
ISA Server 2006
>ICTExpress.com
Address:192.168.0.2
Name:ICTExpress.com
Address:203.162.24.35
>
CuhnhDNSServertrongvngDMZ
DMZDNSServerchngtastoccZonetrongvngForwardLookupZone.
Tnminchngtistolhocmang.comvchaHostwwwchvachIP
203.162.23.34lwebServerangchyIISHostingcatrang
www.hocmng.com
VoDNSServertrnServer203.162.23.35chnForwardLookupZone
ClickphichnNewZone
ToNewZonechoDNSServertrongvngDMZNetwork
ClickNext
23

ZonetypechngtimcnhlPrimarychoZoneutin
Hnh28:PrimaryZonechophpDNSServertqunlcDataBasecamnh.DNSServergi
PrimaryctanquynthayiZone.DNSServerutintronghthngchcchnsgi
PrimaryZone
ZoneNameghocmang.com
DNSServertrongvngDMZsphngiitnminhcmng.com
ISA Server 2006
ClickNext
mcnhphnZoneFilevClickNext
ZoneFilenuZonedngStandardmcnhccha%systemroot%\system32\dns\vitn
tptindomain.com.dns
KhngchnphnAllowDynamicUpdatevClickNext
25
DynamicUpdatetrongtrnghpnykhngcnbtlnvPublicDNSZonekhngcncpnht
ngnhZonecaActiveDirectory.TttnhnngDynamicUpdatebomtchotnmn.
ClickFinish
TiptheotoHostwwwchoZonehocmang.com,clickphivoZonechnNew
Host
ISA Server 2006
ToHostRecordmichoWebServertrongvngDMZNetwork.DNSServernymangPublicIP
vscchnhlmNamServercaZoneny
GwwwvphnIPg203.162.23.34
achIPcaWebServertrongvngDMZNetworkcaVietCERTl203.162.23.34
ClickOK
Kimtrabngcchgtnminhttp://www.hocmang.comsthyhinrani
dungtrangwebgingvikhichngtaghttp://203.162.23.34
Nidungtrangwebwww.hocmang.comchinthkhidngDNSServertrongvngDMZ
NetworkphngiiachIP
27
3.
Ci t v cu hnh Certificate Authoritive Server

VietCERTchngtitcuhnhCertificateServerphcvchoviccp
Certificatenkhchhng,cthtrongtnglaichngtiphcvnhlth
thnhvinchokhchhngthnthitcatrangwebwww.hocmang.com.Trc
mt,CAServerVietCERTphcvcpphtCertificatedngvimcchm
hathngtin.TrangwebcuhnhVietnamLAB.com,hocmang.comv
ICTExpress.comccuhnhmhaHTTPviSSL(haycngilHTTPS).
CertificateAuthoritychngtisdngtrnWindows2003
VoControlPanel
ClickchnAdd/RemovePrograms
SdngchcnngAdd/RemoveProgramscaControlPanelthmdchvtrongWindows
ClicktipAdd/RemoveWindowsComponents
ISA Server 2006
ClickchnAdd/RemoveWindowsComponentsthmdchvchoWindows
ClickchnCertificateAuthority.KhichnCertificatechngtiphichrng
WebServerccit.
CertificateServicestrnWindows2003qunlccCertificate,PrivateKey/PublicKeytrnWindows
2003
WindowssthngbochongidngbitnucuhnhCertificateServicess
29

khngththayitnServercna.ClickYEStiptcqutrnhcuhnh.
SaukhicitCerfiticateServicethkhngthitnmytnhcnavtnmyck
nhntrongRootCertificatecaCertificatServer
VClickchnthmApplicationServerciWebServerchoCAServer.
StandaloneCAServerchcthcpphtCertificatequaWebSite.
ClickOK
TiptheolcuhnhthngtinchoCertificateAuthorityServer,chngtis
dngStandaloneServervkhngmunlinquannDomain,vCAServerny
scsdngchoUserInternet.StandaloneServerphicthmWebServer
IISCILentcthxincCertificatebngWeb.
ISA Server 2006
StandaloneCerficateServerphcvchottcmingivchcthcpphtCertificatequaWeb
Site
ClickNext
KhaibothngtinvCertificateServicescuhnh.ThigianExpirecho
CertificatecpbiServernynnkhang2nmlhpl.Certificatetcp
nhVietCERTchngtichcthsdngchoSSLmhangtruyncho
ngthtc.ChcnngchnhcaCertificatelxcnhnServer(Authenticate)
nhngvicxcnhnlcnytrnnvnghavkhngaitrnInternettrust
CertificateServercachngti.
KhaibothngtinvCertficateServer
ClickNext
KhaibongdnnDatabasecaCertificateServer.
31
KhaibongdnlutrdliuchoCertificate
mcnhvClickNext
WindowsyucuachaSourcei386ca2003.Chngtisdngphinbn
Windows2003StandardEditionnnphicungcpngi386caStandard.
WindowsyucuaServicePackhocaSourcecaWindows2003
ClickNexttinhnhciCertificate
CertificateServicecnhbovingidnglstbtASP.NETServiceln
htrchotrangWebxinCertificate.Nunhquntrkhngbtdchvnyth
khngthxinCertificatebngWebcmStandaloneCerficateServicechh
trxinCertificatebngWeb.
ISA Server 2006
TrangwebxinCertificatevvitbngASP.netnnhthngphibtlnASP.nethtrtrang
webny.
ClickYEStiptcci
CuicngClickFinishktthcqutrnhcitCerficateService
Vcngcquntr,WindowscungcpchochngtacngcCertificate
AuthorityManagementConsole
SdngSnapinCertificateAuthorityqunlccCertificatechngnhncho
User/Service/Server
VicngcnychngtacthqunlviccpphtCertificatehocthuhi
chng.
33
GiaodincacngcCertificateAuthoritytrnWindows2003
VinhngCertificateangtrngthichccpphtsnmtrongmc
PENDING
CcPendingCertificatenmtrongvngPending.ViStandaloneServerthviccpphtnyphi
lmbiAdministrator
VnhngCertificatecpphtnmtrongmcISSUED
ISA Server 2006
NhngCertificatechngnhnvcpphtchoClientsclutrongkhuvcIssuedCertificates
HcdanhschnhngCertificateshthnvthuhilinmtrongmc
RevocationList
4.
Xin cp pht mt Certificate cho Web Server

TrckhicuhnhSSLchotrangwebwww.hocmang.com,chngtiphixc
nhCommonNameltntrangweb,chngtingktnminnyvhin
tinidungltrangwebwww.vietnamlab.com
QuytrnhchungkhithchinxinCertificatechomtWebSitelvoWebServer
vtoraPrivateKey/PublicKeyvxutringPublicKeycaWebServerthnh
mtptin
XinCertificateServicechngthcPublicKeycaWebServerlngvinhng
gchWebSitecungcptrongqutrnhxinCertificate.CertificateServicesto
mtCertificatechoWebSitevImportCertificatenyvoWebServercth
chycviSSL.
Chngtithchinbc1ToKeyvXutPublicKeychoWeb
VoIISServervchntrangwebwww.hocmang.comscuhnhHTTPS,click
phichnProperties
VoTabDirectorySecuritychntipntServerCertificate.
35
CuhnhxinCertificatechoWebSitetrnIISServer6.0
WindowsstiptcmtWizardgipchonhquntrkhaibothngtincho
WebSitevtocpKeyPrivate/Public
ClickchnOptionCreateaNewCertificatetomtCertificatemicho
Clients.
ISA Server 2006
TomtCertificateRequestginCertificateWebSitexinchngthc
ClickNext
ChnPreparetherequestnow,butsentitlatertomtPublicKeyvxut
thnhtptin
TotptinCertificateRequestdngPlainTextnhCertificateServerchngthc
37

ClickNext
KhaibothngtinchoWebSitekhicuhnhSSL.cgichCommonName
phingvitnminngktrninternetvltnngidngstruycp
votrangweb:www.hocmang.com
TncaCertificatevchiudicaKeysdngmha
ClickNext
Khaibothngtinvcngtyangchatrangwebwww.hocmang.com,nucn
thit,CertificateAdminphictrchnhimkimchngtnhchnhxccathng
tintrn.
ISA Server 2006
KhaibothngtinvCertificateOrganization
ClickNext
KhaiboCommonNamechoCertificate.CommonNamephingvitnng
kvtntrangwebkhingidngtruycpvotrangny.
CommonNamltnchinthtrnCertificate.CommonNameclutrongCertificatevtn
trangWebnyphikhpvitntrangWebkhiUsertruycp.
ClickNext
39

Khaibothngtinvcngty,qucgia
KhaibothngtinvtchcangxincpCertificateny
Thngtinvdoanhnghipangshutrangwebcnchngthc.Nhngthngtinnyscm
hatonnPublicKeyvcchatrnCertificate.
ClickNext
XcnhngdnchatptinPublicKeycatrangweb.Nidungtptinny
scchngthcbngmtCertificateService.
ngdnlutptinchaPublicKeycaTrangwebhcmng.comchngtivacuhnh.Ni
dungcaPublicKeycngclinquannnhngthngtinkhaibotrongWizard
ClickNext
ISA Server 2006
TnghplitanbthngtinkhaibotrongWizard.cgiphikimtra
liCommonName,rtquantrngnukhngchnhxcCommonNamekhixin
Certificate.
ClickFinish
Bc2xinchngthcPublicKeyvtoCertificate
StandaloneCAServerchcthhtrxinCertificatetWebSitecaCAServer
VotrangwebxinCertificatetiach
http://192.168.0.2/certsrv
GiaodintrangwebcpCertificatecaCerficateServicetrnWindows2003.
ClickchntipAdvancedCerrtificateRequesttruycpvotrangWebcho
phpcpCertificatechoWebServer.
41
ChnAdvancedOptionxinCertificatebngmtWebSitecbittrongtrnghpPublicKey
totrc
Trangwebtiptheohinthnidungcnkhaibo.ChngtichnOptionth2
khaibonidungPublicKeycsntrongtptinCertreq.txt
ChnOptionnyxincpphtmtCertificatetmttptinchaPublicKeycsn
CopytanbnidungcatptinCertreq.txtvocastrntrangwebca
CertificateService
ISA Server 2006
Nidungcatptincertreq.txtcthhinthbngNotepadvtptinnylPlainText.Nidung
chabntrongtptinnylPublicKeycaWebSitecncchngthccpmtCertificate.
CopytanbnidungcatptinnyvocasSaveRequest
Dntanbnidungcatptincertreq.txtvocasWebSitetrnCertificateServer.
ClickSubmitginCertificateServer.
43
DavoRequestIDcthbitcCertificateServernycpbaonhiuCertificate.
ThigianchbaoluldoCertificateAdministratorccpphtCertificatehay
khng.
CpmtCertificateangtrngthich(Pending)
NhquntrphilnCAServerConsolevclickchnIssue,hintiCertificate
nyangtrngthiPending
CpphtCertificateviStandaloneCertificateServerchcththchinManual
QuaylitrangwebcaCAServerDownloadCertificatevDownload
CertificateChainImportRootCAServerCertificatethchinvicTrust
ISA Server 2006
XemtrngthicaCertificateccpphtbiAdministratorhaycha
TrnClient,chngtasdngCertificateSnapinqunl.NhngCertificate
sdngchoWebcxpvoServiceCertificate
ClickLinkDownloadCertificatecchngnhnvcpphtbiCertificateAuthority
ClickchnDownloadCertificateChainDownloadCertificatechoWebServer
vDownloadlunRootCertificatethchinTrustCertificateServer.
ClickDownloadCertificatetiCertificatechoWebSite
45
ClickSavelulitptinCertnew.cer
ClickSaveDownloadCertificatedng.CERfile
ChnngdnluCertificatetiC:\CertNew.cer
LutptinCertificatevoDesktop
ClickClose.KhngsdngchcnngOpentptinCertificateny.
ISA Server 2006
TiptheoDownloadCertificateChain
DownloadCertificatetCertificateAuthority
ClickSavetptinCertificateChain
TptinCertificateChaincludngtptinp7bcha2Certificatesbntronggm1caRoot
CerticicateAuthorityServerv1caWebServer.
ChngticnglutptinnytrongngdnC:\cngvitptinCertnew.cer
ClickOPENmtptinnyvchyvongngdnCERTNEW.P7B
Certificate,DoubleClickvoVietCERTCertificateServicethchinTrust
CertificateAuthorityServerVietCERT.
47
ClickOPENmCertificatevtinhnhInstallCertificate
ClickInstallCertificateImportCertificatevoWebServer.Qutrnhnych
TrustCertificateAuthorityServer.
InstallRootCertificatecaVietCERTCertificateServiceTrustServerny
TiptheoWizardvchnngmcTrustedRootCertificationAuthoritiesbng
ntBrowse
ISA Server 2006
ImportCertificatevoTrustedRootCertificationAuthoritiesthchintrustviCertificate
AuthorityServer
ClickNext
ClickFinishImportCertificatevoWebServerthchinqutrnhTrust
TrnmyWebServermtipCertificatewww.hocmng.comxemCertificate
ccTrusthaycha
49
BiutngnychobitCertificatecTrust.WebServerTrustviCertificateAuthority
trongqutrnhInstallCertificatetrc.
TiptheochngtascuhnhCertificatenychotrangwebwww.hocmng.com
trnDMZNetwork.
5.
Cu hnh Web Server s dng SSL

ChngtisdngWindows2003lmServernnWebServersdnglIIS6.0.
TrnIISServerchngtiHostnhiutrangwebsdngtnhnngHostHeader.
ClickphichutvotrangwebHocMang.comvchnProperties
ClickchntabSecurityvchnServerCertificate
ISA Server 2006
CuhnhkhaiboCertificatechoWebServersaukhiccpphtbiCertificateAuthority
GiykhngcncuhnhRequestmchcnchnProcessthepending
requestandinstallthecertificate
ClickchnProcesstipqutrnhcuhnhHTTPSchoWebSite
Clicknext
Khaibongdncatptincerts.crt
51
KhaibongdnCertificateFilechoWebSite
Clicknext
ChnPortsdngchoWebSitenyHTTPSl443
CuhnhPortchoWebSitekhisdngSSL
ClickNext
Tnghplinidungvtrangweb
ISA Server 2006
TngktqutrnhcuhnhCertificatechoWebSitehcmng.com
ClickFinish
BucUserphitruycpvotrangwebnybngSSL
ClickphivotrangwebchnProperties
ClickchnTabDirectorySecurity
ClickEditSettings
ClickEditcuhnhbtbucsdngSSLchotrangwebny
ClickchnRequiresecurechannel(SSL)vClickchnRequre128bitencryption
53
YucuClientsphisdngHTTPSkhitruycpvotrangWebny
ClickOK
NuUsernotruycpvotrangwebnybngHTTPsbboli
ThnghimlitrangwebbngcchvoInternetExplorergdngach
http://www.hocmang.com,chngtasnhncthngbolphitruycp
trangwebbngngdnSecuretclhttps
ISA Server 2006
InternetExploreryucuphisdngHTTPSkhitruycpvotrangwebhcmng.com
TruycplitrangwebbngngLinksauhttps://www.hocmang.com
Trangwebtruycpbnhthng
NidungtrangWebhcmng.comhinthbngHTTPS.Chbndigcphicaschnh
khamuvngchngttrangwebnyangsdngHTTPS
55

6.
Xy dng h thng Active Directory

HthngActiveDirectorycaVietCERT.comcxydngtrongbtiliu
thchnhmn70294canhmbinsanVietCERT.TrongvngDMZNetwork
cthchngtisxydngmththngDomainICTExpress.comchng
thcSingleSignOnchochthngDMZ.
ViccuhnhActiveDirectorytrnvngDMZcngkhngquphctp,chng
tidngmtServertrongvngnyvchyDCPROMO
VoRUNgDCPROMO
SdngWizardDCPROMOcuhnhActiveDirectorytrnServerthnhDomainController
ClickNextchnkiucuhnhchoDomainController.
CuhnhDomainControllerchomtDomainmiviOptionDomainControllerforaNew
Domain.ChcnngnycsdngkhitomtDomainControllermichomtForest,Treehoc
mtChildDomain.
ISA Server 2006
ClickchnDomaininanewForest
MtForestmiraicnhdubngmtDomainControllerutincaDomainutin
trongtanForest.HthnghinticachngtachacDomainnonnbtbucchngtiphi
chnOptionsny.
BctiptheoxcnhtnDomaindngDNS
TnDomaindngDNScchngtisdnglICTExpress.com.ThngthngtnDomainsl
tncngty.com.ICTExpress.comslDomainutincaForesttrongvngDMZNetwork,n
ngvaitrForestRootDomainvServer1.ICTExpress..comlDomainControllerutinca
Forest.
XcnhtncaActiveDirectorysxydng,trongtanmhnh,chngti
dnghthngActiveDirectorymangtnICTExpress.com(tnkhngphnbit
57

chahoahaythng).DNSDomainNamesmangtnICTExpress.com
TiptheoxcnhNetBIOSDomainNamechoActiveDirectory.Tnnysc
ccClientstrcWindows2000sdngphngiithngtincaActive
Directory.
NetBIOSDomainNamemcnhsclytDNSDomainNamectbphnui.compha
sau.NetBIOSDomainNamecClientstrcWindows2000sdng.
ClickNext,mcnhcuhnhtrn
ClickNextxcnhDatabasecaActiveDirectoryschangdnno.
NTDSlnichaActiveDirectoryDataBasecamiDomainController.Thmcnycnbom
PerformancecannntthnhtlMovesangmtSCSIDrivedngring.
ThmcSYSVOLlnichaGroupPolicyDataBasechotanbDomainny
ISA Server 2006
SysvolFolderchobitylmyDomainControllercamtDomain.SysvolchatanbGPO
didngGUIDFolder.
ClickNext,nucgicuhnhngthqutrnhDCPROMOshinthnh
sau.
DCPROMOthngboqutrnhkimtraDNSZone
CuhnhPermissionthcralcuhnhDomainFunctionalLevelchoDomain
hatngmcno.DomainFunctionalLevelc3cpMixedMode,
NativeModevServer2003.
59
CuhnhchoDomainhatngNativeMode.NucgichnOptiontrn,MixedModes
cthitlpphhpchohthngcnsdngWindowsNT4.0lmDomainController.
CuhnhPasswordchoAdministratorchRestoreMode
RestoremodePasswordccuhnhringchotngAdministratortrnLocalcatngDomain
Controller.LocalAdministratorsdngtrongRestoreModePasswordcchatrongfileSAM
caringmiDomainController.
ChqutrnhDCPROMOhantt,khingliServer.
ISA Server 2006
BiutngxydngmtDomainControllerhantanmi.
cgiphikhingliServersaukhichyxongDCPROMO
KhingliServerktthcqutrnhlnDomain.
SaukhikhingliServer,ServertrthnhmtDomainControllerutin
choForest.
ChoccServertrongvngDMZNetworkthamgiavoDomainICTExpress.com
cththchinSingleSignOn.VicutinkhicuhnhthamgiaDomain
lcuhnhTCP/IPSettingschDNSServervmyDomainController
61
CuhnhDNStrnTCP/IPConfigurationchvDNSServercaDMZNetwork.Nucuhnhsai,
SRVkhngcphngiithnhachIPcaDomainController,qutrnhthamgiaDomains
thtbi.
TiptheovoComputerSettingsphnComputerNamechnChange
ISA Server 2006
ClickChangeitnmytnh/ivaitrcamytnhlthnhvincaDomainhocWorkgroup
ClickphnMemberOfvgtnDomainICTExpress.com
MemberOfDomainchobitClients/MemberServernyslthnhvincaDomaintn
ICTExpress.com.ChngtithamgiaDomainnybngDNSDomainNamevcnphicDNS
SRVtrnDNSServer.
GUsername/PasswordcabtkmtUsertrnDomain.
KhingliServersaukhithamgiaDomainthnhcng
TiptheocuhnhTrustinggia2ForestVietCERT.comvICTExpress.com,kiu
TrustthchinlExternalTrustcthsdngSingleSignOngia2Forest
nythngquaISAServer.CuhnhTrustingDomainccbnthamkhothm
bnTiLiuThcHnhmn294caVietCERT.
Ghich:Clientc2Domaincthlinlccvinhau,trustingcthchycchngta
phicuhnhISAServermcctrafficcnthitchoKerberos.
63

7.
Cu hnh dch v chng thc bng RADIUS

TrnccthitbFirewall,chngthcbngUsername/Passwordchngtaphi
cmtAuthenticationServer.WindowschngtasdngRADIUSServer(trn
WindowsgilInternetAuthenticationServerIAS).
RADIUSServersquytnhvicngnhpthnhcnghaythtbivoISAServer.RADIUSs
dngProtocolUDPtrongqutrnhtruynginncthbtncng.ISAServercthsdng
RADIUSchngthcUsertrongAccessRule.
CitRADIUS
VoControlPanelchnAdd/RemovePrograms
ISA Server 2006
Add/RemoveProgramscitdchvRADIUSServervoWindows2003.RADIUSServerl
dchvminphtchhptrongWindows2003.
ClickchnAdd/RemoveWindowsComponents
CcdchvcngthmcaWindowscthmvobngAdd/RemoveWindowsComponents
ClickchnNetworkServices
ChngtikhngclickchnNetworkServicesmthayvolbmDetailschnduynhtdchv
InternetAuthenticationService(IAS)lRADIUStrnWindows2003.
ClickDetailschntipInternetAuthenticationService(IAS)
65
ChndchvInternetAuthenticationServicevClickOKstinhnhcitRADIUSServertrn
Serverny.
ClickOK
ClickOKvkhaibongdnthmci386caWindows2003
gimnhhthng,Windows2003khngchasnSourcei386trongbcitmthayvo
ngidngphikhaiboSourceCDtrongqutrnhciRADIUS
CuhnhRADIUSServerchophpISAServerchngthc
TiptheolcuhnhIASServer(RADIUSServer)vkhaiboISAServerthnh
ClientcaRADIUSServer.
VoAdministrativeToolschnInternetAuthenticationService
ISA Server 2006
RADIUSServertrnWindows2003vitngiInternetAuthenticationService
GiaodincaIASServertrnWindows2003
GiaodincaRADIUSServertrnWindows2003.
ClickchnRADIUSClientsvclickphichnNewkhaiboISAServerlm
ClientscaRADIUSServer
67
ToRADIUSClientstrnRADIUSServercaWindows2003.
FriendlyNamechngtagtnhinthcaISAServerlFirewall
TiptheogachIPcaISAServer
achIPcaRADIUSClientsachIPcaFirewallISAServer2006
ClickNext
XcnhthngslinlcviClienttcRADIUSServer.ISAServermunchng
thcbngRADIUSServerphikhaibochnhxcShareKeyccuhnhtrn
RADIUSServer.
ChngticuhnhSharedKeyl123abc!@#
ISA Server 2006
SharedKeycsdngRADIUSClientschngthcviRADIUSServer.SharedKeyphi
gingnhautrnClientsvServer.
ClickNext
KtthcqutrnhtoRADIUSClienttrnRADIUSServer.
CuhnhISAServer2006sdngRADIUSServer
VoISAServerManagementConsolechnmcConfiguration
ChntipmcGeneral
TrongcasDetailschnSpecifyRADIUSandLDAPServers
69
SdngchcnngcuhnhRADIUStrongmcGeneralcaISAServerManagementConsole.
ClickAddthmRADIUSServervoISAServer.ISAServerslClientca
RADIUSServer.
ClickAddthmRADIUSServersdngchngthccctraffictClients.
KhaibothngtinvRADIUSServer.
ServerIPl192.168.1.2lachIPcaRADIUSServer.
PhnDescriptionchngtakhngcnquantm
VquantrngnhtlphnSharedSecretphikhpvichuiktkhaibo
trnRADIUSServerl123abc!@#
ISA Server 2006
KhaibothngtinvRADIUSServerchoISAServer.ISAServersgiAuthenticationRequestn
ngRADIUSServercuhnh,sdngSharedSecretKeychngthcviRADIUSServer.
RADIUSsdngUDPPort1812.
ClickOK
TrliviphncuhnhAuthenticationServersvkimtraIP,Portca
RADIUSServersdungl1812UDP.
71
SaukhicuhnhADDthmRADIUSServerchoISAServer,chngtikimtraliphncuhnh
trongISAServer.KimtraliachIPvsPortsdng.Nucuhnhsaiphnny,ISAServer
sblikhisdngRADIUSServerchngthc.
ClickOK
RADIUSServerscsdngkhicuhnhAccessRule,VPN,WebProxytrn
ISAServer
ISA Server 2006
CHNGII
Ci t ISA Server 2006
Gii thiu s lc v chng
73

8.
Gii thiu m hnh thc hnh

CngtyVietCERTthukhangachIPPublic203.162.23.32/28gm16ach
IP,chngtisdngnhngachIPnychonhngServertrongvngDMZ
Network.ISAServerngvaitrFirewall(mhnhThreehome)gm3Interface
tngtcnccmngExternal,InternalvDMZNetwork.
HthngmngchngtithitkchoVietCERTbaogm3hthngm2LANvmtvngmng
DMZ.HthngDMZchngtisdngPublicIP.HthngLANcnlichngtisdng
PrivateIP.
ISAServersbovhthngmngLANkhistncngcaHacker.Nuh
thngDMZbtncng(vInternetClientstruycptrctipvoDMZ)cng
khngnhhngnLANvquaISAServerccAttackTrafficnyblcli.
TrongsutccbithchnhchngticuhnhcctnhnngcaISAServer
2006theomhnhtrn.
CcServerWebServer,MailServer,ChatServervStudyingOnlineServercc
bnthngtruycpchngtittrongvngDMZ(LocalHosting).
9.
Ci t Service Pack cho Windows

ISAServer2006chcthcittrnWindows2003ServicePack1trln
(Windows2003cncphinbnWindows2003ServerR2).citService
Pack1thWindowscabnphicLicenseviCDKeyphhp.VnLicense
chlgiythpl,cntrnWindows,Microsoftsdngkthutkimtra
GenuineCopycaphinbnWindowshinti.NukhngcCDhplbn
khngthcitWindows2003ServicePack1viunycngcnghalbn
khngthcitcISAServer2006.
ISA Server 2006
cgicthdownloadphinbnTrialcaWindows2003sdngtrong180
ngy(phiActivate).MiCDKEYcaWindows2003TrialcActivatemt
lnchophpsdngtrong180ngyvcUpdateServicePackvHotfixy
.
DownloadWindows2003ServicePack1tiach
http://www.microsoft.com/technet/downloads/winsrvr/servicepacks/sp1/default.
mspx
Ghich:tithiimvitcunschny,WindowsServer2003cphinbnServicePack2RC
choWindows2003nhngdoylbnReleaseCandidatennchngtichaavosdng.
TrckhiUpdateServicePackchohthng,ingITphikimtrartkmiHotfixbngcchlp
hthnggilptrnVirtualServer2005R2(ylmtphinbnminphcaMicrosoftchophp
gilphthngServerviClusteringtrnWindows2003).Saukhicpnhtthnhcngtrnhthng
Servero,chngtimithcschotinhnhcpnhtthct.
VietCERTsdnghthngcpnhttngbngsnphmSMS(System
ManagementServer)caMicrosoftcpnhttanbHotFix,ServicePackvc
nhngbnvlicaccchngtrnhkhngphitMicrosoftnhchngtrnh
qunlkhchhngmtdncnglmhnhichngchokhchhngno
quantmnhthngCRMvERPtrinkhaivavosdngti
VietCERT.
cgicthtibnthnghimcaSMS2003tiach
http://www.microsoft.com/smserver/evaluation/2003/r2.mspx
Viccpnhththngrtquantrng.BnthnISAServer2004cngnh2006
hanthnhtngittvicbomttrnsnphmcamnh,nhngcng
chthngbtncng.ascccuctncngvoFirewallldohainguyn
nhnsauy:
Nguynnhnthnht:Viccuhnhqulnglo,ngiquntrkhngnm
htccctnhhngkhicuhnh,mqunhiuPort,mnhiungdngv
suynghtheohngchcnlc,hthngcamnhchclkhngaitn
cng
Nguynnhnthhailhthngcpnhtccbnvlikhngctrinkhai
(mttrongccnguynnhnkhngtrinkhaichthngnyldokhng
cLicense)nnWindowsServer(2000/2003)cli,tnhnglinyHackerc
thtncngquaISAServer2004/2006.
nginhaviccpnhtvcnhtranhviccsnphmFirewallkhc(h
githnh,tngtnhbomtvxydngWizardgipchoviccuhnhdhn
75

baogiht)ISAServercdngsnphmdngAppliance(ISAServer2006c
tchhptrnthitbphncng,nhngdngsnphmnyhinchacbn
rngritiVietnam)
MtsAppliancetiubiu
AmericanResearchMachines(ARM)S.I.A.S.A
http://www.microsoft.com/isaserver/hardware/arm.mspx
CelestixNetworks
http://www.microsoft.com/isaserver/hardware/Celestix.mspx
HewlettPackard
http://www.microsoft.com/isaserver/hardware/hp.mspx
NetworkEngines
http://www.microsoft.com/isaserver/hardware/NetworkEngines.mspx
OttoSecurityandSoftwareTechnologie
http://www.microsoft.com/isaserver/hardware/Otto.mspx
PyramidComputer
http://www.microsoft.com/isaserver/hardware/Pyramid.mspx
WhaleCommunications
http://www.microsoft.com/isaserver/hardware/WhaleCommunications.mspx
WortmannAG
http://www.microsoft.com/isaserver/hardware/WortmannAG.mspx
ISA Server 2006
ThitbISAServerAppliancecaCelestixtchhpbISAServer2006viphncngrtgngng,
titkimcphnLicensechoWindows2003vhthngphncngphctpcamtServer
chuynnghip.
DngthitbcaColestix
MhnhxutcaCelestixISAServerAppliancecthchycvinhiuhthng,mhnha
77

dng.ISAServercthmdngAppliancecxemlmtthmnh,cuhnhddnghnsovicc
dngFirewallkhc.
MhnhFirewallcaColestixviFirmwarelISAServer2006ckhuynco
sdngnhtrn.Ngaithitbra,ISAServerthngccittrnmt
ServerangchyhiuhnhWindows2003Sp1cngcthitkvim
hnhtngtnhchybngAppliance.
GiaodincuhnhcaISAServer2006ApplianceCelestix.Hthnggiaodincphttrinda
trnbISAServer2006SDK.CuhnhAppliancehantanbngWebSitetchhptrnthitb
Port10002.
Cuhnhtrnthitb
DngthitbcaHPProlianttchhpbISAServer2006StandardEditionvicngStripvu
DVD,USBchophpImportcuhnhtngaivoISAServerddng.
ISA Server 2006
DngthitbcaHP
TrnISAServer,nmcnguyntchatngcaISAServerlcthcu
hnhtttrnccthitbMicrosoftISAServer2006Appliance.
Ghich:ISAServer2004cngcdngAppliancenhngchviphinbnEnterprise,vcngkhng
bnthtrngVitNam.
10. Cu hnh TCP/IP cn thit cho ISA Server

ISAServer2006cthchyvinhiumhnh.NuchyvitnhnngFirewall
thISAServersc2InterfacehocnhiuInterface.Mtsmhnhcthkn
khisdngISAServer2006lBastionHost,BackendFirewall,vProxyServer
only(chsdngISAServer2006lmProxyServer,khngtndngtnhnng
Firewallcasnphmny.
BastionHost
MhnhmngBastionHostviFirewalllISAServer(cthlApplicationhcApplianceu
c).Trongmhnhny,ISAServersbovmngInternalvcungcpVPNConnectioncho
RemoteUsers.
Trongmhnhny,ISAServermtmnhbovchohthngmngLANv
cungcpInternetchoUsertrongmngLAN.TrongmngLANcaISAServerc
thcDomainController,DHCPServer,DNSServer,WINSServervWeb
Server,MailServer.NhngServernycthchsdngtrongmngLAN,hoc
csdngtrctiptInternetUser(chiviWebServervMailServer,
ikhiDomainControllercngcsdngchngthcchoInternetUser).
TronghthngLANcaISAlcnybaogm2hthngLAN(1lInternalcho
UsertrongcngtyvmtlhthngDMZchaccServerctruycptrc
teptInternetUser)
79
CuhnhIPvGatewaycahthngBastionHostviPublicIPtISPccpxungchoRouter
ADSL.NucuhnhPublicIPtrnRouterADSLskhngcnthitphiNATtrnRoutervkhi
khngcncuhnhGatewaytnhchoISAServer.
cuhnhIPchohthngBasionHostchngtaphicuhnhnhsau
TrnISAServer
CuhnhIPbaogm2InterfaceInternalvExternal,2Connectionnyktni
n2NICvtlkhcnhau.Trongbithchnh,cgicthsdngmt
NICvi2achIPnhngdxyrali.Chngtikhngkhuyncocgis
dngcchny.
CuhnhIPchoBastionHosttrnISAServersdngNetworkConnectiontrnWindows.
ISA Server 2006
InternalktniISAServervimngLANbaogmDomainControllers,DNS
Server,DHCPServer...vccmyClientstrongLAN.TrnInternalInterfaceca
ISAServersccuhnhnhsau
InternalInterfacecaISAServerktniISAvimngLANmangNetwork192.168.1.0skhng
ccpDefaultGateway.TrnmiHost,kcISAServer,GatewaycthcnhiunhngDefault
Gatewaychcmt(DefaultGateway=DefaultRoute)
ChsdngDNStrongmngLANchoISAServerphngiitnminnib
(trongtrnghptruycpWebServer,MailServerbngHostHeader,ISA
ServerssdngDNSServerphngiitn).KhngnncuhnhDNStrn
ISAServerchtrctipraISPnh210.245.31.130hoc203.162.4.190,...vlcny
ISAServerkhngthnhnthycLocalWebServerhocMailServer.
ExternalInterfacektniISAServerviInternet.ISAServersdngInterface
RJ45ktniraInternetnnkhngthktnitrctipnnhcungcpdch
v(ISP)mphithngquamtRouterhocModem(bchuyntnhiu).
ViExternal,cuhnhIPsnhsau
81
ExternalInterfacecaISAServerphicDefaultGatewayhoccgicthcuhnhDefaultRoute
choISAServercngtngngviDefaultGateway
ClientsvccServerstrongLAN
CuhnhIPtrnccClientsvServerstrongLANphimangNetworkIDging
viISAServerInternalInterfacenghalphitngtcncISAServer
bngInternalInterface.racmtNetworkIDkhc,ccClientsvServers
trongLANcncmtDefaultGateway(lmtIPtrnmtInterfacecaRouter
gnviLANnht),lcny,DefaultGatewaylachIPcaInternalInterface
trnISAServer2006.
ISA Server 2006
mhnhny,ISAServerslGatewaychottcccmytrongLAN.TrnClientschngticu
hnh192.168.1.1lGatewaychottcccClients.CuhnhIPcaClientscthgntnhhocng
quadchvDHCP.
VtrnDMZServermangPubliccngcuhnhchvISAServer/Appliancelm
Gateway
83
CuhnhIPvGatewaycaccmytrongvngDMZNetwork.ChngtisdngPublicIPcho
DMZNetworkvISAServermangachIP203.162.23.33lachIPutintrongNetwork
203.162.23.32/28.
Tmli,cuhnhIPcaccmytrongLANvISAServersnhsau
Laithitb
achIP
Default
Gateway
DNS1
WINS
DNS2
ISAServer
Internal
192.168.1.1
N/A
192.168.1.2
192.168.1.2
ISAServer
External
10.0.0.1
10.0.0.2(IP
caRouter)
N/A
N/A
Clients&
DMZServers
192.168.1.x
192.168.1.1
192.168.1.2
192.168.1.2
DNSServer
caLAN
192.168.1.2
192.168.1.1
192.168.1.2
192.168.1.2
192.168.1.3
ISA Server 2006
ChachIPcaDNSServervachIPtrongcuhnhTCPcaISAServer
(InternalInterface)
MhnhBackEndFirewall
Mhnhth2nycngthngcsdng.ISAServernhgnhhnccm
hnhkhclbovmngLANtrongtrnghpFrontEndFirewallbnhsp,
ccServertrongvngmngDMZbtncngvtHackerscthtncng
tipvotrongmngLAN
ISAServerngvaitrBackEndServerchomtFirewallkhc.KhuvcgiaFrontendvBackend
FirewalllvngDMZchaccServerscPublishedchoInternetUsers
ISAServercthlmFrontEndFirewall,nhngtrongVersiont2004tri,
MicrosoftkhuynconndngISAServer(dngApplication)vivaitr
BackEndlttnht.AppliancecPerformancetthnvbomthn(vnh
phnHiuhnh).
Trongmhnhny,ISAServercngmang2Interface(Externalktninh
thngLANcDMZvGatewaycaISAServerslInternalInterfaceca
FrontEndFirewall.CuhnhtrnFirewallvtrnRouternichung,nnsdng
RoutingTablecuhnhchoccthitbny.ViISAServer,RoutingTable
ccuhnhbngdchvRoutingandRemoteAccesshocROUTEADD
Command.
CcClienttrongmngLANdoISAServerqunlcuhnhIPtngtnhm
hnhBastionHost,GatewaychnISAServer(InternalInterface).
ServertrongvngDMZcuhnhIPkhcNetworkIDvimngLAN,vcng
NetworkIDviExternalIPcaISAServervInternalIPcaFrontEndFirewall.
85

FrontEndFirewalllcnycthlPIXFirewallcnggm2InterfaceExternal
vInternal,cuhnhIPviGateway(hocDefaultRoute)vModemtruycp
Internet.
MhnhBackendviISAServercthhnkhichngtignNetworkIDchoccmngclinquan.
Trongmhnhny,ISAServermangmtachIPPublicnmtrongmng203.162.23.32/28
CuhnhIPrtquantrng,cgikhngclnlnchny,nusai,tanb
mhnhshng.
CuhnhIPtrnFrontendFirewallcthylmtAppliancecaISAServer
hocmtthitbkhcvichnngFirewall
ExternalInterfacecuhnhmangPublicIPvigatewaycuhnhvISP.Trn
ServernycthkhngcncuhnhRoutingTableviDestinationlNetwork
IDcamngLANvnuUsermuntruycptinternetvoLANphithchin
quayVPN2lnvonISAServer.
ISA Server 2006
ExternalInterfacecaFrontendFirewallmangPublicIPvcuhnhGatewaychvachIPca
ISP.
InternalInterfacecngmangPublicIPvikhangIPccptISP,ch
khangIPnykhngtrngvikhangIPsdngchoExternalcaFrontEnd
Firewall
87
InternalInterfacecaFrontEndFirewallchccuhnhachIP,ngairakhngcncuhnhg
ht,kcGatewayvDNS.
CuhnhIPtrnISAServer,ISAmang2InterfacestngtcvimngDMZv
LAN.
ExternalInterfacemangPublicIPnmtrongkhangIPpublicdoISPcppht,
NetworkIDtrngviNetworkIDcaDMZServers.
ISA Server 2006
ExternalInterfacecaISAServermangPublicIPnmtrongkhangmngcaDMZvsdng
FrontEntFirewalllmRouter(DefaultGateway)
InternalInterfacemangPrivateIPcngmngviCorpLAN.cgikhngcu
hnhGatewaytrnInterfaceny.
89
TngtnhBastionHost,ISAServerkhngcuhnhGatewaytrnInternalInterfacecamnh,
chcuhnhDNSphngiitntrongmngnib.
CuhnhIPtrnClientstrongCorpLANcuhnhchGatewayvachIP
InternalcaISAServer.NetworkID192.168.1.0/24
ISA Server 2006
TrnClientstrongmngLANchcuhnhGatewayn192.168.1.1mkhngcnbitbnngai
ISAServercnmtFirewallkhcna.NguyntccaGatewaylRoutergnnht.
CuhnhIPtrnDMZServermangPublicIPdoISPcpphtvchGatewayv
InternalinterfacecaFrontendFirewal.
TrnccServerscahthngDMZchngticuhnhIPtnhvchGatewayvIPcaFrontEnd
Firewall.DNSServerchngtisdngchnhmy203.162.23.35vServernyslDomain
ControllerchohthngForestcaDMZ
Laithitb
achIP
Gateway
DNS
FrontEnd
Firewall
ExternalIP
10.0.0.1
10.0.0.2(a
N/A
chIPcathit
b
LoadBalancing
hocModem)
WINS
N/A
91

FrontEnd
Firewall
InternalIP
203.162.23.33
N/A
203.162.23.34
DNSServer
trongvng
DMZ
203.162.2334
ISAServer
ExternalIP
203.162.23.35
203.162.23.33
N/A
N/A
ISAServer
InternalIP
192.168.1.1
N/A
192.168.1.2
192.168.1.2
LANClients
192.168.1.x
192.18.1.3
192.168.1.1
192.168.1.2
192.168.1.2
192.18.1.3
DMZServers
203.162.23.x
203.162.23.33
203.162.23.34
203.162.23.34
MhnhThreeHomed
ISAServerctrchnhimnngnhtlbovmngLAN,ngthibov
mngDMZchaccServerctruycptrctiptInternetUser.
MhnhThreehomedviISAServerlmFirewallslmhnhchngtichncuhnhtrong
sutTiLiuThcHnhny.DMZvLANuktnivoISAServer,mimngktniviISA
ServerbngmtInterfaceringviNetworkIDkhcnhau.ISAServerngvaitrRouterv
Firewallchoccmngny.
ISA Server 2006
ISAServersc3Interfacektnivi3Networkkhcnhau:External,Internal
vDMZktniviDMZNetwork.MhnhnygingviBastionHost,chc
thmmtInterfaceDMZtchmngDMZrakhimngLAN.
MngDMZtchbitkhimngLANkhngbtncngtphangai,DMZ
thngxuynctruycptInternetnnnguyctncngrtcao.Microsoft
xemDMZNetworknhSemiTrustedNetwork.
CuhnhIPcngtngtnhBastionHost
MhnhThreehomedcminhharhnviNetworkIDcavo.MngDMZchngti
vnsdngPublicIPvikhangIPkhngil203.162.23.32/28
ISAServerExternalInterfacecuhnhmangachIPtht,tnhtrongkhangIP
cISPcppht.
93
ExternalInterfaecaISAServermangmtachIPPublictnh,cuhnhvGatewaytrnISP.c
gichphnSubnetMasktrongachIPtrn,NetworkIDchgm2achIPl203.162.24.33
v203.162.24.35ktninISP.
ISAServerInternalInterfacemangachPrivateIPtngtcvimngLAN
mangNetworkID192.168.1.0/24
ISA Server 2006
InternalInterfacecaISAServerkhngcuhnhGateway,chsdngGatewaytrnExternalca
ISAServer
DNSServertrongLANscuhnhForwardernDNSServertrongmngDMZ,
gipISAServerphngiictnmincaDMZtrongtrnghpsdng
PublishingRule.
Trongmhnhny,ISAServermangthmmtInterfacektniviDMZ
Network.DMZNetworkchngticuhnhmangPublicIPtnhnnInterface
nycngphimangPublicIPcngNetworkIDviDMZNetwork.
PhnDMZInterfacechngticngkhngcuhnhGateway,cxemnhInternalcaISA
ServernhngmangachIPPublic.
ClientstrongLANmangachIPnmtrongNetworkID192.168.1.0/24vcu
hnhchDefaultGatewaynInterfaceInterfacecaISAServer.DNSServerch
vDNSServertrongmngLAN.TDNSServernysforwardernhng
RequestnccServertrongvngDMZhocPublicDNSServer.
95
ClientstrongmngLANttccuhnhGatewaychvISAServer(philInternalInterfaceca
ISAServer)
ServerstrongmngDMZmangachIPtnhvsdngISAServerlm
Gateway.
ISA Server 2006
ServertrongmngDMZcaISAServercngmangachIPtnhvsdngISAServerlm
Gateway
TmttccachIPcuhnhtrnISAServer,LANClientsvDMZServers.
Laithitb
achIP
Gateway
DNS
WINS
ISAServer
ExternalIP
10.0.0.1
10.0.0.2
N/A
N/A
ISAServer
InternalIP
192.168.1.1
N/A
192.168.1.2
192.168.1.2
ISAServer
DMZIP
172.16.1.1
N/A
N/A
N/A
Clients
192.168.1.x
192.168.1.1
192.168.1.2
192.168.1.2
192.168.1.3
192.168.1.3
DMZServers
172.16.1.x
172.16.1.1
172.16.1.2
172.16.1.2
11. Ci ISA Server 2006

SaukhicitWindows2003ServicePack1vUpdateWindowsnnhng
Hotfixminht,chngtitinhnhciISAServer2006vimhnhThree
Homed.
Ghich:ISAServer2006khngsdngFirewallClientschoClientsnamcthsdngLDAP
ServerthchinqutrnhSingleSignOnchoClients.
ChyfileSetup.exebtucit
Hnh
Trongqutrnhci,ISAServeryucuxcnhInternalNetworklmngLAN
doISAServerqunl.InternalNetworklmtkhangachIP(tnht
97

NetworkIDnBroadcastIP)cISAServerhiuvitnmcnhlInternal.
SaukhicitISAServer,nhquntrcthtothmccNetworkmivikiu
lInternal.VaitrcanhngNetworksnytngngviInternalmc
nh.
Ch:InternalNetworkhaybtkNetworknoctoratrnISAServerlmtRangeIPtrong
phibaogmachIPcaInterfacetrnISAServerktniviNetwork.
ClickNexttiptc
ChISAServerhanttqutrnhcit.Chngtikhuyncocginnkhi
ngliServersaukhicitISAServer2006hantt.Qutrnhkhings
lmmiliRegistryvkhingliccdchvcaISAServervacci
t.
12. Nhng cng vic cn lm sau khi ci t

SaukhicitISAServerchngtisthchinnhngthaotcsaukimtra
ISAServercithantt.
KimtraccdchvcaISAServer
SdngSnapinServices.msc
Kimtraccdchvsauy
ISAServerControl
MicrosoftFirewallService
ISAServerJobScheduler
ISAServerStorage
ISA Server 2006
KimtraccdchvcaISAServersaukhicitlviclmcnthit.Quantrngnhtldchv
MicrosoftFirewallskimsatFirewallEnginecaISAServer.
NuccdchvchacStart,tinhnhStartccdchvny.Mcnhsau
khici,ccdchvnyckhing.
KimtraServicesbngISAServerManagementConsole
VoISAServerManagementConsolechnmcMonitoring
ChnTabServices
XcnhccdchvangtrngthiRunning
99
KimtradchvcaISAServerbngchnhgiaodinISAServerManagementConsole.Sdng
ISAServerManagementConsolecgicthbt/ttdchv
NutrngthiStop,sdngISAServerManagementConsolestartServices
KhingdchvbngcachClickphichnStart
nbcnycthxemISAServer2006dccithanchnh,nhng
chngtikhuyncocginnkimtralicuhnhIPthitlptrckhi
ci.VicsaicuhnhIPliudxyranhtvingimicuhnhIP.(hiu
ttvIPvGateway,thamkhothmTiLuthchnhmn70291cacngty
VietCERT)
Tiliu:PublishingbiVietCERTVietnamLABmikinnggpxingiv:100
ISA Server 2006
CHNGIII
Cu hnh Outbound Internet Acccess
Cho php Clients trong LAN c truy cp Internet thng qua ISA Server 2006, gii thiu cc
kiu Clients ca ISA Server 2006
101

13. M hnh cho bi thc hnh
14. Cc lai Clients ca ISA Server 2006
ISAServercthsdngcclaiClientssauy:
SecureNAT:ttcccHostTCP/IPcmtachIPvcuhnhISAServer
thnhGateway.ViccuhnhGateaycthtinhnhbngtay,cuhnh
ManuallyhoccuhnhbngmtServer,chydchvDHCPServer.
SecureNATClientscthlmtthitb,cthlmtHostWindows2000,XP,
hocmtmytnhangsdngLinux.ClientssdngSecureNATkhngth
tndnghtctnhnngcaISAServer.
SecureNATchcncuhnhGatewaysdngISAServerlGateway,chngti
cthcuhnhachIPtnhchoccClients.
CuhnhTCP/IPsdngISAServerlmGatewaylchpnhnlmSecureNATClientscaISA
Server.
HocsdngDHCPOptions003cuhnhchoClientslmGateway,Clients
snhncuhnhIPnyvsdngISAServerlmGateway.
ISA Server 2006
CthsdngDHCPServerOption003RoutercuhnhGatewaychoccmyClientstrong
LAN.
SecureNATClientsbtbucphicuhnh,chodchngtacciFirewall
Clientshaykhng.
WebProxyClients:ISAServerhatngvitnhnngProxyrttt.Proxy
ServercungcpchoClientstnhnngCachechoWeb.WebCachingtrnISA
Serversdngrttt.ISAServerCachenidungWebtrnRAMnntcci
thinngk.TtcccWebBrowserhtrctnhnngProxylcths
dngISAServerlmProxyServer.CcBrowsernhIE,Firefox,AvantBrowser
cthdngISAServer2006lmProxyServer.CcProxyClientskhngcns
dngDefaultGatewaycngcthtruycpHTTPvFTPbnhthng.Tnh
nngProxytrnISAServernusdngWebProxyClientschhtrchoHTTP
vFTP.
WebProxySettingscthcuhnhbngPolicytDomainhoccuhnhbng
tay
CuhnhProxySettingsbngPolicy
TmtGPOhpltrnDomain,clickchnEdit,vdchngticuhnhPolicy
trnOUMarketing
103
ChnOUhpltcdngPolicy.SdngDomain/OUPolicyhiuqusmangnvicqunl
ActiveDirectoryrtddng.
ThitlpProxySettingschoClients
VoUserConfigurationWindowsSettingsInternetExplorerMaintenance
Connection
ChntipProxySettingsvDoubleClick
ThayiOptionProxySettingstrongmtGPOangpdnglnOUMarketingcuhnhProxy
chotanbnhnvintrongOUny.
inthngsvoPolicyny.
ISA Server 2006
GiaodincuhnhProxySettingstrongPolicy.
ClickOK
TrnClientslcnycsthayivIESettingsnhngUsercthtthay
ili,chngtistiptcdngmtPolicynacmkhngchoUserthay
iPolicySettings.
VoUserConfigurationAdministrativeTemplatesSystemComponents
InternetExplorer
ChntipSettingProhibitChangingProxySettings
105
TttnhnngiProxybngtaytrongInternetExplorer.ChngtisdngProxycmUsert
thayi.
DoubleClickvachnEnable
ClickEnableOptionDisablechangingproxysettingsvClickOK
ISA Server 2006
ClickOK
SaukhibtcdngbiPolicyny,trnClientsskhngthcuhnhliProxy
Settingscna
SaukhikimtraClientstrongLANchngtinhnthyiumongmunlProxySettingsbv
hiuha,nhngnidungvnl192.168.1.1viPort8080caISAServer.
MunthayiProxySetting,nhquntrssdngPolicycuhnhlim
khngcncuhnhtrntngClients.
Ghich:SaukhithayiPolicy,trnClientsmuntcdngngaylptcphiglnhGPUPDATE
/FORCEhoclnsaukhiClientsLoginsbnhhngPolicyny.Thcranhmquntrchngti
cthLogOffUsertxa,nhngvicnykhngcnthitvkhngcquynlmnhvy.
CuhnhProxySettingstrntngClients
ChngtisdngcchnycuhnhtrnccClientskhngthamgiaDomain.
ChngticuhnhtrnInternetExplorer.
ClickMenuToolsInternetOption
107
CuhnhProxytInternetExplorerbngInternetOption
ChntipTabConnection
ISA Server 2006
ChnTabConnectionvtiptcchnLANSettingscuhnhProxychotngmyClients.
ClickLANSettings
ClickchnUsethefollowingProxySettings
KhaiboachIPcaISAServervPortsdngchoProxyl8080
inIPcaISAServerl192.168.1.1vPortchngtisdngl8080.
FirewallClients:LaiClientsnycncitmtchngtrnhtrnmyClients.
ClientscaISAServerchcthcitrnhiuhnhWindowsnnlaiClients
nychcbitdngchoWindows.ClientscaISAServerstoktninISA
ServerbngmtTunnelringcmhagilWinSOCKS,ttccctraffics
cchuynnISAServervISAServersngvaitrProxychottccc
laitraffic.ClientsccitchngtrnhFirewallClientscthtndngtnh
nngSingleSignOnviUserAccounttrnActiveDirectory.
CuhnhFirwallClientscncitthmmtchngtrnhtrnClients.Chng
trnhnyclytmtthmcSharetrnISAServer.ISAServerttoRule
chophpClientstrongInternalctruycpvoISAServerlytinguyn
Shareny.
KtnilnISAServertiach192.168.1.1lytinguyntrnthmcShare
MSPLNTvchytptinSetup.exe
109
KtninISAServertiach192.168.1.1lyFirewallClientsvchycittrnmyClients.
ChytptinSetup.exe
Hanttchngtrnhcit
CuhnhISAServerClients
GachIPcaISAServervchnCheckNow
ChnTabWebBrowservClickConfigureNowISAClientstngcuhnh
IEProxySettings.
15. C bn v cu hnh trn ISA Server 2006

cuhnhtttrnISAServer2006cgicnnmc3vnchnhsau
y
NetworkDefinition:cISAServerhiulmtkhangachIPktnin
ISAServer.KhangachIPnyctmtNetworkName.ISAServers
qunlNetworknyquaNetworkNametrnISAServer.QunlNetwork
DefinitiontrnISA2006mcConfigurationNetwork
ISA Server 2006
GiaodincuhnhNetworksDefinitiontrnISAServer2006
NetworkRule:quynhccmilinhgiaccNetworkstrongISAServer.Cc
NetworksnycISAServerktnivinhau.GiahaimngkhiiquaISA
Serverssdngmttronghaicchsauy:ROUTEhocNAT.
RoutingkhngthayiSourceIPkhiiquaISAServer,gitincginguyn
SourcevDestinationIPvcForwardnDestination.
NATthayiachSourceIPtronggitinvForwardnDestination.
DestinationchngtachthygitinntExternalInterfacecaISAServerm
khngbitcachIPthtcagitin.
AccessRule:quynhnhnglaitrafficnociquaISAServer.AccessRule
lthnhphnquantrngnhtcaFirewallISAServer2006.cgicnnm
vngAccessRulecthcuhnhttISAServer.
111
PhncuhnhchnhnhtcaISAServerlFirewallPolicynicuhnhttccciukincho
ISAServer.
TtcnhngbithchnhdcaohaythptrnISAServer2006ucthc
hinquaAccessRule.NhngtnhhungcaISAServer2006thcralskt
hpgiaccComponentscaAccessRuleComponenentsvinhau.
ToNetworkmitrnISAServer
KhicmtNetworkmi(mtNetworkIDmi)ktnitrctipnISAServer
chngtasphitomtNetworkDefintionmitrnISAServer.Network
DefinitionbaogmkhangachIPcaNetworkvttnchoNetwork
Definition.
Trongmhnhtrn,VietCERTcthmmtmngLANth2ktnivoISA
ServervmngDMZktnivoISAServer,chngtistinhnhto2
NetworkchoISAServer.
NetworkName
NetworkType
StartIP
EndIP
LAN01
Internal
192.168.1.0
192.168.1.255
DMZNetwork
Perimeter
203.162.23.32
203.162.23.47
ToNetworkLAN01
VoISAServerManagementConsole
ChntabConfiguration
ChntipNetwork
ISA Server 2006
CuhnhNetworkDefinitionbngISAServerManagementConsoletrnWindows2003
ChnTabNetworks
NetworkDefinitiontrongISAServerManagementConsoletrnWindows2003
TrncasTaskPanechnCreateaNewNetwork
113

SdngNetworkTaskstoNetworkmitrongISAServerManagementConsole.
NetworkNamegLAN01
NetworkNamechngtitochoISAServerlLAN01qunlmngLAN01cahthng
VietCERT
ClickNext
NetworkTypechnInternal.InternalNetworkchoISAServerbitylmt
mngLAN(trustedNetwork)lmngcISAServerbovhantan.
ISA Server 2006
LaiNetworksdngchoLAN01lInternal.InternalNetworksdngtrongLANvcISA
Serverbov(TrustedNetwork)
ClickNext
ClickAddRangethmkhangachIPangsdngtrongmngLAN01
115
AddRangethmkhangIPcncuhnhchoISAServer.RangeIPcAddtrongkhangny
dngchomngLAN01
GkhangIPxcnhtrongbngtrn
KhangIPsdngtrongLAN01l192.168.1.0/24.ChtrongkhangIPnyphichacach
IPcaISAServerInterfacektnivimngny.
ClickOK
KimtralinhngIPADDcnmtrongcasWizardhaycha
ISA Server 2006
KimtralikhangIPthmvoISAServerchomngLAN01
ClickNext
ReviewliqutrnhtoNetwork.Trongbcnycgicthxcnhl
mnhtonghaysaiccthngtincththayikpthi.
KimtraliNetworkLAN01vikhangIP192.168.1.0/24
ClickFinishktthcqutrnhtoNetwork.
ToNetworkDMZ
117

ChnmcConfiguration,chnmcconNetworks
CuhnhNetworksDefinitionstrongISAServer2006trnWindows2003.
ChntipTabnetworktrongcasgia
CcNetworkDefinitionstrnISAServer2003
TrongcasTaskPanechnCreateaNewNetwork
ISA Server 2006
ToNetworkDefinitiontrnNetworkTasks
NetworkNamegDMZNetwork
NetworkNamechngtisdngchomngDMZlDMZNetwork
NetworkTypexcnhlPerimeter.PerimeterNetworkcnglmtmngLAN
trongISAServernhngPerimeterchaccServerctruycptInternetnn
cthxemnhkhngbomt.ISAServervccFirewallkhctchDMZ
(Perimeter)rakhimngLANvxemnhSemiTrustedNetwork.DMZ
NetworknucbtncngcngchcthleothangnccServertrongvng
119

DMZ.ISAServersbovtuytiInternalNetworktrongtrnghpDMZb
tncng.
DMZNetworktngngviPerimeterNetwork
ClickAddRangethmkhangIPchovngDMZNetwork
AddrangethmkhangachIPchoDMZNetwork
AddressRangegnhcuhnhIPthngnhttrongkhach
ISA Server 2006
KhangIPchngtisdngchoDMZNetworklPublicIPcnh
ClickOKvkimtralikhangIPcuhnhtrongbngtrc.Vickimtra
nykhngtha,phichcrngachIPcaISAServercngnmtrongkhang
ny.
KhangIPchngtignchoDMZNetworkgm16achIPtnh.
ClickNext
KimtraliqutrnhcuhnhNetwork.
121
ClickFinishsaukhikimtralinhngphncuhnh.
ClickFinish
CuhnhNetworkRule
NetworkRulechoISAServerbitmiquanhgiaccNetworkvinhautrn
ISAServer.Nu2NetworkcnglaiIPssdngROUTEtrnISAServerkhi
tngtc.HaiNetworkkhclaiIP(Private/Public)ssdngcchNATkhi
tngtcvinhauquaISAServer.
XtnhngmiquanhcaccNetworkvinhautrongISAServermhnh
sau
ISA Server 2006
NetworkRuleschmiquanhgiaccmngvinhau.Khithitkhthngphinhntmtng
quanhthngxcnhkhinocnRoutevNAT.
ChngtathygiaccmngLANvinhaumangachIPPrivatestngtc
nDMZvmngInternet(ISAServerhiuInternetlExternal)bngcch
NAT.QutrnhNATssdngPublicIPcaExternalInterfacetrnISAServer
giaotipvimngInternet.
AllLANSofISAServerInternet:NAT
AllLANSofISAServerDMZ:NAT
Gia2mngLANcaISAServerlInternalvLAN01ktnivinhauquaISA
Server.HaimngLANnysdngcngliachIPlPrivateIPnnss
dngcchROUTEgiaotip
LAN01Internal:ROUTE
VcuicnglDMZNetworkviInternet.ChngtaxtvlaiachIPs
dngycnglPublicIPnnhaimngnysgiaotipvinhaubngcch
ROUTE.
DMZInternet:ROUTE
Ghich:DMZNetworkcthmangachIPPrivatehocachIPPublicty
theohthngcuhnhthno.NuDMZmangachPublicIPthmiquanh
viccmngkhccngcxt:nucnglai,sdngROUTE,khclais
dngNAT.DMZmangachPrivateIPsktniviInternetbngcchNAT
vPrivateIPkhngthtrctipiraInternetviPublicIPbngcchROUTE
123

c.
ToNetworkRulegiaInternalvExternals
McnhISAServercmtRulegilInternetAccessgiaInternalNetworkv
External(Internet)sdngcchNATnnphnnychngtakhngcnto
NetworkRulechoInternalvExternal.
VoTabConfigurationchntipmcNetworks
CuhnhNetworkRulestrongphnNetworkscaISAServerManagementConsoletrnWindows
2003
ChnNetworksRulestrongcasDetailPane
ChnTabNetworkRulestrongphnNetworkschmiquanhgiaccmnggmROUTE/NAT
DoubleClickhocchnPropertiesInternetAccessRule
ISA Server 2006
PropertiesNetworkRulehinticaISAServer.InternetAccesstInternalraExternalssdng
NAT
KimtraphnSourceNetworks
SourceNetworkbaogmInternalvVPNClients.VPNClientscngcxptrongkhangIP
Private.PrivateIPcmiquanhviPublicIPlNAT.
KimtraphnDestinationNetworks
125
DestinationNetworklExternalidinchomngInternet.
KimtratipTabNetworkRuletathysnsngvicchNAT.GiaPrivate
IPNetworkvPublicIPphisdngcchNAT.
TabNetworkRelationshipchmiquanhgiaccmng.NATthaythachSourceIPcagi
tin.
ClickOKngcasPropertiesli.Nhvychngtakhngcncuhnh
InternetAccesschovicNATInternalvLANraInternet.cuhnhInternet
chngtachcncuhnhAccessRule.
ToNetworkRulegiaLAN01vExternal
ISA Server 2006
LAN01sdngPrivateIPsktniviExternalbngcchNATtrnISA
Server.
NetworkRulechngtastogm
RuleName
SourceNetwork
Destination
Network
Relationship
LAN01<>
External
LAN01
External
NAT
ChnmcConfiguration,chntipmcNetworks
CuhnhNetworkRulessdngNetworkstrongISAServerManagementConsole.
ChntiptabNetworkRulecuhnhmiquanhgiamngLAN01v
Internet
TabNetworkRulesquynhmiquanhgiaccmng
127

ClicktrncasTaskPanecaISAServerchnCreateaNewNetworkRule
SdngNetworkTasktomtNetworkRulemi
RuleNamegLAN01<>External
MiquanhgiaLAN01vExternalslNAT.ChngtittnchoNetworkRulednhn
bit.
ClickNext
ISA Server 2006
SourceNetworkclickAddchnLAN01
ClickADDthmSourceNetwork
BrowsephnNetworksDefinitionvDoubleClickvoLAN01
SourceNetworkslLAN01.ISAServerdatrnachIPcaSourcePacketvsovikhanga
chIPcaNetworkLAN01
ClickClose
KimtraliNetworkvathmvoSourceNetworks
129
KimtraNetworkLAN01saukhiClickAddtrongNetworkComponents
ClickNext
ClickAddthmExternalvoDestinationNetwork
TiptcDestinationchngtichnExternalidinchoInternet
DoubleExternalvclickClose
ClickNext
TrongphnchnRelationshipchngtachnNAT2mngnyktnivi
nhaubngNAT.
ISA Server 2006
MiquanhgiaLAN01vExternallNAT.achIPSourcecagitincthaythbnga
chIPPubliccaISAServer.
ClickNext
ReviewliqutrnhtoRuletrongcascuicng,kimtrakphnnyc
thxcnhlitrongqutrnhto.
131
KimtralicuhnhvClickFinish
ClickFinish
ToNetworkRulegiaLAN01vInternal
HaimngLANktnivinhauquaISAServersdngcnglaiPrivateIPnn
ktnivinhaubngcchROUTE.
NetworkRulechngtastonhsau
RuleName
SourceNetwork
Destination
Network
Relationship
LAN01<>
Internal
LAN01
Internal
ROUTE
ChnmcConfiguration,chnmcNetworks
ISA Server 2006
NetworkRuleccuhnhtrongmcNetworkscaISAServerManagementConsole.
ChntiptabNetworkRule
NetworkRulesccuhnhtrongTabNetworkRules
133
ToNetworkRulemibngTabTasktrongTaskPane
RuleNamegLAN01<>Internal
RuleNamehinthmiquanhgiaccmng.RuleNamechcgitrhinth,khngcgitrvi
ISAServer.
ClickNext
SourceNetworkclickAddchnLAN01
ISA Server 2006
ClickADDthmSourceNetworkchoRule
DoubleClickvoLAN01,clickClose
SourceNetworklLAN01gmkhangIPPrivatetrongLANcaVietCERT
KimtraliNetworkLAN01trongphnSourceNetworks
135
KimtraNetworkSourcesaukhiAddtcasNetworkComponents
ClickNext
ClickAddthmInternalvDestinationNetwork
DestinationcaRulenylInternalmngLANmcnhcaVietCERT
ClickNext
nhaubngROUTE.
ISA Server 2006
Miquanhgia2mngnylROUTEkhngthayiachSourceIPcagitin.Network
Rulescuhnhctcdng2chiu
ClickNext
137
KimtraliqutrnhcuhnhvClickFinish
ClickFinish
ToNetworkRulegiaccmngLANviDMZNetwork
DMZNetworkcaVietCERTlcnysdngPublicIPnnktniviccmng
LANsdngPrivateIPphidngcchNAT.
Ghich:nhiucgihichngtirngPublicIPvPrivateIPtrncngmt
ISAServertrongmngLAN,lcnyPublicIPvncharangaiInternetmch
truycpvotrongDMZthi,liuchngticthsdngcchROUTEkt
nickhng.Cutrlicachngtilkhng,vmcnhcclaiFirewall
nichungvISAServerniringkhngchophpsdngcchROUTEgia
PrivateIPvPublicIP.
NetworkRulegiaccmngLANvDMZsctonhsau
RuleName
SourceNetwork
AllLANS<>DMZ Internal
Destination
Network
Relationship
DMZNetwork
NAT
LAN01
ISA Server 2006
ChnmcConfiguration,chnmcNetworks
NetworkRuleccuhnhtrongmcNetworkscaISAServerManagementConsole.
ChntiptabNetworkRule
NetworkRulesTabcuhnhccmiquanhgiaccmng
139
SdngNetworkRuleTasktothmRulechoNetworkcamngLANvDMZNetworkvi
PublicIP
RuleNamegAllLANS<>DMZ
NetworkRuleNamegiaccmngLANviDMZNetwork
ClickNext
SourceNetworkclickAddchnLAN01vInternal
ISA Server 2006
ClickADDthmphnSourceNetwork
DoubleClickvoLAN01,doubleclicktipvoInternal
ChnLAN01vInternallmSourceNetworkchoRule
ClickClose
KimtraliSourceNetworks,phnnylhaichiu
141
KimtraliNetworkSourcesaukhiADD
ClickNext
ClickAddthmDMZvoDestinationNetwork
DestinationNetworkslDMZNetworkidinchomngPerimetermangPublicIP.
DoubleDMZvclickClose
KimtraliDMZNetworkstrongphnDestinationNetworkscaWizard
ISA Server 2006
KimtralimngDMZNetworkthmtrongWizard
ClickNext
nhaubngNAT.
MiquanhgiamngmangPrivateIPvPublicIPslNAT.NATthaythachIPcaSource
IPtrongPacketgiraISAServer.
ClickNext
143

KmtraliphntnghpRulevClickFinihs
ClickFinish
ToNetworkRulegiaDMZNetworkmangPublicIPviExternal
DMZNetworkcthmangPrivateIPhocPublicIP.TytheokiuIPcaDMZ
NetworkchngtassdngcccchNAThocROUTEtybin.
NuDMZmangPrivateIPkhiiraInternetssdngcchNATvDMZvi
PublicIPssdngcchROUTEkhirangaiInternet.
SourceNetwork
DestinationNetwork
Relationship
DMZPrivateIP
InternetPublicIP
NAT
DMZPublicIP
InternetPublicIP
ROUTE
TrongmhnhmngchngtiangsdngDMZviPublicIPnnscuhnh
NetworkRulenhsauchoDMZNetworkvInternet
RuleName
SourceNetwork
Destination
Relationship
ISA Server 2006
Network
DMZNetwork<>
Internet
DMZNetwork
External
ROUTE
ChnmcConfigurationchnmcNetworks
NetworkstrongConfigurationsdngcuhnhNetworkRule
ChntiptabNetworkRuletrongcasDetailPane
CuhnhNetworkRulequynhmiquanhgiaDMZvExternal
145
ToNetworkRulebngTaskPane
RuleNamegDMZNetwork<>External
RuleNamechngtittrongWizardlDMZNetwork<>Externalhinthmiquanhtrong
Rule.
ClickNext
SourceNetworkclickAddchnDMZNetwork
ISA Server 2006
ClickADDthmSourceNetworkchoRule
DoubleClickvoDMZNetwork
SourceNetworkslDMZNetwork.
ClickClose
KimtraliDMZNetworktrongphnSourceNetworks
147
KimtraNetworkDMZsaukhithmvoWizard
ClickNext
ClickAddthmExternalvDestinationNetwork
DestinationNetworkcaRulelExternalidinchomngInternet.
DoubleExternalvclickClose
ISA Server 2006
KimtraliExternallDestinationNetwork
ClickNext
nhaubngROUTE.TrnRouterktniInternetphicuhnhthmRouting
EntrychoRouterny.
Miquanhgia2mngnylROUTEvcngmangachIPPublic.
ClickNext
149

KimtraliRulevclickFinish
ClickFinish
SaukhicuhnhttcccNetworkRulechonhngmiquanhquaISAServer
2006,chngtakimtratngquanlilncuitrnISAServer2006
ClickISAServerchnConfigurationNetworks
ChnTabNetworkRulesvnhntngquannhngRuleto
ISA Server 2006
SaukhicuhnhtrnISAServer,chngtiClickApplytcdngcuhnhnyvoISAServer.
ClickApplychpnhnnhngthayiny,ISAServerscpnhtnhng
thngtinvNetworkRulesaukhangthigian5giy.
PhntiptheolcuhnhAccessRuledophctpcaAccessRulenn
chngtishngdntiptrongphnthchnhsau.
16. To Access Rule cho Clients truy cp Internet

AccessRulelmtphntrongFirewallPolicy.FirewallPolicygmAccessRule
vSystemPolicy.AccessRulequynhccnguyntccaTraffickhiiquaISA
Server.CnSystemPolicyquynhccctnhbomtvchpdngring
choISAServermthi.
ISAServercungcp2tnhnngchomththng,lSecurity(tnhnng
Firewall)vAccelerator(tngtcInternetbngtnhnngProxyServer).Mi
traffickhiiquaISAServerscISAServerkimtratheocctrnhtsau
151
ISAServersdngAccessRulekimtrattccclaitrafficiquaISAServer.AccessRulel
phnchnhcncuhnhktrnISAServer.CcNetworkComponentskthplitothnhiukin
choAccessRule.
ISAServercmtuyticcTraffictngaivoISAServer.iviTraffict
trongmngLANraInternet,ISAServerskimtralnltxem
User/Computer/Protocol/Source/DestinationcaTrafficchplhaykhng
inmtAction(quytnhcuicng)lAllowhocDeny.Lnltttc
ccthngstrongPacketcaClientskhigirangaiscISAServerkim
trartk.AccessRulelkhungchuncciukinxcnhktqucui
cngcaPacket.
AccessRuletrnISAServerccutrcnhsau.AccessRulenypdngcho
ISAServer2004v2006,trnthitbAppliancelnApplicationtrnServer2003.
ISA Server 2006
AccessRulebaogmcciukin,khithamncciukinny,AccessRuleschoISAServerbit
quytnhnhthnovilungtrafficny:ALLOWhocDENY
NgaitrphnAllow/DenylAction,ccphncnlitrongAccessRulec
xemlthnhphncaRule(haygilComponents).Trong
Protocol/IPPort/Type:kiuPacketgitClientsraISAServer.Nhngthng
tinnyISAServersctrongIPTCPHeadercagitin.
SourceNetwork/IP,DestinationNetwork/IP:thngtinnyISAServerc
ctPacketcaClientsginISAServer.Datrnthngtinny,ISA
Serverxtxemchicciukinhaykhng.ylphnchnhmchngta
quantm.Source/DestinationchngtacthsdngNetworkDefinition
thaychotngachIPringl.Source/DestinationcngcxemlAccess
RuleComponent.
Schedule:ThngsnykhngcuhnhngaytronglctoAccessRulemchc
thtocsaukhicuhnhRule,thngquacasPropertieschngtac
thcuhnhScheduler.SchedulercnglAccessRuleComponent.
ContentType:PhnnychpdngvigitinHTTP.Nhngfilecchuyn
tiquagitindngHTTPsckimtradatrntnuicafile,hocda
trnngdncafiletronggiHTTP.HTTPlApplicationProtocols
dngTCPPort80.TngtnhScheduler,ContentTypekhngthcuhnh
trctiptronglctoAccessRulemphithngquacasPropertiescaRule.
User:xcnhUsernocphpsdngRuleny.UsercthlLocalUser
trnchnhmyISAServerhocUsertrnRADIUSServer,ringviISAServer
2006cthsdngmtLDAPServerthchinvicchngthcUsers.
153

CuhnhAccessRulethcralkthpccAccessRuleComponentslivi
nhaugmSource/Destination,User,Protocol,SchedulervContentTypevi
nhauccktluncuicnglAllowhocDeny.cuhnhAccess
Rule,chngtastinhnhtoccComponenttrc.
TmttccthnhphntrongAccessRule.xtAllowhocDenykhithamnngcciukin
trongRule.
ToNetworkObject
NetworkObjectlphnthngxuynsdngnhtvkhngththiuc
trongmtAccessRule.NetworkObjectcthlmtNetwork(mtmngLAN),
mtComputer(mytnhnodatrnachIP),AddressRange(khanga
chIP)hocmttphpccNetworkno(gilNetworkSet)chngtas
lnlttoccNetworkObjectchoISAServer.
ToComputer
ChngtisdngComputerNetworkObjectxcnhmtmytnhno
darnachIPcamytnhny.KhiISAServernhncgitinnsxc
nhComputernydatrnSourceIPcagitin.
VoTaskPanechnTabToolBox
ISA Server 2006
CuhnhNetworkObjectstrongphnToolBoxcamcFirewallPolicy.
ChnNetworkObject,nhngthnhphntrongnysngvaitrchnhtrong
AccessRule
McComputeridinchomtachIPtrongmng(hocngaimng)caISAServer.ISA
ServerkhngquantmnComputerNamemchbitnSourceIPcagitingiquaISA
Server.
ClickvoMenuNewchnComputer
155
ClickNewComputertomtmytnhmi,thcchtlmtachIP.
TrongcasComputerphnNamechlphnhinthObjecttrnISAServer.
ThngquaNmenychngtasqunlmytnhnytrnISAServer.Nameg
DirectorComputer
PhnIPchngtagachIPcamytnhcangTangimccngty
VietCERTl192.168.1.5
TomtComputermitrnISAServer.
ClickOK
KimtralitrongTaskPane,mtComputermicto
ISA Server 2006
KimtraliComputersaukhitotrnISAServer.ComputersnmtrongmcComputersca
NetworkComponents
ComputernyhintichatcdnglnmtPolicynoc,chngtiscuhnh
sau.
ToProtocolDefinition
TrongISAServercsnrtnhiuProtocolnhngvnchapngnhucu
canhquntr.ChngtacthtothmccProtocolDefinitiontrnISAServer
chophpqunlnccProtocolkhngnmtrongdanhschsnccaISA.Mt
trongnhngProtocolmnhiungiquantmlYahooMessengervSkype.
YahooMessengersdngTCPport5050,5100v5000chobadchvChat,
VoicevWebcam.ChngtastomtProtocolmitrnISAServer.Chkhi
tochltoComponent,chathcsavoAccessRule.
VoTaskPane,chnTabToolBox
157
CcProtocolthngdngnmtrongmcCommonProtocolscaNetwokComponents
ClickMenuNewchnProtocol
ISA Server 2006
ToProtocolmichoNetworkComponentsbngcchclickNewProtocol
PhnNamegtnhinthlYahooMessenger.
ProtocolNamechngtitochoISAServerlYahooMessenger.Protocolnamechcgitrhin
th.
ClickNext
phnPrimaryConnectionchngtaclickNew
159
ClickNewtothmConnectionchoProtocolny.
TrongcastoProtocolmichnkiuProtocollTCP
PortRangechyt5050n5050
ConnectionbaogmProtocol,PortsdngvhngcaTraffic
ClickOK
ISA Server 2006
TiptheoClickNew2lnnatotipProtocolDefinitionchoPort5100v
5000
ClickNewthmConnectionmichoprotocolYahooMessenger
TotipRangePort5100
Protocol,PortvhngcaTrafficsdngchoYahooVoiceChat
ClickNewtiptctoRange5000
161
ClickNEWtothmConnectionchoYahooWebcam
RangePort5000hngOutbound
PortsdngchoYahooWebcam,hngvnlOutbound
KimtraliProtolsaukhito
ISA Server 2006
KimtraliccConnectointochoProtocolYahooMessenger
ClickNext
phnSecondaryConnectionchngtakhngto,clickNext
SecondaryConnectionchngtikhngsdng.
KimtraliqutrnhtotrongcasReview
163
KimtraliProtocolDefinitionvclickFinish
ClickFinish
iviSkypethProtocolsdnglTCPPort80HTTPnnkhngcntov
trenISAServermcnhhiucHTTP
ClickvoTaskPanechnTabProtocolDefinitionCommonProtocolxem
HTTP
ISA Server 2006
SaukhicuhnhProtocolchngtacththayibngcasProperties
ClickphichnPropertieshocDoubleClickvoHTTP
ChntabParametervxemPort,DirectionvProtocolcaHTTP
165
HTTPProtocolmcnhcgnFilterWebProxychophpISAServerlccctrafficcaHTTPv
CachelichodClientssdngchcnngSecureNAT.
VchHTTPchngOutbound
ToUser
VoISAServerManagementchnmcFirewallPolicy
ClickchnToolBox,chntipphnUsers
ISA Server 2006
SdngToolBoxtrongFirewallPolicytothmUserDefinitionmi
ClickphichutchnNewUsers
ToNewUserDefinitiontrnISAServer
NhngUsernyscthmvoPolicy,UsercthlytrctiptWindows
User(SAMhocActiveDirectory).NamechngtichnStaffMemberscha
nhngAccountccnhnvintrongphnggimc.
167
StaffMemberschltnhinthchngtimuntotrnISAServerbaogmttcccUsertrong
phngTraining
ClickAddthmUservoComponentny
ClickADDthmUservoUserDefitnitionStaffMembers
ISAServercthsdngchngthcWindowsUser/Grouphocsdng
RADIUSServer.TrnRADIUSServerphicuhnhthmRemoteAccessPolicy
chophpnhmUserctruycp.RADIUSServertrnmtServerthamgia
DomainschophpISAServer2006chngthcbngDomainUsermkhng
cnthamgiaDomain.
ISA Server 2006
ThmUsertRADIUSServer.ISAServerhtrchngthcbngWindowsUser(SAMhoc
Domain),LDAPServerhocRSASecurID
ClickNext
ISAServer2006hinthmtcasnhcuhnh,chngtichnAllusersinthis
namespace
ChnttcccUsertrnRADIUSServer.
ClickOK
169
RADIUSServercthmvoWizardvcISAServerhiuvitnStaffMembers
ClickNext
KimtralitrongcasReview
KimtraliUserSetvClickOK.
ClickFinish
TrongphnUserComponentsxuthinthmmtnhmUsersmangtnAllStaff
Members
ISA Server 2006
SaukhitoUserSetvkimtralitrongmcUserstrnToolBox
ToScheduler
SchedulersdngquynhkhinoRulenyctcdng.Schedulerc2
trngthiActivevInactive.
Tronggilmvic,nhnvincaVietCERTkhngcphptruycpInternet
tronggilmvic.Voginghtra,mingicthtruycpInternet.Chng
titothmmtSchedulerlngaigilmvicchoActiveRule,tronggilm
vickhngchoActiveRule.
VoTaskPane,ToolBoxvclickchnScheduler
171
SchedulertrnISAServerchobitkhinoRulectcdng
ClickphichnNewScheduler(hocClickMenuNewchnScheduler)
ISA Server 2006
TothmSchedulerchoISAServerbngcchClickphichnNewScheduler
NamechlphnhinthtrnISAServer,chngtitlOutofwork
PhnActivechngtithitlpnhtronghnh,t11hn13hRulesActive.
ToSchedulertrnISAServerchcnquynhginoISAServercActive/Inactive.Scheduler
ClickOK
KimtraliSchedulervato
173
SchedulerOutofworkvatotrnISAServercqunlbngmcSchedulertrongToolBoxx
SchedulernysckthpvimtAccessRulechophptruycpInternet
nhngchvogi11h13hkhiRulecActive.
ToContentType
ContentTypequynhkiudliuchuynquaHTTPTraffic.Contenttypexc
nhdatrnFileTypeExtension(tntptinmrng).
NgainhmR&D,VietCERTkhngchonhnvintruycpInternetv
Downloadbtktptinnockhnngchy.ChngtistomtContent
Categorybaogmttccctptinmrngckhnngchynh.EXE,.COM,
.MSI,.CAB(chatptinchy),.MSC
VoTaskPanechnTabToolBox
ChnmcContentType
ISA Server 2006
ContentTypetrongmcToolBoxquynhkiudliucchuyntiquaISAServer.Content
TypechtcdngviHTTPTraffic.
Contenttypetchccctptintheohngmc(gilCategory)
ContentTypecquynhsntrnISAServer.
ClickphichnNewContentTypeSettothmhngmcmi
175
TomiContentTypebngContextMenucaToolBox
GtnCategorylExecutableFiles
PhnDetailsquynhnhngtntptinmrng,gtntptinvclickAdd
Thmvocctntptinmrngckhnngchycnhtrn
ISA Server 2006
TothmContentTypeCategorytrnISAServer.ContentTypenychtcdngtrnHTTPTraffic
ClickOK
Ghich:ttcnhngContentTypevatochpdngchoHTTPTraffic.
KimtraliComponentContentTypevato
177
ContentTypeCategoryvatochinthtrongmcToolBoxtrnISAServer.
NhngContentTypenyscavoccPolicychngtacuhnhsau.
TnghpliccComponentvatocuhnhmtAccessRule
TiptheoccghpccComponentsnylivinhauthnhmtRuletrongmc
FirewallPolicy.NhngComponentsnyliukinchoISAServerquytnh
lAllowhocDenyRule.
tinchovictoRule,chngtiaramttnhhungcthnhsau:
Yucu1:KhangachIPt192.168.1.30n192.168.1.80lmycaccnhn
vin,vtronggilmvichchcsdngInternetCheckMailvkhng
csdngWebhocnghenhcOnline.
Cuhnh:cuhnhkhangachIP,chngtisdngAddressRange
trongToolBoxcaISAServer,quynhRangeIPl192.168.1.30n
192.168.1.80.
XtvProtocolthnhngClientsnychcthtruycpMailTrafficgmPOP3,
IMAP4vSMTP.ClientscthtruycptrctipbngachIPcaMailServer
hocsdngtnmin.Trongtrnghpdngtnmin,ClientsphicDNS
phngiitnminnntrongphnProtocolchngtischophpClientsibng
DNS.
ISA Server 2006
SourceNetwork:CcClientstrongmngLANnhngkhngphittc,chgm
khangIP192.168.1.30n192.168.1.80nnSourceslAddressRange.
DestinationNetwork:MailServerhthngVietCERTsdnglMailOnline
ngaytrongvngDMZ.ClientstrongLANstruycpMailServerttiDMZ
caSiGnHQ.DestnationschnchnhxcachIPcaMailServertrong
vngDMZ.ClientschcthCheckMailtMailServertrongDMZca
VietCERtmthi.
Users:RulenypdngchottcccUsercaDomain,chngtimcnh
lAllUsers.
Scheduler:ChophpClientstruycpvoMailServertibtkthiimno,
tronggilmviccngnhginghnnchngtisdngSchedulermcnh
lAlways
ContentType:PhnnychpdngchoHTTPTrafficnnkhngcncuhnh
mcny.
TnRule
Protocol
Mailin
DNS
workhours
SMTP
POP3
Source
Network
Destination Users
Network
Address
203.162.23.34 AllUsers
Range
192.168.1.30
192.168.1.80
IMAP4
Ghich
Chcho
php
Clients
trong
khangIP
trntruy
cpvo
MailServer
trongvng
DMZ
CuhnhAccessRuletrnISAServer
ClickFirewallPolicy
179
CuhnhAccessRulebngFirewallPolicy
TrongcasTaskPanechnCreateAccessRule
ToAccessRulebngTaskPane
NamegMailinworkhours.ChphnNamenysgipAdmincthqun
ltthnccpolicydomnhtora.
ISA Server 2006
ChngtitAccessRuleNamelMailinWorkhourschchophpUserssdngMailtronggi
lmvic.
RuleActionchophpiqua,chnAllow
ChophpUsersdngMailchngtichnActionlAllow
ClickNext
TrafficclickchnSelectedProtocol
181
ClickchnSelectedProtocolsvClickADDthmProtocolvoRule.
ClickAdd
phnCommonProtocolchnvDoubleClickvoccProtocolDNS,SMTP,
POP3,IMAP4
ISA Server 2006
LnltchnccProtocoltrongNetworkComponentscaISAServerthmvoRule
ClickClose
ChcnhngProtocolsauycphpiquaISAServer
183
QuayliviWizardvkimtraProtocoltrongWizard
ClickNext
PhnSourceNetworkclickAdd
ClickADDthmSourceNetworkvoRule
KhangIP192.168.1.30n192.168.1.80chngtachato.totrctiptrong
lctoAccessRule,clickMenuNew
ISA Server 2006
ThmkhangIPvoNetworkComponent.AddressRangegmmtkhangachIPdonhquntr
quynh
ChnAddressRange
TrongcasAddressRangegkhangIPnhtrongbngvphnNameg
ClientsNetwork
CuhnhAddressRangetrnISAServer,chngtittnlClientsNetwork
ClickOK
DoubleClickvoClientsNetworkvato
185
SaukhiADD,ClientsNetworkchinthtrongNetworkEntitiescaISAServer.
ClickClosequayliWizard
AccessRuleSourcechngtithmkhangClientsNetwork
ClickNext
ClickAdd
ISA Server 2006
ClickADDthmDestinationchoRule
AccessRuleDestinationchngtichnExternalvDMZvMailServernm
InternetvctrongvngDMZ.
ChnExternalNetworkvDMZNetworkthmvoDestinationchoRule
KimtraliRuleDestinationgmnhngmngDMZNetworkvExternal.
ClickNext
187

PhnUsersmcnhAllUsers
UserSetchngtichottcmingiucphpsdngRuleny.ChnAllUsers
ClickNext
ReviewliqutrnhvatocthsanhngsaistbngcchClickBack
KimtraliAccessRulegmcclaiProtocolnovClickFinish
ClickFinishktthcqutrnhtoRule.
TrongcasFirewallPolicygiyxuthinthmmtRulemimangtn
MailinworkhoursvchphnOrder,Rulenyangmangs1.
ISA Server 2006
VoFirewallPolicykimtraliRulevato
CuhnhChatvWebRule
Yucu:NhnvinngaigilmviccthsInternetdngWebvChat
bngYahooMessenger.TuynhintrnYahooMessengernhnvinkhngc
sdngchcnngSendfilevibtkdngno.
Cuhnh:
Protocol:YucutrnchchosdngWebdngHTTP,YahooMessenger
nhngkhngchochcnngSendFilecngnhkhngcxemphimonline
dngStreamingMedianhWMVhocWMA.Phnnythcrakhngkh,
nguyntchatngcaFirewalllchchophpnhnggcnthit,cnlil
khattc.
Source:cnglClientsNetwork,pdngviccmycontrongkhangach
IPt192.168.1.30n192.168.1.80.
Destination:WebServerClientsstruycplcnynmtrnmngInternetnn
khngthxcnhcthachIPnoscgn,chngtisdngNetwork
ExternalidinchoInternet.
Users:AllUsers
Scheduler:ChbtRulenyngaigilmvict11h13hnnSchedulerOutof
workscsdng.Schedulernychngtatotrongphntrccabi
thchnhny.
ContentType:ChophpdngInternetnhngkhngchoDownloadhocSend
FilennphithchincmtrnContentType.PhnnychpdngviHTTP.
189

ChngtichchophpdngWebcphpsdng.ViYahooMessengerlc
nyphignthmmtApplicationFilterWebProxyFilterchoProtocolYahoo
MessengercthtcdngContentTypevoProtocolny.
TnRule
Protocol
Source
Network
Webwhile
Free
DNS
Address
External
Range
192.168.1.30
192.168.1.80
HTTP
Yahoo
Messenger
Destination Users
Network
HTTPS
AllUsers
Ghich
Chophp
truycp
Internet
tronggi
nghnhng
khngcho
sdng
chcnng
Download.
CuhnhtrnISAServer
ChnFirewallPolicy
DngchcnngFirewallPolicytothmAccessRulechoISAServer
TrongcasTaskPanechnCreateNewAccessRule
ISA Server 2006
ToAccessRulebngNetworkTaskstrongmcFirewalPolicy
RuleNamegWebwhileFree
RuleNamechngtitlWebhilefreechophpnhnvinsdngInternettronggiri
RuleActionchnAllowchophpquaISAServer
191
ActionchnAllowchophpnhnvinctruycpInternet.
ProtocolclickchnSeletedProtocolvClickAdd
ChnSeletectedProtocolvclickADDthmProtocolvoRule.
TrongphnComponentDoubleClickvoccProtocolHTTP,DNS,HTTPSv
YahooMessenger.
ISA Server 2006
YahooMessengerProtocolchngtitotrongphnProtocolDefinition
ClickClosequayliWizard,kimtraccProtocolvathmvoPolicy
193

CcProtocolchngtithmvoRule.NguyntccanhquntrkhicuhnhFirewalllch
chophphnch,khinothiuProtocolchngtacththmsau
ClickNext
PhnSourceclickAdd
SourceNetworkchoRule,ClickADDthmvoRule
TrongmcAddressRangechnClientsNetworkchngtatochakhang
achIP192.168.1.30n192.168.1.80.
ClickADDvoClientsNetworkthmvoRule
ISA Server 2006
KimtraliNetworkClientsNetworksaukhiquayliWizard
ClickNext
PhnDestinationchngtachophpccClientsnyraInternetnnsaddvo
ExternalNetwork.ClickAddchnmcNetworks
ClickADDthmDestinationvoRule
DoubleclickvoExternalvDMZNetworks
195
ChnmngExternalidinchoInternetvoSource
KimtraliNetworktrongphnDestinationtrongRule.
ClickNext
PhnUserschophptanbUserscthtruycpcInternetnnchngti
chnAllUsers.
ISA Server 2006
UsersettcdngchoRulenylAllUserschophpttcccUsertrongLAN
ClickNext
KimtraliRulesaukhicuhnhvclickFinish
Reviewqutrnhcuhnh
ClickFinish
SaukhicuhnhtoRule,chngtitiptccuhnhSchedulervContent
Type.SchedulervContentTypechcthcuhnhbangcasPropertiesca
Rulesaukhitoxong.
197

VoFirewallPolicyclickchnRulecncuhnh.RulecachngtatnWeb
whilefree
ClickphichnProperties
SdngFirewallPolicyvPropertiesRuletothayinhngphncuhnh
ChnTabSchedulervclickchnSchedulerOutofworkchngtatotrong
phntrccabithchnhny
ISA Server 2006
TcdngSchedulerchoAccessRulesaukhitoxongbngcasProperties
ClickchntipTabContentTypevkhngchnAllContentmchnthe
FollowingContent
ClickchnnhngContentnokhngchophpnhApplications,Documents,
199
ChnContentTypechoRulesaukhitobngcasPropertiescaRule
ClickOKngcasPropertiescaRuleli
KimtraliPolicytrongcasDetailsPane
iukinvacuhnhthmchoAccessRulelAllUsersvOutofwork
ISA Server 2006
AccessRulechoDMZmangPublicIP
Yucu:CcServertrongvngDMZcphptruycprangaiInternetv
UsertInternetcngcthtruycpvoccServertrongvngmngDMZca
VietCERT.Tuynhincclaitrafficcngphihnch.NhnglaiTrafficsau
yscsdngDMZvInternetlMail,Web,Videoonlinechoccan
phimHosttiVietCERTphcvchotrangwebvietnamlab.com
Cuhnh
Protocol:SdngWebchngtascuhnhHTTP,HTTPSvInternetUser
ctruycpFTPServernnProtocolFTPcngsccuhnh.Streaming
MediacISAServerhtrsntrongphnProtocolDefinition.Ngaira
phnMailnmtrongphnCommonProtocolcngcISAServerhtr
sn.
Source:pdngchoccServertrongvngDMZ.MngDMZcchngta
tosntrnISAServerphnthchnhtrcmangtnDMZNetworkv
ngclitrongSourcecngcExternalchophpInternettruycpvoccServer
trongvngDMZ.
Destination:DMZctruycpInternetvngclinnphnDestinations
baogmDMZNetworkvExternal.
Users:AllUsers
Scheduler:DMZServerlunsnsngphcv24/7nnSchedulerchngtichn
Always
ContentType:ChophpttccclaitptincchuynbngHTTPquaRule
nynnchngtichnApplytoAllContentType.
NidungcaRulechngtastonhsau
TnRule
Protocol
Source
Network
Destination Users
Network
Ghich
DMZand
Internet
DNS
DMZ
Network
DMZ
Network
External
External
DMZv
Internet
cphp
truycpln
nhautrong
mithi
im.
HTTP
Streaming
Media
AllUsers
HTTPS
201
CuhnhtrnISAServer
ChnFirewallPolicy
SdngFirewallPolicycuhnhAccessRule
TrongphnTaskPanechnTabTask,clickNewAccessRule
TothmAccessRulebngTaskPanetrongISAServerManagementConsole.
RuleNamegDMZandInternet
ISA Server 2006
RulenamechngtitoDMZandInternetquynhtrafficgiaDMZvInternet
AccessRuleActionchnAllowchophpServerstrongvngDMZtruycp
Internet
ChnAllowchophptrafficiquanukhpvicciukintrongRuleny
203
ClickADDkhichnSelectedProtocolthmvoccProtocolchophpiquaRuleny.
TrongphnComponentDoubleClickvoccProtocolHTTP,DNS,HTTPSv
StreamingMedia.
ISA Server 2006
ThmProtocoltrongmcStreaming
ClickClosequayliviWizard
205

ClickNext
PhnSourceclickAdd
ClickAddthmSourceNetworkchoRule
TrongmcAddressRangechnDMZNetworkvExternal,Rulenyscho
phptruycp2chiu
ChnSourceNetworklDMZNetworktrongcasNetworkEntities
ISA Server 2006
KimtraNetworkSourcesaukhiAdd
ClickNext
PhnDestinationchngtachophpDMZNetworkvExternalctruycpln
nhau
ClickAddthmNetworkvoDestinationcaRule
DoubleclickvoExternalvDMZNetwork
207
ThmNetworkDMZvoRule
NetworkDMZvExternalscxttrongRuleny
ClickNext
chnAllUsers.
ISA Server 2006
TtcccUserucsdngRuleny
ClickNext
Reviewqutrnhcuhnh
KimtralncuikhiClickFinish
ClickFinish
NhngRulecuhnhuctht,nhngthtnyscxtkhic
trafficiquaISAServer.NhngPolicysaukhicuhnhcththayibngca
sProperties.CcRulecchatrongphnFirewallPolicy.
209
ChnhngbiutngcnghatrnISAServerManagementConsolebitRuleang
trngthihatnghaykhng
SaukhixemvkimtrachnhxccanhngPolicyvato,clickApply
chpnhnsthayitrongISAServer.
ClickAPPLYluccthngscuhnhtrnISAServervchochngctcdng
Ghich:PhncuhnhAccessRulenhvyxemnhtmn.DMZNetworkmangachIPPublic
nnsiviInternetbngROUTING.KhiRouting,ISAServerkhngsdngchcnngNATnn
ISA Server 2006
khngcnphisdngchcnngPublishingRule.PublishingRulesdngProtocolvihngi
Inbound.
NgainhngPolicytora,khicnhucucuhnhtrnISAServerchngti
stinhnhtotipPolicydatrnnhngthnhphncbntrongISAServer
tiptcto.cgichcnnmvngvhiucccthnhphncaISA
Serverlcthcuhnhtttrongmitnhhung.
17. Backup Access Rule

CcAccessRulesaukhicuhnhxongnnclulibngvnbnnhchng
tiphntchtrn.RingISAServerhtrchcnngBackupRule(thccht
lqutrnhExport).KhicuhnhFirewall,viccnthitlcuhnhngRule,
tiptheolBackupccRulegilicthphchihocImportvomt
Firewallkhc.
ClickvoFirwallPolicy
TrongcasTaskPanechnExportFirewallPolicy
211

XutFirewallPolicygmccAccessRulethnhFile
ClickNextvchnExportConfidentialInformationvgPasswordbov
tptinXMLny.
PhnAccessRulequantrngnhttrngnhttrnISAServernnbnphitPasswordbo
mthngtinkhngbl
ClickBrowsevchntptinlutrAccessRule
ISA Server 2006
ChnnilutrtptinXML
ClickOpenluli
XcnhngdnlutptinXML
Reviewlinhnggcuhnh
213
NidungtptinXMLscmha
ClickFinish
ISAServersthngbochoUserkhixutxongtptinXML
QutrnhxuttptinXMLthnhcng
MtptinXMLxutbngNotepadxemcuhnhcluthno
ISA Server 2006
SdngNotepadxemnidungcctptinXML
NotepadhinthcctptindngPlainText
MnidungtptinXML,tptinnycmha
CctptinBackupnyscsdngImportlivoISAServerkhigps
chcImportvomtISAServerkhcgingcuhnhchun.
XMLlg?
XMLvitttcacheXtensibleMarkupLanguage(ngnngnngcpcth
mrng)lmtbquilutvcchchiamttiliuralmnhiuphn,rinh
duvrpccphnkhcnhaulidnhndinchng.cchobiT
hpWebtoncu(W3C),XMLtrthnhmtcimkthutchnhthc.
ThpWebtoncuW3CgiXMLlmtcphpthngdngchovicbiuth
cutrctrongdliu.Dliuccutrcthamchiundliucgn
nhnchonidung,ngha,hoccngdng.
Vd:TrongmttrangWebtadngnhngTagPairs(cpnhnhiumng)
nhdunh<BODY>v</BODY>.HyquanstmttrangWebdiy:
<HTML>
<HEAD>
215

<TITLE>WelcomeToLHng</Title>
</HEAD>
<body>
<H1>nhNgha</H1>
A:Saoanhlictdyinphnghp?<BR>
B:Vdyinnhtithiumtmtkhc.<BR>
A:Nhvyllycnglmt!<BR>
B:Khng,nhvyllydinuingn!<BR>
</BODY>
</Html>
TrongHTMLWebpageccTagPairucnhnghatrcvkhngcha
ngnghagvdkinmchngkpbntrong,trtrnghpchoTITLE.
ThdH1cnghadisplayhngchbntrong(nhNgha)theoclnnht,
nhnghngchycthlbtcthg,khngnhtthitphilt(nh
Ngha)y.CnXMLthchophptatdottnccTagPairdngkhi
cn.Nutnhra,DynamicHTMLcnkhong400Tagsmnumundngta
phinhht.Trongkhi,XMLkhngcgiihnvconsTagsvtakhng
cnphinhTagnoc.nghacaccTagrtlinhngvtacthspxp
cctagscaXMLtheoloichohpl.ThdmunlmmttrangXMLvmn
VnhctacnnhngTagdintnhnvt,ngysanh,ngyt,...
ThamkhothmXMLtitrangwebEchip
http://www.echip.com.vn/echiproot/weblh/ctv/2001/lehung/xml/xml.html
18. Import cc Access Rule

QuamtISAServermihoccuhnhliISAServercsaukhigpscphi
citliFirewallchngtacthsdngchcnngImportSettingstcctp
tinXMLcuhnhsn.CctptinXMLnythcraltptinluccthngs
AccessRuleschngtaxutrabngWizardExport.
ISA Server 2006
ChntipmcFirewallPolicy.ISAServerhtrImportcuhnhcatngphn,
nucgimunImportcaphnno,vongphnthchinImport.
TrongbithchnhnychngtaImportAccessRulevomtISAServermi
chaccuhnh.
ImportFirewallPolicyttptinXML
ClickImportFirewallPolicytrongcasTaskPane
ChnngdnlutptinXML.CthsdngchcnngBrowsetmtp
tinXML.
217
ChnngngdnXMLlucuhnh
ClickNext
KhngclickchnOptionImportServerSpecificInformation
ISA Server 2006
ImportnhngthngtincharingchoServerny
ClickNext
NhpPasswordcatptinXMLcthitlptronglcxutcuhnhtISA
Server.Passwordcachngtatrongbithchnhnyl12345678
NhpngPasswordkhilutptinXML.TptinXMLlutrPasswordtrongchnhtptin
didngHASHMD5
ClickNext
ClickReviewliqutrnhlm
219
QutrnhImportthnhcng
ClickFinish
KimtraccPolicycImport
KimtratanbnidungcAccessRulesaukhiImport,trvtrngthinhbanulcBackup
tptinXML
ISA Server 2006
Ghich:khiImportphithchintuntccComponentstrc,sauminphnNetwork,
NetworkRules,AccessRulevSystemPolicies.
19. Phn tch c ch NAT ca Network Rule

NATvROUTElmttrong2cchcaISAServerkhiccmnggiaotipvi
nhau.NATsdngtrongtrnghp2mngcaISAServersdng2laiIP
khcnhaulPrivateIPvPublicIP.
PrivateIPcsdngtrongmngLAN
PublicIPcsdngrngritrnmngInternet.MiHosttrnInternet
mangmtPublicIPvlduynht.
CchNATthayiachSourceIPcagitin
CchNATschuynachIPPrivatetrongLANthnhachIPPublicca
ISAServerkhigitinnyiquaISAServervirabngInterfaceExternalca
ISAServer.
TronghthngmngnucPrivateIPvmunsdngInternetbngmta
chIPtrnISAServer(PublicIP)nnphisdngcchNAT.achSourceIP
cagitinscthaythbngachIPPublictrnExternalInterfacecaISA
Server.
221
HthngLANmangPrivateIPphisdngcchNATkhiraInternet
KhiClientsgigitinPINGnWebServer,achIPthucsl
203.162.24.33lachIPcaExternalInterfacetrnISAServer.
VgiavngDMZ&InternalsktnibngNATquaISAServer
ISA Server 2006
DMZNetworkmangPublicIPnnmngLANcngphisdngcchNAT
SdngEtherealbtgitin,chngtacSourceIPlachIPcaInterface
ngaitrnISAServer.
Hnh
MunsdngcchNATtrnISA,chngtasdngchcnngNetworkRule
trnISAServer.
PropertiesNetworkRuleInternetAccesstrnISAServer,kimtraphnNetwork
RelationshiptathyangchNAT
HinthRulemcnhtrnISAServerchophpClientstruycpInternetbngcchNAT
20. Phn tch c ch Routing ca Network Rule

ISAServerquacchNetworkRulesquytnhgitincForwardbng
NAThayROUTE.NuchnROUTE,SourceIPcginguynkhiiquaISA
Server.ChngtasdngROUTEtrongtrnghpccNetworksdngcng
laiachIPPrivate/PrivatehocPublic/Public
ISAServercvngDMZNetworkmangPublicIP,khangIPnysktnivi
InternetquacchROUTING
223
DMZNetworkmangPulbicIPsdngROUTEgiaotipviInternet.
ThngtinvROUTEcthctmttnhsau
ROUTEchchuyngitinnhngkhngthayinidungcaphnSourceIP
GitintDMZNetworkginWebServerngaiInternetsmangSourceIPl
203.162.23.34cachnhServertrongvngmngDMZgira.ROUTEkhngthay
iachSourceIPcaginntWebServersnhnthygitinntServer
trongvngmngDMZ.
ISA Server 2006
CHNGIV
Cu hnh cc tnh nng Firewall trn ISA
Server 2006
ISA Server 2006 bao gm 2 phn Internet v Security. ISA Server 2006 c th hat ng n
thun nh mt Proxy Server cho chc nng Caching Web, hoc cao cp hn v l tnh nng
chnh ca ISA Server 2006 l Firewall tng Application (Application Firewall)
225

21. Phn tch cu trc ca mt gi tin
MhnhOSIgm2phn,mtcaTCP/IPgm4lpchnh
MhnhTCP/IP
VmtlchuncaISOgm7lp
ISA Server 2006
MhnhOSILayervsosnhvimhnhTCP/IPchngcstngng
Dliucnggi(Encapsulation)tmygi(Sender)vMgi(De
Encapsulation)mynhn(Rereiver).TrongqutrnhEncapsulation,dliu
cgiquacclpkhcnhaucaOSILayer,miLayerccutrcdliu
khcnhaunnchngtacccutrcdliuiquacclpny
TcckiudliuvProtocolhatngtngny,chngtacthxydng
ccutrcgitinchunnhsau
Cutrcchuncamtgitin
TrongTCPHeaderccutrcchititnhsau
227
TCPheadertheotiliuRFC
VIPHeaderccutrcchititnhsau
CutrcIPHeadertheotiliuRFC
HocICMPHeader
ISA Server 2006
CutrcmtICMPHeadertheoRFC
ARPHeader
ARPHeader
Phncnlildliucagitin
229
Ethereal(cbitvitnWiredShark)dchnidungcaccgitinthnhngnngcthc
hiuddng.
ChngtacthsdngcngcEtherealbtliccgitinvxemcutrc
can.TrnEtherealc3phncaschnh:Tngquanslnggi,chititgi
dngReadablevchititgidngHEXvBIN.
TngquangiaodinEthereal
ISA Server 2006
SdngEtherealcthchochngtaxemcutrcgitin,vphnchngta
thngsdngchnhlcasgiacaEthereal(cutrcchititdng
Readable)
XemnidungcamtTCPHeadercdchbngEthereal
SaukhicaptureccgitinbngEthereal,chngtacthlulitptinnydi
dngFile.CAPvsaumraphntchsau.Tptin.CAPcthtngthch
vichngtrnhNetworkMonitorcaWindowsServer2003.
SoviNetworkMontor,Etherealmnhhnnhiuvphnhinthvccchc
nnghtrkhiphntchgi.Etherealphnlaigitintheomugipnhqun
trddngnhndnglaigitin.
CngcNetworkMonittortrnWindows2003cngcthsdngquanstthngtintrnmng
231

LAN
VchcnngFilterphngiccSessionringbit,tinchovicphntch.
EtherealctnhnngMonitortheoSessionvchhtrnuktnibngTCP.UDPkhngc
Session
TiptheoEtherealshinthnidungcaccgitintrongSessionnydng
PlainText
NidungcaSessionschinthbngPlainTexttrnEthereal
lmvicctiviEthereal,chngtikhuynbnnntmccun
SyngressEtherealPacketSniffing
ISA Server 2006
cgicththamkhothmEtherealvitiliuEtherealPacketSniffingcanhxutbn
Syngress
CutrcgitinTCP/IPscgiquaISAServervISAServerphntchda
trnIPHeader,TCPHeadervcphnApplicationDatavISAServerlmt
ApplicationFirewall.
22. Phn lai cc Firewall

DatrnlaidliumFirewallphntchcchngtaxpcclaiFirewall
vocctngkhcnhaucaOSILayer.CnhnglaiFirewallcbnvlthuyt
l:PacketFiltervApplicationFirewall(ngairacnnhnglaiFirewallkhc
chngtikhngnhcny)
PacketFilter:phntchPacketdatrnTCPHeadervIPHeader,ngairalai
FirewallnykhngphntchcdliutngApplication.PacketFilterhat
ngtng3vhuhtccRouteructnhnngny(haycngilAccess
List)
ApplicationFirewall:HatngtngApplicationtrongmhnhOSI.
ApplicationFirewallcthphntchcUserDatatrongphnDatacaPacket
giquaFirewall.ThngthlaiVirus,Trojan,WormvKeyLoggersdng
phnApplicationDatachuyndliu.ISAServerlmtvdca
ApplicationFirewall.ISAServerlcttnhtccgiHTTP(HTTPlmt
ApplicationProtocolsdngTCPPort80).
233

23. Cu hnh Perimeter Network
PerimeterNetwork(DMZNetwork)cthtmdchlvngphiqunsvtrong
vngnychaccServerchophpInternetUsertruycp,nhngccServerny
vnnmtrongsqunlcaLANAdmin.Perimeterthcralmtphnca
mngLAN,nhngvkhngantanlmkhichonhngServernynmchung
trongphnmngLANcncbomttuytinnccnhquntrtchra
thnhmtkhuvcmngringgilDMZ.
DMZNetworkcktninISAServerbngmtInterfaceringbit.Trn
ISAServerphitomtNetworkmivtrongNetworknychakhangach
IPcanhngServernmtrongvngDMZ.
XtvachIPcaDMZServer,nhngServernycthsdngachIP
PublichocIPPrivateuc.KhisdngachIPPublic,Serversc
truycptrctiptInternetthngquacchRoutecaISAServer.Vnus
dngPrivateIP,InternetUserstruycpServernythngquaPublicIPcaISA
ServervcNATvoServertheomtPortno(cchNAT).
RoutingtrnISAServercthchinnhmttrafficbnhthngittrong
LANrangaiInternetnhngchkhcliSource/DestinationtLANthnh
Internetvngcli.HngcatrafficivnlOutbound.
NusdngPrivateIPtrongDMZ,ISAServerssdngtnhnngPublishing
RulechophpInternetUsertruycpvoDMZquacchNAT.Traffics
dngviPublishingRulechnglInbound.
PhncnlicuhnhchitittrnISAServerchngtastmhiutrongccbi
thchnhchitithn.
24. S dng Network Templates

ISAServerginlcccbccuhnhchonhquntrnmctithiu.Thng
thngnhnglibomttrnhthng,Firewallnhnchungldolitrongqu
trnhcuhnhcanhquntr(MissConfiguration)chophpHackerxmnhp
triphpvohthng.BnthnISAServervccFirewallkhcnuc
Updateythvictncngcthnilkhcththchinctrkhili
lmihantan.
TrnISAServerccungcpsnccTemplatecthtthitlphthngv
cuhnhISAServertheonhngmhnhmngchun.KhichyccWizardny,
ISAServerstngcuhnhvnhquntrsphicungcpthngtinvo
Wizard,phncnliISAServerscuhnhtng.
VomcConfigurationNetworks
ISA Server 2006
TrongphnTaskPanechnTabTemplates
ChnmcTemplatestrnISAServerManagementConsole.
XemquaccTemplatestrongISAServer2006gmccmhnh
ISAServercungcpccTemplatevicuhnhchunchongidng
ChngtascuhnhISAServer2006bngTemplateEdgeFirewal
235
MhnhFirewalEdgehaycngilBastionHost
ClickEdgeFirewalltrongphnTaskPanescmtcasWizardxuthin
Tiptheoccthngtintrongcasny
ISAServerscnhbongidngnuccthngstrnISAServercuhnh
trc,vqutrnhcuhnhbngTemplatessghittcnhngthngtintrn
ISAServerhinti.Trongqutrnhlm,ISAServerchophpngidngs
dngchcnngExportlulitanbcuhnhtrnISAServercamnhri
mitiptc.
ISA Server 2006
TrckhicuhnhbngTemplate,ngidngcthxutcuhnhhintithnhtptinXML
ClickNext
CuhnhkhangachIPPrivatesdngtrnISAServer.ClickAdd/modify
thmhocikhangachIP.
237
CuhnhNetworkRangebngTemplate
ClickNext,chnAccessRulespdngchoClients.ISAServercchthchcho
ngidngcasDescriptionbndi.Saukhicuhnhchngtiphikim
tralinhnggISAlmcngvinhucuhaykhng,vsauthayicho
phhpvitngtnhhungcth.
ISA Server 2006
nviccuhnhAccessRulecngbngTemplate
ClickNext,xemliqutrnhcuhnhvClickFinish
239

KtthcWizardcuhnhNetworksdngTemplate
ClickFinish
QuayliISAServerkimtraphnFirewallPolicychngtithyISAServercu
hnhhpl.NhngTemplatestrnISAServercthxemlcuhnhchunnu
bnmunthamkho.
NhngAccessRulecuhnhbngNetworkTemplateccuhnhrtbibnnhngkhcbn
TiptheochngtikimtraNetworkInternalcuhnhnghaycha
PhnNetworkthayingnhnhnggkhaibotrongWizard
NetworkDefinitioncngccuhnhtNetworkTemplate
25. Cu hnh System Policies

SystemPolicychaccthngtinlinquannbomttrnISAServer2006v
chpdngchochnhISAServer.SystemPolicylmtphncaFirewallPolicy.
ISA Server 2006
FirewallPolicygmhaiphn:AccessRulevSystemPolicy.SystemPolicykhng
tcdngnccClientsinhocquaISAServermchtcdnglnchnh
ISAServer.SystemPolicycngkhngthngxuynsdnglmvchnhISA
Servercthitktheokiulunantan.Trnhnhnglibomtdovic
cuhnhsaicanhquntr.
CuhnhSystemPolicybngFirewallPolicy
VoISAServerManagementConsolevchnmcFirewallPolicy
CuhnhSystemPolicytrongmcFirewallPolicy
ClickvoTaskPanechnEditSystemPolicy
241
ChnEditSystemPolicybngmcTaskPane
GiaodincaSystemPolicynhsau
ISA Server 2006
TngquanvSystemPolicytrnISAServer2006
NhnIPtExternalDHCPServer(Router)
ISAServercExternalInterfacesnhnIPtDHCPServertrnADSLRouter.
achIPthttADSLRouterschuynvISAServer.McnhSystemPolicy
chchophpISAServernhnIPtmtDHCPServernmtrongvngmng
Internal.
ISAServernhnIPngtRouterchngtisdngphngphpnynhnIPthttRouter
trongtrnghpkhchhngmunsdngISAServerlmVPNServer,WebServerPublishing
trnngADSL.
MunISAServernhnIPtmtDHCPServerbnngaimngLANthphicu
hnhSystemPolicytrnISAServer.yc2cchcuhnhlchngtasthm
mngExternalvoSystemPolicyhoccuhnhComputerlachIPcaADSL
Router.ChngtiscuhnhComputercuhnhcthIPcaRouterADSLv
nhvybomthn.
ClickAdd
243
CuhnhiukinchoSystemPolicy
TrongcasComponentchngtichntipComputervclickphichnNew
Computer
ISA Server 2006
ToNetworkObjectlmiukinchoSystemPolicy
NametnADSLRoutervachIPl10.0.0.2lachIPcaRouterADSL
ToComputerlmiukinchoSystemPolicy
ClickOK
245

KimtraliComponentvatotrongcasComponentphnComputer
DoubleclickvoADSLRouterComputerAddComponentnyvoSystem
Policy
ComputersaukhitonmtrongphnNetworkObjectvcthsdngchoSystemPolicyhoc
AccessRule
ClickOKngcasAddnyli
KimtralinidungchngtathySystemPolicychophpISAServernhn
IPtRouterADSLmangachIP10.0.0.2
trnhsaistkhinhnIP,chngtilaibNetworkInternalrakhiSystem
PolicybngcchLickRemove
ISA Server 2006
LaibNetworkInternalsaukhithmComputermangachIPcaRouterADSL.Chngtich
munISAServernhnIPthttRouterADSLmkhngnhntDHCPtrongmngLAN
HinthSystemPolicy
TrnISAServermcnhchhinthAccessRuletrongphnFirewallPolicy,
nunhquntrmunlunlunhinthSystemPolicythcthsdng
Optionsau
247
HinthSystemPolicytrnISAServerManagementConsole.
VoTaskPaneclickchnphnSystemPolicyvClickvoShowSystemPolicy.
LcnytrongContentPanexuthinthmhnglatccSystemPolicy
ISA Server 2006
SystemPolicyhinthhantantrnISAServerDetailsPane
MunthayiSystemPolicynothchngtachcnDoubleClickvoOption
vthayinidungbntrongcaPolicy.
ThayiSystemPolicytrctipbnggiaodinDetailPane
SystemPolicychyulcuhnhEnablehocDisable
BthocttSystemPolicy
HoccuhnhvikiutngtnhAdd/RemoveNetwork
249
CuhnhiukinchoSystemPolicy
VcuicngchngtimuncgichlSystemPolicychnhhngvi
chnhmyISAServervdngvomcchbomtchoISAServer.
Ghich:SystemPolicythcchtcnglAccessRulenhngMicrosoftcuhnh
thnhmtphnringviWizardchophpngidngddngcuhnhcho
ringISAServer.Numuntmhiu,cgicthClickphichnProperties
voSystemPolicythayvClickEditSystemPolicy.
ISA Server 2006
ThayinidungchoSystemPolicyvchngtanhnthyrngSystemPolicythcchtcngl
mtAccessRuleviiukintcdnglnchnhbnthnISAServer
26. Cu hnh h thng Instrusion Detection Service

ISAServerctnhnngcamtInstrusionDetectionService(IDSSystem)vs
lulitanbcccuctncngvoISAServer,chyultncngDoS.ISA
Serverchialm2laitncng:tncnglaiphbinlDoShocScanPortv
laitncngth2thnggphnltncngvoDNSServer.
HthngIDSchlmchcnngLulicuctncng,nidungccgitintn
cngvhthngvophnAlerttrnphnMonitoringcaISAServer
bttnhnngIDStrnISAServerchngtalmnhsau
VoISAServerManagementConsolevchnmcConfigurationGeneral
SdngGeneralcuhnhcctnhnngphchoISAServer
TrongcasContentPaneclickchnEnableIntrusionDetectionandDNSAttack
Detection
251
Cuhnhtnhnngcnhbotncng(IDS)choISAServer2006
TrnTabCommonAttacksvClickchnEnableinstrusiondetection
CckiutncngsclulitrnAlertvLoggingcaISAServer
Vchntipcckiutncngscluli
ISA Server 2006
Windowsoutofband(WinNuke).ISAServerslulinugpkiutncng
outofbanddenialofservicebngProtocolNetBIOSvohthngbntrongISA
ServernhmngLAN(Internal),DMZhocchnhISAServer.
Land.KiutncngnysgimtgitinvoISAServerhocmtmytnhbn
trongmngcaISAServerviSourceAddress/SourcePortvDestination
Address/DestinationPortgingynhnhau.ISAServersluvoLognugp
kiutncngny.
Pingofdeath.ISAServerluliLognugpgitinPINGvidunglngqu
ln(lnhn65535bytes).
IPhalfscan.LulikiuScanPortnuISAServernhnlintcccgiSYN
nhnglikhngcACKtrlihanttktnitheocchThreeway
Handshake.
QutrnhThreewayhandshakembochaibnTCPClientsvServerumunkhitokt
ni.Trongbckhitony,ClientsvServersthngnhtvinhausSequenceNumber,
WindowsSizechonhau.HackercthlidngktcuchtchnycaTCPthchinnhiukiu
tncngkhcnhau.
UDPbomb.ylkiutncngthnggpnhtnhngchyultrongLAN,
HackerssgihnglatccgitinUDPkhngcncchFlowControl(UDP
khngcFlowControl)vinhlmhaotnbngthngcahthng.Nu
gpkiutncngny,ISAServersluli.
253
CchlnglocaUDPtochichoHackertncngchimbandwidthcaServer.UDPkhngh
kimtrabngACKhocWindowsSize.
Portscan.ChngScanPortnuphthinhnglatgiSYNcgilintc
voccPorttrnISAServerhocmtmybntrongDMZ.NuchnOptionny
chngtaphichnthmmttrong2Optionssau:
Detectafterattacksonwellknownports.XcnhslngWellknownPort
bScan,khinongvislngPortnhtrongphnny,ISAServermito
mtAlert.WellknownPortcgitrt02048
Detectafterattacksonports.Phnnycngtngtnhphntrnnhngni
Portchungchungit065535.
ClickOK
ClickApplyluthayicaISAServer.KtbyginuISAServerpht
hinmttrongcckiutncngtrn,ISAServersluliphnLogvoAlert
trnMonitoring
ISA Server 2006
AlertsthngbotnhhnhcaISAServertrongcluntnhhnhbtncngbngnhngkiu
notrongmcIDSvacuhnhtrn
Ghich:thchincckiutncngtrn,cgiphickinthcvHackingcbnvkhng
csdngcccngctncngnythnghimvihthngtht(chodcacngtymnh
hocmtnikhc).VikiuUDPFloodrtdthchin,cgicthttmchomnhmtcngc
tncngkiuUDPFloodtitrangwebgoogle.com.vnvitkhaUDPFlood
CckiutncngDNS
DNSServerchaPublicDomaincacngtycchuynvDMZArea,vDNS
ServernylmtDNSServertronghthngDNSServertancu,cUpper
LevelDNSServercuhnhNSRecordvoPublicIPcaDNSServer.lm
cDNSServertrongvngDMZchaPublicDomainName,chngtiphi
thchin
255

ngktnmin
ngkNSRecordcuhnhvmtachIPthtvtnhtrnmtServer
angchydchvDNSvitnZonecngtnvitnminchngtingk
PublicDomainNamechngtingknhngNSRecordscuhnhchvDNSServermangPublic
IPtronghthngmngDMZ.
DNSServertrongvngDMZcISAServerbovvsthngbonuDNS
Servernybtncng.CuhnhIDSchoDNSAttacks
VoISAServerManagementConsolechnmcConfigurationGeneral
ISA Server 2006
CuhnhphncnhbotncngDNSbngISAServerManagementConsole.
ClickchnEnableIntrusionDetectionandDNSAttackDetection
CnhbotncngDNSlmtphncatnhnngIDStrnISAServer
TrnTabDNSAttacks,clickchnEnabledetectionandfilteringofDNSattacks
257

CckiutncngDNSscISAServerlulikhixyra
Vchntipcckiutncngsauy
DNShostnameoverflow.KiutncngnysgimttruyvnnDNS
ServervimttnHostNamediququynh(hn64kttrong1levelhoc
hn254ktchocmtDNSFQDN).
DNSlengthoverflow.LinyxyranuDNSServertrlimtachIPln
hn4byte(trongtrnghpcmtOctectlnhon255).
DNSzonetransfer.NucmtClientsnotngaiInternetmunTransfer
Zone(dngSecondaryZone)scluli.NuchophpClientstransferZone
thHackercthbitcbntrongZoneangcchanhngg.
ClickOK
ClickApplylulithayichoISAServer.
CuhnhLogDroppedPackets
TrnISAServermunluliccgitintncnglcbiIDSvcgicth
kimtraliccginysau
CuhnhLuginhngPackettncng
ClickchnEnableIntrusionDetectionandDNSAttackDetection
ISA Server 2006
CuhnhphnLoggingnhngPacketsdngtncng
ClickchntipOptionLogDroppedPacketstrongTabCommonAttacks
TnhnngLoggingcbtlnmcnh
ThcrachcnngnylmcnhkhicitISAServer,nhngchngtac
259

ttnivmcchtngPerformance.
27. Cu hnh tnh nng Flood Mitigation ca ISA Server 2006

FloodMitigationchophpnhquntrxemcccLogfilelinquann
nhngcuctncngbngMalicousCode(Virus,Trojan)voISAServer,hoc
cckiutncngtrnISAServerhocvoccServertrongvngDMZdoISA
Serverqunl.cuhnhcctnhnnglinquannFloodMitigationtrn
ISAServer2006chngtalmnhsau
CuhnhtnhnngFloodMitigationtrongmcGeneraltrongISAServerManagementConsole.
ClickchnConfigureFloodMitigationSettings
ISA Server 2006
CuhnhFloodMitigationtrnISAServer2006
ymithcsltnhnngcamtFirewallmnhxngtmnhISAServer
2006.ISAServerschnccktnihocgitincnhngduhiutncngsau
y.VyltnhnngmichctrnISAServer2006
261

EditthayiiukinchoccmcFloodMitigation
Mitigatefloodattacksandwormpropagation
CheckchnOptionnybttnhnngphthinVirus,Trojan(haygichung
lMalicousCode)
MaximumTCPrequestsperminute,perIPaddress:Edit
ISAServercthchngFlooddatrnslngTCPConnectionktnivoISA
ServerhocmtHostbntrongISAServer.ISAServercthphthinxmnhp
khicmtchngtrnhTrojanhocVirusxmnhpvohthng.
BmEditchnslnggitinyucukhitoktni(SYNPacket)ng
thicthchpnhntmtachIP.Mcnhslngktnichottccc
achIPl600ktni.Trnghpngailchophpn6,000chomtach
IPno.
MaximumconcurrentTCPconnectionsperIPaddress:Edit
ChngFloodvoISAServerhocHosttrongvngDMZdatrnslngkt
niTCPhanchnhvoISAServerhocvomtHosttrongvngDMZ.
ClickEditchnhlislngktnimcnhl160.Trnghpngailcho
mtachIPl400.
Ghich:SYNPacketsdngtrongkhitoktnivchl1phncaqutrnhThreeway
handshake.SaukhihanttqutrnhThreewayhandshake(gm2giSYNvmtgiACK)khi
mithcscmtTCPConnectionckhito.
MaximumhalfopenTCPconnections:View
ISAServerchngliSYNFloodAttackbngcchny.Trongkiutncng
SYNFloodAttackny,HackertInternetsgihnglatgiSYNvoISA
ServerviachIPSpoofnhmmcchphvqutrnhThreeway
handshake.KtqultrnServerstorahnglatktnitrngthi
LISTENINGgyhaotntinguynchoServerhocFirewall.
PhnnyISAServerstngcuhnhchochngtavbnkhngththayi
cthngssmcnhny.
MaximumHTTPrequestsperminuteperIPaddress:Edit
ISA Server 2006
ISAServerdngcchnychngDoSvoWebServer.Trongkiutncng
DoS,HackergihnglatccgitinHTTPRequestvoWebServerlmhaotn
tinguyntrnWebServer.
ClickEditthayislngktnicamiachIPnWebServer,mc
nhl600.TrnghpngailchomiachIPl6,000ktniHTTP
Request.
MaximumnewnonTCPsessionsperminuteperrule:Edit
HackercthtncngDoSvoServertrongmngDMZbngccgitinkhng
phiTCP(vdnhICMP).Trongkiutncngny,Hackersgihnglatcc
gitinNonTCPvoHosttrongvngDMZ.Ttcnhnggitinkhngphi
TCPsbtchi.
ClickEditthayislngktniNonTCPvoISAServerhocDMZ
ServertmtachIPno.Mcnhconsnyl1,000vcgikhng
ththayiphnException(ngail)cakiutncngny.
MaximumconcurrentUDPsessionsperIPaddress:Edit
ISAServersdngcchnychnglikiutncngUDPFloodvoHost
trongvngDMZ.Trongkiutncngny,HackersgihnglatgitinUDP
dunglnglnvoHostgynghnmng.
NugpphikiutncngUDPFlood,ISAServerskhngchpnhnthmbt
kktniUDPnonavoHost,lcnyslngktniUDPhintils
cquynhtrongISAServer.
ClickEditthayislngktniUDPtiacthcthchintmt
achIP.Mcnh,consnyl80.Trnghpngaillnn400.
Specifyhowmanydeniedpacketstriggeranalert:Edit
ISAServerstoramtAlerttrongphnMonitoringnuslnggitinbt
chitnngngquynh.Ngngquynhnyctnhchotanbcc
achIP,khngtnhringachIPnoc.
ClickEditthayislnggitinbtchivnuISAServerms
lngginystoramtAlert,chngtichn2000gi.
Logtrafficblockedbyfloodmitigationsettings
263

ChnOptionnyISAServerlulicccuctncngkiuFloodmISA
Serverphthin.Chngtikhuyncocginnbttnhnngnylnc
thphthincachIPnothchintncngvoISAServervvo
thiimnocthkhcphckpthivilichngtasphisdng
nhiutinguynhntrnISAServerchotnhnngny.
28. Bt/Tt cc tnh nng bo mt cho IP

IPFragment
CcgitinIPlnhnkchcbnhthngchostphnmnhgiigil
FragmentPacket.NhngFragmentPacketcthlkiutncngDoSnnnh
quantrcthbucISAServercmnhnggitinny.
VoISAServerManagementConsoleclickchnphnConfigurationGeneral
Bt/ttcctnhnngbomtchoISAServertrongmcGeneral
TrongcasContentPaneclickchnDefineIPProtection
ISA Server 2006
CuhnhnhngtnhnngbomtchoIPtrnISAServer
ChntabIPFragmentvclickduchnBlockIPFragment
CmnhnggitinIPphnmnh
ClickchnnglicnhbocaISAServer.
265
ISAServermunkhngnhviccmccgitinphnmnh
ClickOK
SaukhiclickhnOptionnyvApplythayichoISAServernlptcchiu
lc.
Ghich:NuISAServercthamgiaDomainvsdngchngthcKerberosV5(sdngProtocol
UDPvgitinnythngxuynbphnmnhFragment)thcthkhngchngthccvISA
ServerbnhmlnkhicmttcccgitinFragment.NhngthngthngISAServerkhngc
thamgiavoDomain.
IPOptions
VoISAServerManagementConsolevchnConfigurationGeneral
CuhnhIPOptionstrongmcGeneraltrnISAServerManagementConsole.
ClickchnphnIPProtection
ISA Server 2006
CuhnhcctnhnngIP
ChnTabIPOptionsvchnEnableIPOptionsFiltering
267
ChophphockhngchophpnhnggitinmangIPOption
VchntipmttrongccOptionsauy
DenyallpacketswithanyIPoption
DenypacketswiththeselectedIPoptions
DenypacketswithallexceptselectedIPoptions
ISAServerslaibnhnggitincnhngOptionnhtrongmcchn
IPRouting
McnhISAServersdngtnhnngRoutingchuynccgitingiacc
NetworktrnISAServer,chngtacthtttnhnngRoutingnyibngcch
sau
ISA Server 2006
CuhnhIPRoutingtrnISAServer
ChntipmcIPPreferencestrongContentPane
CuhnhIPRoutingtrnISAServer
ChnTabIPRoutingvClickbduchnEnableIPRouting
269
BthocttIPRoutingtrnISAServer
ClickOK
ClickApplythayichoISAServer.
KhibOptionnysgimtnhPerformancetrnISAServernhnglitngtnh
bomtvISAServerskhngForwardnguyncgitintClientsrangaim
chgiphnDataviphnIPlcaISAServer(cchNAT)
ISA Server 2006
CHNGV
Cu hnh Publishing vi ISA Server 2006
S dng ISA Server lm Boundary Firewall bo v tan b h thng mng, hoc s dng ISA
Server bo v ring h thng DMZ cha cc Servers s c Publish ra bn ngai
Internet. ISA Server phc v rt tt vic cho php Clients t Internet (Internet Users) truy cp
vo bn trong cc Servers trong vng DMZ hoc LAN bng tnh nng Publishing Rule.
271

29. Cu hnh DNS cho Publishing Rule
PublisingRulechophpClientstInternetcthktnivoWebServer,Mail
Server,ApplicationServer,cthsdngDNSNamehocsdngachIP
Public.TrnghpServertrongvngmngDMZsdngPrivateIPchngta
sdngPublishingRule,ProtocolsdngtrongPublishingRulelInbound
Direction.
ISAServersthchinmtktninWebServerbntrongvngDMZ.Trn
WebServerchngticuhnhHostHeaderttnchocctrangwebtrnIIS
Server.truycpcctrangwebnychngtaphisdngtnmintruy
cpvotrangweb,vd:http://www.vietcert.com;trongwww.vietcert.coml
HostHeadercatrangweb,chngtitonhiutrangwebtrnIISServervt
lnltlwww.vietcert.com,www.ictexpress.com,www.vietnamlab.com.
TrongDMZNetworkchngtatmtDNSServerphngiichoServertrong
mngDMZ.DNSServernychaccZonetrongvngDMZ.ISAServerkhng
cuhnhtrctipnDNSServertrnDMZmscuhnhvolocalDNS
ServertLocalDNSServersForwarder.
TrongmhnhbndichngtakhngcDNSServertrongvngmngDMZ
NetworkmsdngLocalDNSServerphngiiachIPPubliccacc
ServertrongvngmngDMZNetwork.ISAServercuhnhchtrctipDNS
trongLocalNetwork,trnLocalDNSServerchathngtinAHostcanhng
ServertrongvngDMZ.
ISA Server 2006
CuhnhDNStrongTCP/IPSettingscaISAServerkhisdngcchPulbishingRule
BnngaiInternet,ClientscthtruycpcvoISAServer(hocIPPublic
caDMZServer)cngtychngtiphingkcctnminvietcert.com,
ictexpress.com,vietnamlab.comvcuhnhHostchvISAServer.Cchth
nhtchngticuhnhNSRecordvnginguynDNSServertrnISP(ni
cungcp),ngairachngticthcuhnhNSRecordchvDNSServermang
PublicIPttrnhthngDMZNetwork(lcnyDMZphimangPublicIP),
bngcchnychngticthdchchuynDNSServervmngLANcacng
ty.
Ghich:cnhngISPkhngchophpkhchhngtcuhnhNSRecordchuynDNSServer.
Nugptrnghpnyccbnphilinhvinhcungcptnmincchuyn.Khithu
DomainccbnccpmtCpanelcuhnhNSRecord.
30. To Web Publishing Rule

WebServertrongmngLANcaVietCERTcPublishraInternetchokhch
hngthamkhoquahthngCRMcaVietCERTtrinkhaichonhnvin.Vic
PublishraInternetmttrangwebsdngtrongLocallviclmkhtobo,
chngtiquytnhsdngISAServerSecurengHTTPny.
ISAServercthPublishmtlcnhiutrangwebbngPort80datrnDomain
Namemchngtachn.ISAServer2006cungcpWizardsdngchovic
Publishingrtddng.
WebServertrongmngLANchngtivnachIP192.168.1.5vchy2
trangwebvietcert.comvcrm.vietcert.comlmttrangwebringnhngcng
chytrnWebServer192.168.1.5
PublishMultipleWebSites
VoFirewallPolicy
273
SdngchcnngPulbishingRuletrongmcFirewallPolicy
mcTaskPanechnPublishWebSites
CuhnhPublishingRulebngchcnngPublishWebSitetrongTaskPanecaISAServer
TiptccasquenthuccaWizard,chngtittnlPublish
VietCERT.com
ISA Server 2006
RuleNamechobitchngtiangmunPublishtrangwebno
ClickNext
ChnAllowchophpClientsctruycptInternet.NuchnDeny,ISA
ServerscmkhngchophptruycpvobntrongWebServernynucc
iukincaRulekhp.
ChophpUsertruycpvotrangebnytInternet.
ClickNext
ChnmcPublishMultiPleWebSites
275
ISAServer2006cthPublishingmtlcnhiutrangWebtrongcngmtWizard
ClickNext
TiptheolthmvonhngtrangwebnobnmunPublish,ISAServer2006
chophpPublishcnglcnhiutrangwebchvimtWizard
ISA Server 2006
ClickADDthmWebSitevoWizard
ClickAddthmtrangweb.Trangwww.vietcert.comscPublish.ISA
ServerktninWebServernybngSSLchthnhcngnuchngticu
hnhthnhcngSSLtrntrangwebwww.vietcert.comtrnServer192.168.1.5
ChchADDthmphnucaWebSite,khngADDFullyQualifiedDomainName(FQDN)
ClickOK
ClickADDthmmtachnachngtimunPublishlcrm.vietcert.com
277
ChngtithmWebSiteCRMcahthngVietCERT
ClickOK
ClickNext
VtrongWizardnychngtispublish2trangweb:wwwvcrm
ClickNexttiptc
GtnDomainca2trangwebtrn.MuntruycpctnDomainnyt
Internet,chngtingkVietCERT.comvihthngqunltnminquc
t.
ISA Server 2006
Tnminsdngchungcho2trangwebnylvietcert.com.PublishingMultipleWebSiteschc
thsdngnucctrangebnysdngcngtnui(DNSSuffix)
ClickNext
BctiptheortquantrngltoWebListenerchoISAServerbitphilng
nghePortbaonhiu,tnmingvktqulsdnvong2trangweb
cuhnhtrn.
ToWebPublishingRule
ClickNewthmWebListenerchoISAServer
279
ToWebListenerchoISAServerlngnghe3trangwebny
ClickNew
TnListenerchngtichnlCRMSite.
ISA Server 2006
CuhnhWebListenerlngnghecoh2trangweb.WebListenterName
ClickNext
HintichngtichathchnSSLnClientsvchacuhnhSSLCertificate
trnISAServer.CchPublishingWeblcnyldngBridging,ISAServers
tomtktninPublishingServervmtktninClients.Mithngtin
scISAServerkimsat.
CchthcbomtngktnigiaISAServervClients,cgicthchnSecurebngHTTPS
hocsdngHTTP
ClickNext
CuhnhISAServerlngnghetrnInterfacenocamnh.
281
LngnghetrafficWebRequesttClientsInternet,vsdntrafficvoWebServer
ClickNext
TiptheolcuhnhkiuchngthcviUsertInternet,chngtichnHTTP
Authentication
ISA Server 2006
ChnkiuchngthcchoWebListener,chngtisdngBasicAuthenticationviHTTP
Authentication.PhnsauchngtishngdncuhnhHTTPSbomtUsername/Password
gibngPlainTexttrnngHTTP
ClickNext
SingSignOntrnWebchhtrnuchnHTMLFormAuthentication.Hinti
chngtichnHTTPAuthenticationnnkhngthbttnhnngSingleSignOn.
283
HTTPAuthenticationkhngthtndngctnhnngSingleSignOn(SSO)vicctrangweb
nhSharePointPortalvCRM
ClickNext
Kimtraliqutrnhcuhnh
TnghpqutrnhtoWebListenertrnISAServer.
ClickFinishktthcphntoWebListener,quayliviWizardvchnWeb
Listener.
ISA Server 2006
ChnWebListenervatochoWizardPublishingRuleangcuhnh
ClickNext
ChnOptionNoDelegation,butClientsmayauthenticatedirectlychophp
ClientscthchngthctrctipviWebServer.TrnWebServercuhnh
BasicAuthentication.
ChnchcnngDelegateAuthenticationtrnISAServervWebServer
ClickNext
TtcmingiuctruycpvoWebSiteCRMcaVietCERT.Numun
285

cuhnhthnhtngnhmUser,sdngchcnngADDthmUser
Definition(lmtComponentscaAccessRule)
Chophpttcmingicphptruycpvowebnynyviiukinphic
Username/Password
ClickNext
Kimtraliqutrnhcuhnh
ISA Server 2006
TnghpqutrnhtoPublishingRuletrnISAServer
ClickFinish
Saukhicuhnhxong,ISAServersto2Rule.Biutngca2PublishingRule
chinthtrongFirewallPolicy.KimtraliRulevatobngcch
PropertiestngRulelnkimtra.
PublishingRulesaukhitocxngcqunlbngFirewallPolicy
PropertiesRules1chnTabPublicNames
287
CuhnhthngsbntrongchoPublishingRulesaukhitobngcasPropertiescaRule
ClickchnTabBridgingbitISAServerktnivoWebServerbnggiao
thcgvcthcuhnhthayili
ISA Server 2006
CuhnhPortsdngRedirectnWebServer.HTTPSchngtisdngPortmcnhl443
ClickOK
ngtInternetgachtrangwebhttp://crm.vietcert.comchngtasc
truycpvomy192.168.1.5vvongtrangwebcrm.vietcert.comtrnmy
192.168.1.5trongmngLANcaVietCERT.
tInternetcthtruycpctnmincrm.vietcert.comchngtiphic
Domainvietcert.comvcuhnhCNAMEhocHostcrmvchvachIPtht
caISAServertiach203.162.24.33
31. To Secure Web Publishing Rule

CuhnhPublishingWebviHTTPS(HTTP+SSL)
32. Cu hnh Server Publishing Rule
289

ChngtisPublishRemoteDesktoptrnmtServertrongmngLAN
192.168.1.5rangoiInternetMr.ThanhcthquntrtxaServerny,v
thngquaServernyMr.ThanhcthktninccServerkhctrongmng
LAN.ChcnngPublishingRulechngtachsdngchoServermangPrivate
IP.ViPublicIPchngtachnginsdngAccessRule,SourcelExternal
vDestinationlPublicIPcaServermangPublicIP.
ServerPublishingRulethcralcchNATtrnISAServer.ISAServersdngchcnngPort
RedirectionvitnhnngcaFirewallcthlccApplicationData.
RemoteDesktopProtocolsdngTCPPort3389.VinhngProtocolthng
dngISAServertosnccProtocolDefinitionviccProtocolvPortnh
sn.RDP(RemoteDesktopProtocol)ServersdngTCPPort3389Inbound
cISAServertosnvvychngtachcntoServerPublishingRule.
VoISAServerManagementConsolechnFirewallPolicy
ISA Server 2006
CuhnhPublishingRuletrongmcFirewallPolicy
TrongTaskPanechnCreateNonwebServerPublishingRule
TonhngPublishingRulekhngdngchoWebvMailServer.ISAServer2006htrthm
WizardPublishingSharePointPortalServer.
RuleNamegPublishRemoteDesktopServer
291
RuleNamechobitchngtiangPublishlaiServerg
ClickNext
ServerIPg192.168.1.5ServernynmtrongmngLAN,sdngIPPrivate
nnchngtiphisdngPublishingRule.KhigpPublishingRuleCondition,
ISAServersNATvobntrongPrivateIP
RemoteDesktopServerchngtichytrnServer192.168.1.5
ClickNext
ISA Server 2006
ProtocoltmtrongdanhschvchnRemoteDesktopServer(RDP),cthkim
traProtocolnybngcchClickchnProperties
ChnPublishingRemoteDesktopServerProtocolccuhnhsntrnISAServer
ChntabParameter
XemphnProtocolTCPPort3389vDirectionlInbound
293

CuhnhccthngsbntrongProtoclnyphnParameter.RDPsdngTCPport3389
ClickOK
ClickNexttrongkhivnchnRemoteDesktopProtocolServer
ClickNext
ChnNetworkExternalchoISAServerbitslngngheRDPtInternet(cc
InterfacecaISAServerktnivimngInternet)
LngngheRemoteDesktoptrnInterfaceExternal,tclUserchcthtruycpvoServernyt
Internet.
ClickNext
Xemliqutrnhcuhnh,chngtichoISAServerlngnghetrnExternal
Interface(nhngInterfacekhngnmtrongInternalvDMZlExternal)v
NATtrafficnyvoServer192.168.1.5angmdchvRemoteDesktop
ISA Server 2006
TnghpqutrnhcuhnhPublishingRule
ClickFinish
ClickApplychpnhnthayitrnISAServer,cthbnphikhingli
ccdchvcaISAServer2006.
SaukhitoxongPublishingRule,chngtikimtraliProtocolbngcas
Properties
295

RemoteDesktopRulesaukhicuhnhshinthtrongFirewallPolicy
ClickchnTabTo
CuhnhtnhnngcaPublishingRuletrnISAServer.
ChngtivnchnOptionmcnhcaISAServerlRequestappeartocome
fromtheoriginalClients,OptionnygipchngtiMonitorctraffictu
n,bitcSourceIPcaccyucudchvnyltmyno.Nuchn
OptionRequestsappeartocomefromtheISAServercomputersmtitnh
nngMonitortrnWebServer,MailServerhaynichunglccServerc
PublishkhngthbitcSourceIPntumchthyIPcaISAServer.
ClickOKquayliviISAManagementConsole.
Ghich:chcnkhingdchvISAServerControlJob,WindowstngRestartliccdchv
linquancaISAServer.
ngtmtClientsmangPublic210.245.22.91mtngtruynkhcktni
voPublicIPcaISAServer2006(203.162.23.33).Chngtakhngktnitrc
tipvoPrivateIPcaRemoteDesktopServerachIP192.168.1.5mphi
ktnivoPublicIPcaISAServer,tISAServerstomtktnivoRemote
ISA Server 2006
DesktopServer.ngtRemoteDeskopServerchngtachcththyc
SourceIPlISAServer(InternalIP)
KtquktnithnhcngnRemoteDesktopServernhngachIPtrn
thanhRemoteDesktoplachIPPubliccaISAServer203.162.23.33
33. Publishing cc h thng Server MultiMedia

BntronghthngLANcaVietCERTcmtServerchaccVideodng
StreamingMediachophpWebServertvngmngDMZcaVietCERTc
phptruycpvo.SteamingMediasdngProtocolMMSchophpxemphim
onlinemkhngcndownloadtanbnidungtptinWMVhocWMA.
ServerMMScaVietCERtmangachIP192.168.1.5trongmngLAN,v
chngtichchophpWebServertiach203.162.23.34cphptruycp.
ChngtisdngPublishingRuleviPortlMMSServervcbitphicu
hnhFromNetworklComputervigitrlach203.162.23.34
ChchophpDMZServercphptruycpvoServertrongmngLAN,nuUserhocServert
InternetskhngthtruycpvomngLANbngStreamingMedia.
VoFirwallPolicy
297
CuhnhPublishingRulebngFirewalPolicy
TrongTaskPanechnCreateNonwebServerPublishingRule
CuhnhPublishingRulesdngTaskPane
RuleNamegPublishMMSServertoDMZ
ISA Server 2006
RuleNamechothychngtimunPublishServernovngno.
ClickNext
ServerIPg192.168.1.5ServernynmtrongmngLAN,sdngIPPrivate
nnchngtiphisdngPublishingRule.KhigpPublishingRuleCondition,
ISAServersNATvobntrongPrivateIP
achIPcaStreamingMediachngtitti192.168.1.5trongmngLAN.achIPPrivate
nnchngticnsdngtnhnngPulbishingRule
ClickNext
299

ProtocoltmtrongdanhschvchnMMSServer,cthkimtraProtocolny
bngcchClickchnProperties
ChnMMSProtocolccuhnhsntrnISAServer
ChntabParameter
MMSServersdng2Connectionsktni,TCPsdngtrongvictruyn
thngsiukhin,UDPsdngginidungPhim,nhc
ISA Server 2006
CuhnhthamschoMMSServer.MMSServersdngc2ProtocolTCPvUDPuPort
1755.ISAServercchcnngFilterchoMMSphnApplicationFilter.
ClickOK
ClickNexttrongkhivnchnMMSServer
ClickNext
ChnNetworkExternalchoISAServerbitslngngheMMSServer
203.162.33.34tmngDMZ,chngtichnDMZNetworkvClickchn
AddressvchnchnhxcachIP203.162.33.34trongvngDMZ.
301
LngnghetrnDMZNetworkvchcDMZNetworkIPcthtruycpvoServer1.5bngMMS
Protocol
ClickAllIPAddressontheISAServercomputerthatareintheselectednetwork
lngnghebngInterfaceDMZ.Chngtivnchathchincmcch
chlngnghetComputer203.162.33.34,vicnychngtasthchinsaukhi
cuhnhxongPublishingRule.
ISA Server 2006
TtcachIPtrongvngmngDMZNetworkucthtruycpvoMMSServerachIP
192.168.1.5
ClickOKquayliviWizard
ClickNext
Xemliqutrnhcuhnh,chngtichoISAServerlngnghetrnExternal
Interface(nhngInterfacekhngnmtrongInternalvDMZlExternal)v
NATtrafficnyvoServer192.168.1.5angchyStreamingMediaServiceca
Microsoft
303
TnghpqutrnhcuhnhPulbishingRulechoMMSServer
ClickFinish
ClickphichnPropertiestrnRulevatora,chngtistiptccuhnh
FromNetworklDMZnhngphichnhxcachIP203.162.33.34
ISA Server 2006
CuhnhthamschoPublishingRulevcuhnhliphnFromchchphpmtServercthno
ctruycpvoMMSServerach192.168.1.5
ClickRemovebkhangAnywherevclickADDAddthmmt
ComputermangachIP203.162.33.34
305
TomtitngkiuComputergnvoPublishingRule
TnmytnhchngtitlDMZWebServer,mangachIP203.162.33.34
ComputerchngtittnhinthlDMZWebServervachIPcaServernytrongvng
DMZNetwork.
ISA Server 2006
ClickOKtoComputervDoubleClickvoComputervatoAddvo
phnFrom
DoubleClickadditngnyvoPublishingRule
KimtralinidungFromvacuhnh
307
VchngtichchophpServernyctruycpvoMMSServerachIP192.168.1.5
ClickOK
ClickApplychpnhnthayitrnISAServer,cthbnphikhingli
ccdchvcaISAServer2006.
ISA Server 2006
CHNGVI
Kt hp ISA Server 2006 v Exchange
Server 2003
S dng ISA Server 2006 vi cc tnh nng Publishing, Access Rule v Security bo v h
thng Exchange Server 2003 bn trong vng DMZ. Cc bi LAB trong chng ny s cho
ngi c thy c s kt hp han ho gia ISA Server 2006 v Exchange Server 2003.
309

34. M hnh chung
TrongbithchnhcachngnytptrungvocuhnhPublishingRuletrn
ISAServerchophpUsertInternetcthtruycpvoExchangeServer.
ExchangeServerMailchngtikhngttrongmngLAN,nhngdocth
cabithchnhnntmthichngtichoMailServernmtrongvngmng
InternetthchinPublishingRule.
NuMailServernmtrongvngmngDMZviPublicIPthkhngcnsdng
tnhnngPublishingRulemthayvocuhnhAccessRulechoUseritrc
tiptInternetvoDMZNetworkvihngTrafficlOutbound.
TrongmngLAN,chngtic2Server192.168.1.4chyMailServerExchange
2003v192.168.1.5chyStreamingMediaServerhostingccanVideocho
VietnamLabWebSite.Chngtaslnltthchinccbithchnha
nhngdchvtrnccServernyraUsertInternet.
MhnhthhnhchungchophnPublishingRule.
CuhnhRoutingvNATbngNetworkRule,cuhnhAccessRulechoUser
truycpbnhthngtmngLANraInternet.NhngtInternetvoLANphi
cuhnhPublishingRulehaynicchkhclNATngctheoPortcadchv.
TrnISAServercuhnhkhnhiuPortvihngincomingvcnh
dubngccProtocolcchServerphasau.ChngtastndngccProtocol
csncaISAServerPublish.
ISA Server 2006
35. Cu hnh SMTP Publishing Rule

MailServertmngDMZcthgiMailtrctipvoMailServerbngProtocol
SMTPPort25.ChngtasthchinPublishingSMTPServerhngInbound
voServer192.168.1.4.KhiPublishSMTPServer,chngtacthcuhnhSMTP
FilterlcnidungcaMailkhinhntMailServertrnInternet.
VoFirewallPolicy
SdngFirewallPolicycuhnhPublishingRule
TrongmcTaskPanechnPublishMailServers
PublishingMailServerlmtWizarddngsntrongISAServerchophpaMailServertrong
mngLANraInternetquacchNAT
NamechngtigPublishMailServernonSecureSMTP
311
PublishingMailServerSMTPbngISAServerWizard
ClickNext
TiptheochnServertoServercommunication:SMTP,NTTP
ChnWizardgipcuhnhchotngtcMailServertInternetvoLocalMailExchangeServer
tiach192.168.1.4lmMailOnline.
ClickNext
ChnProtocolSMTPServersPublish.
ISA Server 2006
ChnProtocolSMTPServerchophpMailServertInternetcthgiMailtrctipvoServer
Exchangecachngti.
ClickNext
XcnhachIPcaMailServerangchyExchange2003ti192.168.1.4
achIPcaMailExchangeServertiach192.168.1.4
ClickNext
ChngtichoISAServerlngnghetrn2InterfacelDMZvInternet.NuMail
ServercakhchhngcnhucugiMailvocngtychngti,chcnMail
ServermangachIPPubliclcphpgivomailServer.
313
CuhnhISAServerlngnghetrnExternalvDMZNetworknutrafficSMTPntInternet.
ClickNext
Kimtraliphncuhnh
ISA Server 2006
KimtralinhngphncuhnhsaukhihanttccbccaWizard
ClickFinish
SaukhitoRule,ISAServerxuthinthmmtRulenatrongFirewallPolicy
PublishingRulethcchtcngcchatrongFirewallPolicychungviccAccessRule.
PublishingRulechlmtdngbinthcaAccessRule.
315
36. Cu hnh SMTP Filtering

ISAServercungcptnhnngSMTPFilteringchnglivictncngbngSMTP
tInternet.Hackercthsdngkiutncnglmtrnbm(Buffer
overflow)bngcchgiccCommandtrongSMTPProtocoldihnbnh
thng.ISAServerngnchnvicnybngcchquynhchiudicacccu
lnhtrongSMTP.McnhSMTPFiltercEnabletrnISAServervquynh
snnhngchiudiccculnhcnthittrongSMTP.
cgicthEnable/DisabletnhnngSMTPFilterbngmcAddinstrongISA
ServerManagementConsole.
VoISAServerchnmcAddins
EnablevcuhnhSMTPFilterbngApplicationFiltertrongmcAddInscaISAServer
ManagementConsoletrnWindows2003
ChnTabApplicationFiltervEnableSMTPFilter
ISA Server 2006
EnableSMTPFilterchnglicckiutncngtrnbmcaHacker
CuhnhccchiudichonhngculnhtrongSMTPCommand.Thcrabi
nychngtimungiithiuncgivSMTPFiltertnhnngny
cbtmcnhtrnISAServer2006vtcdngtrnIncommingSMTP
Traffic(gmSMTPvSMTPServerProtocol)
CuhnhchiudiccculnhSMTPbngcchchnculnhvClickEDIT
317

ThayichiudicaSMTPCommand.266lchiuditiacaculnhRCPTTO:chach
Emailcngin.Hackercthgimtculnhdihn266gylichohthng.
ClickEdit
cgicththbngcchchocons266nhhnchiudicattccca
chgitrongmcTO,lMailsbchnlitrnISAServer.
NhquntrcththayichiuditiachoRCPTCommand
ClickOK
ISAServer2006cthmmttnhnngphchngtacthcihckhngci
cngc,lMessageScreener.
ThamkhothmMessageScreenertiach
http://www.microsoft.com/technet/isa/2004/help/FW_SMTPFilterAbout.mspx?mf
r=true
37. Cu hnh OWA Publishing Rule

OutlookWebAccessctrangbtrnExchangeServerchophpUsercths
dngHTTPCheckMail/PublicFolderngaytrnWebBrowsercamnh.Web
BrowserchcnhtrJavalc,vhuhtccBrowsergiyhtr
Javavotrnhduytcamnh.
truycpvoExchangeWebSitetrongmngLANchcnghttp://IPof
Server/exchangeviIPofServerlachIPcaExchangeServertrongmng
LAN,vghttp://IPofServer/publictruycpvoPublicFoldertrn
ExchangeServer.
ISA Server 2006
UserktnivoExchangeServertInternetquaISAServer.ExchangeServer
mangachIPPrivatenntrnISAServerphithchinchcnngNATtheo
Portvobntrong.TnhnngNATtrnISAServercgitheomttnkhc
PublishingRule.
ISAServerdnhringmtphnPublishOWAcaMicrosoftExchangeServer
2003,trnISAServerPublishingWizarddnhringchoOWAchtrtnhnng
AuthenticationFormnhmbomtchoUserkhikhngciukinsdng
MicrosoftOutlook2003checkMailmphisdngOWAmtnikhng
antannhdchvInternetcngcng.
SdngWizardPublishSecureWebSitetrnISAServer
VoFirewallPolicytrongISAServer
ChnmcPublishExchangeWebClientsAccesstrongcasTaskPane
SdngchcnngPublishExchangeWebClientsAccessatrangOWArangaiinternetcho
Usertruycp.RequesttClientsscISAServernhnvchuyntipvoExchangeServer.
RuleNamechngtitPublishingOWAon192.168.1.4
319
RuleNamePublishingOWAon192.168.1.4chochngtibitchcnngcaRuleny.Rulename
ttphihinthcchongidngbitchcnngcanmchacnphivopropertiesxem
ClickNext
XcnhlaiExchangeServersdngtrnmy192.168.1.4lExchangeServer
2003vlaiProtocolchngtimunPublishhintitrongbithchnhnych
lOWAnnchnOutlookWebAccess
ISA Server 2006
ChnExchangeServerversionvlaiProtocolsPublishraInternet.ChngtichnOWA
PublishWebOWAtrnExchangeServer
ClickNext
Chntipdngwebn,vchngtichsdngmtachIP192.168.1.4cho
ExchangeServer.
ChpublishmttrangwebtrnExchangeServernnchngtichnOptionPublishasinglewebsite
321

orloadbalancer.
ClickNext
ChngtiktniISAServer2006viWebServertrnExchangeServersdng
HTTPS.MuncuhnhcHTTPS,trnExchangeServerchngtiphicu
hnhthmCertificateAuthoritiviveServercpCertificatechoWebServertrn
Exchange.ChngtimundngOptionnybomtchotrafficktnitISA
ServervoExchangeServer.
ChnlaiktnigiaExchangeServerviISAServer.ISAServerngvaitrClientscaExchange
ServervchngtichnkiutrafficlSSLSecuretrongLAN.
ClickNext
KhaibotntrangwebtrnExchangeServercuhnhHTTPS.Tntrangweb
btbucphilMail.VietCERT.comvchngtikhaiboCommonName
trnCertificatecpchotrangwebnylMail.VietCERT.com
ISA Server 2006
TnminsdngkhitruycptISAServervoExchangeServer.Mail.VietCERT.comltnmin
CommonNamechngtikhaibotrnExchangeServerWebSitekhicuhnhHTTPSnnphi
dngmail.vietcert.comkhitruycptrangwebny.
ClickNext
KhaiboPublicDomainNametrnInternetkhingkvihthngtnmin
QucT.ChtruycpvoISAServerbngngtnminPublicnymic
dnvoExchangeServertiach192.168.1.4
PublicDomainNamechngtisdngchotrangwebnyl
webmail.vietcert.com
323

CuhnhWebSitetrnISAServerchophpPublishOWA
Clicknext
CuhnhWebListenerchoISAServersdngPublishOWAraInternet.
ChngtiscuhnhSSLtrnISAServerbucUserphisdngHTTPSkhi
truycpvotrangOWAcaISAServer.WebListenertrnISAServerchngti
stolngnghetrnPort443caHTTPviSSL.
Clicknew
cgiphicuhnhthmWebListenerchoOWAviHTTPS
Ch:MuncuhnhcSSLWebListener,ISAServerphicServerCertificatechngthc
viClientsvkhitomtSecureTunnelnClients.Mitraffictrongngtruynnyscm
haviKeyctobiClientsvServerquaqutrnhtraoiKey.Keynycilintcsau
15pht.
inListenerNamelSSLWebListener.
ISA Server 2006
TnchoWebListenerviCertificate
ClickNext
ChnkiuktnicaListenerviClients.ChngtibucUserphiktnin
ISAServerbngHTTPS.VtrnISAServerphicCertificatechngthcvi
User.
325
CchthctruycptISAServervClients.ChngtiphibomOWAcbomtnnphi
cuhnhHTTPSchoktniny.
ClickNext
ListenernyslngngheHTTPTraffictClientsInternetvDMZNetwork.
Chn2mngDMZNetworkvExternal
ISA Server 2006
LngnghetmngDMZNetworkvmngInternet.
ClickNext
BctiptheolkhaibochoISAServersdngCertificatenochngthc
viClients.thchincbcny,cgiphithchinqutrnhxut
CertificatetWebServercuhnhtrongbithchnhxxxvavoISA
Server.ISAServersidinchoWebServerviClientsthchinqutrnh
chngthcchoWebServer.Trongphnnychngtixinnhclicchxut
CertificatetWebServervImportvoISAServertinchoquvtheodi.
XutServerCertificatetWebServervImportvoISAServer
TrnWebServersdngSnapinCertificatexutCertificatetWebServer
thnhmttptin.
VoRUNchyMMCnpCertificatesSnapin
327
KhingMMCbngRUN
ClickOK
VoMMCvADDthmSnapinCertificates
ThmSnapinCertificatequnlCertificatestrnmytnh
ClickADD
VchnComputerAccount
ClickNext
ISA Server 2006
LaiCertificatesdngchoWebServerslComputerAccountCertificae
ChnmcLocalAccountqunlAccounttrnLocalComputercaWeb
Server.
KtnivoLocalComputerqunlccCertificatetComputerny
ClickchnmcPersonaltrongSnapinCertificates,chntipFolderCertificates
vtmCertificatewww.hocmang.comcpchotrangWebhocmang.com.
ClickphichnExportxutCertificatenyvchunbImportvoISAServer.
329
SdngWizardExportxutCertificatethnhfile
ClickNext
ClickYes,exporttheprivatekeyvphicPrivateKeytrongCertificatecpcho
WebServervschuynchoISAServer.ClientsssdngPublicKeyca
Cerficatek
XutlunphnPrivateKeysdnggiimphnKeycmhaviPublicKeytClient
ClickNext
VchnlaiCertificatesdngl.PFXbntrongcchaPrivateKey.Chngti
sdngStrongEncryptionbovPrivateKeybntrongtptinny.
ISA Server 2006
LaiFilePFXcsdngchaPrivateKeyvcmha
ClickNext
CuhnhPasswordmhachotptinny
tPasswordmhanidungcatptinPFX
ClickNext
Tntptinchngtixutralhocmang.cer
331
XuttptinCertificatethnhtptinhocmang.cer.pfx
ClickNext
ClickFinish
WebServersbolqutrnhxutthnhcng
QutrnhxutCertificatethnhcng
ImportCertificatevoISAServer
TrnISAServersaukhicopytptinhocmang.cerxutratWebServer,chng
tiDoubleClickvoCertificatenyImportvoISAServer.
DoubleClickvotptinhocmang.cer.pfx
ISA Server 2006
CuhnhImportCrticateviPrivateKeyvoISAServer
KhaibongPasswordchngtisdngtrongqutrnhxuttptinny
KhaiboPasswordgiimCertificateviPrivateKey
ClickNext
ChnPersonalbngntBrowsevclickOK
333
ImportCertificatevongphnPersonaltrnComputer
ClickNext
ClickFinish
QutrnhImportthnhcng
QutrnhImportthnhcng
KimtraCertificatetrongCertificateSnapincaISAServermcPersonal(thc
hincngvicnytrnISAServer)
ISA Server 2006
KimtraCertificatetrongmcPersonalcaISAServer
TiptheoqutrnhpublishingOWA
ClickchnServerCertificatevchnngCertificatecpphtchoWeb
ServervImportvoISAServer.
ClickOK
ClickFinishktthcphnchnCertificate
TiptcchnkiuchngthclFormbasedAuthentication
ClickNext
KimtraqutrnhLogonlncui
ClickFinish
38. Cu hnh RPC Publishing Rule

MicrosoftOutlook2003cthktninExchangeServerbngMAPIProtocol,
haynicchkhclMicrosoftOutlook2003cthsdngRPCtngtc
nExchangeServerbngcchmAPIgiaccchngtrnhvinhau.RCPc
thcPublishbngISAServervISAServerccchSecurenhchngti
giithiuuchng.
MicrosoftOutlook2003cthsdngAccountMicrosoftExchangeServert
InternetviachIPPubliccaISAServerti203.162.24.33
VoFirewallPolicy
335
CuhnhPublishingRuletrongmcFirewallPolicytrnISAServerManagementConsole.
TrongmcTaskPanechnPublishMailServers
ChnmcPublishingMailServerschophpUsertInternettruycpcvoMailExchange
Servertiach192.168.1.4trongmngLANcaVietCERT
NamecaWizardchngtigPublishNonSecureRPC
ISA Server 2006
RulenamechngtitchoPublishingRuletheonguyntcPublishingmtcngviccaRule
ClickNextchnClientsAccess
SdngWizardPublishingClientschophpClientscthktnivoExchangeServertrongmng
LANquacchNAT
ClickNext
TiptheochngtischnRPCaMicrosoftOutlook2003chophptruy
cptInternet.
337
ChnprotocolscPublish.ChngtichnRPCchophpMicrosoftOutlook2003cthktni
voExchangeServerbngMAPI,ngtruynMaillcnycmha.
ClickNext
XcnhachIPcaExchangeServer2003trongmngLANtiachIP
192.168.1.4
XcnhachIPcaMailServertrongmngLANmangachIPPrivatel192.168.1.4
ClickNext
ISA Server 2006
ChoISAServerlngnghetInternet,nutrafficnyntInternetchngs
cNATvobntrongExchangeServerach192.168.1.4.
LngnghetraffictExternaltrnISAServer.ClientstInternetktnivoExchangeServert
InternetscdnvobntrongExchangeServerachIP192.168.1.4bngcchNAT.
ClickNext,kimtraliqutrnhcuhnh.ChngtiskhngClickApplyv
RPCkhngcantan,dbtncngbngcckiuVirusnhBlaster,Sasser.
ThayvcuhnhRPCbnhthngquaInternet,chngticuhnhRPCover
HTTPS,sdngSSLmhanidungcaRPCtrongmtProtocolHTTPS.
39. Cu hnh Publishing Rule cho Clients s dng POP3 v IMAP4

ClientstInternetcthtruycpvoMailExchangetrongmngniblyMail
bngProtocolPOP3vIMAP4.MailServercPublishingquaISAServer,
ClientssktnivoPublicIPcaISAServer.TrnISAServertomt
PublishingRulechophpClientsktnivobntrong.Chngtacthtchhp
mtschngtrnhchngVirus,SpamngaytrnISAServer(SMTPGateway)
bomtchohthngMail.
iviClientsphitothmmtProfilenachoUserttnOutofOffice
Usercthsdngddngkhilmvicngaivnphngnhngvnktni
339

voExchangelyMail.
TrnISAServercsnWizardchophpcuhnhPublishingRuleIMAP4v
POP3
VoFirewallPolicy
SdngFirewallPolicycuhnhPublishingRule
ChnmcPublishingMailServerstrongphnTaskPane
PublishingMailServerbngWizardcsncaISAServer.
NamechngtitlMailClientsPOP3IMAP4
ISA Server 2006
RuleNamehinthcchcnngcaRuletosddngkhiqunlISAServer
ClickNext
ChnClientsaccess:RPC,IMAP,POP3,SMTP
ChnClienAccesstiptcWizardPublishingProtocolchoClients
ClickNext
TiptcchnlaiClientslPOP3,IMAP4vSMTP.PhicSMTPchophp
ClientsgiMailbngExchangeServer.
341
ChngtichchnPOP3,IMAP4vSMTPchoClientstruycptInternet.
ClickNext
XcnhachIPcaMailServerdngtrongmngLAN.ExchangeServer2003
cachngtiangsdngmangachIP192.168.1.4.
ChuyncctnhiunyvoServerMailExchangetiachIP192.168.1.4
ClickNext
ISA Server 2006
ChnlngnghetInternet.NuUsertInternetinvdngPortPOP3,
IMAP4vSMTPsdnvobntrongMailServer192.168.1.4.iunychp
dngnuClientsgIPtrctiplcaISAServer.NuClientsgthngach
IPcaMailServermangPublictrongvngDMZthsibngRoutingtrctip
voMailServerDMZnymkhngquacchPublishingRulecaISAServer.
LngnghecctrafficnytrnInterfaceInternet
ClickNext
Kimtraliphncuhnh
343
TnghpliqutrnhcuhnhPublishingRule
ClickFinish
CuhnhMicrosoftOutlook2003sdngPOP3/SMTP
TiptheocuhnhMicrosoftOutlook2003tomtProtfiletnOutofOfficev
cuhnhPOP3hocIMAP4choUser
MicrosoftOutlook2003nmtrongbMicrosoftOffice2003Professional
CuhnhMicrosoftOutlook2003bngAppletMAILtrongControlPaneltrncc
myClients
ISA Server 2006
CuhnhMicrosoftOutlookProfilebngchcnngMailtrongControlPanel
TomtProfilemimangtnOutofOffice
ChnhinthccProfilehincotrongmytnh
ClickchnAddthmProfilemi
345
ClickADDtothmProfilemitrenmytnh
GtnProfilelOutofOffice
tProfilenamechoProfilemi
ClickOK
ChnOptionAddaNewEmailAccountkhaibothmAccountchoMicrosoft
Outlook2003
ISA Server 2006
TothmAccountchoProfilemi
ClickNext,chngtichoUsersdngPOP3khirakhivnphng.
ChnlaiktnilPOP3nMailServer
ClickNext
347

KhaibothngsvMailServer.MailServerphikhaibothnhachIP
publiccaISAServer.TrnISAServerchngticuhnhPublishingRule
chuyncctrafficnyvotrongServer192.168.1.4.
KhaibothngtinktninMailServer,Username,PasswordvachcaMailServer(gm
POP3vSMTP)
ClickNext
ClickFinish
UserQucTancthsdngProfilenykhiktnitInternetCheckMail
bntrongMailServertiach192.168.1.4
ISA Server 2006
CHNGVII
S dng cc b lc trn ISA Server 2006
S dng Advanced Filter v Web Filter cho php ngi qun tr lc c cc ni dung su
bn trong gi tin i qua ISA Server 2006. Ngai ra, phn Filter ny, Microsoft cho php
ngi lp trnh c th t vit thm cc Module bn ngai chy tch hp vi ISA Server
2006. Tnh nng ny nhm mc ch tch hp cc ng dng ca hng th 3 vo ISA Server
2006.
349

40. Tm hiu Application Filter trn ISA Server 2006
ApplicationFilterlphnmrngMicrosoftchophpcchngth3cthpht
trinccngdngtchhpvoISAServer.MttrongcchngphttrinAddin
choISAServerlGFI.ThamkhoGFItitrangwebwww.gfi.com.GFIhtr
ISAServerphnHTTPFilteringkhtt.
Hnh:GFIWebMonitorsnphmcachungnhtsdngviISAServer2004/2006
MonitorvchngViruschoHTTP,FTP
Internetaccesscontrol&realtimemonitoringofuserswebactivity
Companiesmustexercisesomecontroloveruserswebbrowsinghabitsnot
onlytoensureproductiveuseoftheInternetbutalsotosafeguardusersfrom
adultsitesandtoensurethatdownloadsarevirusfree.Thetraditionalfullblown
webproxyfiltersarecumbersometoinstall/administerandexpensivetobuy,
whilelogfileanalyzersareawkwardtouseanddonotallowforrealtime
monitoringandblocking.
Virusscanningofdownloadsandrealtimeaccesscontrol
GFIWebMonitorisautilityforMicrosoftISAServerthatallowsyoutomonitor
thesitesusersarebrowsingandwhatfilestheyaredownloadinginREAL
TIME.Inadditionitcanblockaccesstoadultsitesaswellasperforminganti
virusscanningonalldownloads.GFIWebMonitoristheperfectsolutionto
transparentlyexerciseadegreeofaccesscontroloverusersbrowsinghabitsand
ensurelegalcomplianceinamannerthatwillnotalienateyournetworkusers!
WebFilterchophpISAServerqunlcPacketDatatngApplication
ISA Server 2006
SdngApplicationFilterlcnidungccApplicationdatakhigiquaISAServer.ISAServer
lApplicationProtocolnncthccApplicationDatatng7.
VcbitWebApplicationFiltercsdngnhiunhttrnccApplication
FirewallvlinquannWebTraffic
351
WebFilterlcttcccHTTPTrafficiquaISAServervcththayinidungcagiHTTP.
ViHTTPS,ISAServersdngcchBridgingthayinidungHTTPS.
Ngaira,MicrosoftcungcpchongidngvccDevelopersphnISAServer
SKDcthtlptrnhhocthayiISAServertheohngphttrinca
ringmnh.CcAddIncaISAServercthEnable/DisablebngcngcISA
ServerManagementConsoletrongmcAddins
DownloadISAServerSDKtiach
http://www.microsoft.com/downloads/details.aspx?FamilyID=16682c4f7645
427997e49a0c73c5162e&DisplayLang=en
TrnISAServer2006,ccApplicationFilterscttrongphnAddins
ChnmcConfigurationchntipAddins
ISA Server 2006
CuhnhApplicationFilterstrongphnAddinscaISAServer.NgairatrongphnAddinsny,
cgicththmnhngFilterttobngbcngcISAServerSDK.
TrongphnAddingmttcccApplicationFiltercaISAServer2006,gm2
phn:ApplicationvWebFilter
CcApplicationFilter
TrongISAServer2006baogmsnkhnhiuApplicationFilterchoccApplicationtngng.
VClickchnTabWebFiltersxemccFiltersdngchoWeb
353
RingphnWebFilterISAServerlumtphnringbitvWebihikhnhiulaiFilter,mt
iunalWebTrafficthngxuyncsdngnht.
ChngtacthEnable/DisableccAddinsnybngcchClickphichutchn
Enable/Disable
CuhnhEnable/DisableccFilterbngcchClickphichut,chnEnable/Disable
ChbiutngcaAddinbitangtrngthiEnablehayDisable
ISA Server 2006
NhnvotrngthicaccApplication/WebFiltercthbitchngangEnablehocDisable.
41. Cu hnh HTTP Web Filter

McnhttcccTrafficnoiquaISAServerbngProtocolHTTPubmt
ApplicationtrongISAServertcdng.FiltermangtnWebProxyFilter.Filter
nycchcnngchnttcccWebTrafficvthchinchcnngSemiNAT
WebServer.achIPcaClientsvnchinthtronggitin,nhngISA
Servercquynkimsatnidunggitingii.
PropertiesHTTPProtocolEnable/DisableWebProxyFilter
ChnFirewallPolicy
CuhnhHTTPFiltertrctiptrongAccessRule.AccessRuleccuhnhtrongFirewallPolicy.
ChntabToolBoxtrongTaskPanevtmProtocol
355
HTTPFilterccuhnhtrnProtocolDefinition.ChngtakhngcuhnhtrctipHTTPFilter
trnbWebFiltercaISAServer.
ChnngProtocolcncuhnhApplicationFilter,chngtichnHTTP
PropertiesProtocolnyvchkhuvcApplicationFilter
ISA Server 2006
TrnHTTPProtocolDefinitioncpdngmtApplicationFiltersdngchoWeblWebProxy
Filter.FilternycungcptnhnngHTTPFilterchoISAServer
HintiHTTPangbtcdngbiApplicationFiltertnWebProxyFilter.Filter
nychngtakhngthDisabletrnISAServercnhngcthUnLinkFilter
nykhiProtocolHTTP
Ghich:ikhiWebProxyFiltergyralichoWebTrafficnncthchnhsanhanhbngcchb
WebproxyFilterrakhiProtocolHTTP.UncheckWebProxyFilterbFilternyrakhiHTTP
Protocol.
WebProxyFilterchophpcuhnhtrnHTTPPackets.Nhngculnhv
MethodhocnhngtptincchuyntitrnHTTPucthlcbngFilter
ny.cuhnhblcHTTPFilterchngtachnHTTPProtocoltrongbtk
mtAccessRuleno.ChngtichnmtAccessRuleInternetAccesstrong
FirewallPolicycuhnhHTTPFilter.
357
CuhnhHTTPFilterngayAccessRulenocProtocolHTTP.Clickphichutvchnmc
Protocols.
ClickchnntHTTPFilter
ProtocolnocpdngWebProxyFiltersmangtnhnngHTTPFilter.KhicuhnhHTTPFilter
spdngchotanbProtocolnocWebProxyFilter.
ISA Server 2006
Cmccphntnmrngmangtn.EXE,.MSIkhngctiquang
HTTP.ClickchnTabExtensionvADD2tptintrn.ChnBlockSpecified
extensions(allowallothers)
CuhnhHTTPFilterkhngchophpdownloadnhngtptinctnmrngthucphnExecutable
Files(nhngtptincthchyc)
ClickOK
Ghich:NhnggchngtacuhnhtrongHTTPFiltersclulitrnWebProxyFiltervtc
dngchottcccProtocolkhccaISAServernuccProtocolnycpdngFilterWebproxy
filter.ChngtacthtothmmtProtocolHTTPNoProxychophpccClientsithngrangai
InternetmkhngcnCachelinidungtrnISAServer.ProtocolminycngsdngPort80
TCPnhngkhngpdngblcWebProxyFilter.
HocWebProxyFiltercthchngitinHTTPdatrnHTTPSignature
359
TrongmtgitinbtcbngEthereal,cutrccaHTTPHeadernhphntrn.HTTPHeader,
SignaturelnhngphnnhndinviISAServerbitgitinchag,angsdngtrnh
duytno
DatrnHeader,Signature,MethodhocPacketTypecaHTTPpacketchngta
cthbucISAServerchnhocchophpcclaigitinny.Ttcnhngtnh
nngtrnlcaWebProxyFilter.
ISA Server 2006
HTTPthucApplicationProtocolnnccutrcdliuchoringmnh.HTTP,SMTP,FTP,
POP3,ulnhngApplicationProtocol.HTTPsdngTCPPort80chuyngitin
PropertiesphnHTTPFiltering,chngtacthcuhnhccthnhphnca
HTTPPacket.
NgairacgicthcuhnhthmnhiuphnkhcnaviHTTPFilter.HTTPFilterchyu
datrnnidungcaHTTPHeader..
Ch:HTTPPacketcthsdngphnBodylctrnISAServer.Nusdngtnhnngny,
ISAServerstnrtnhiutinguynchovicMonitorvAnalyze,skhnghiuqu.
361
TomtProtocolmichoHTTPnhngkhngpdngWebProxyFilter
VoISAServerManagementConsolechnmcToolBoxtrongTaskPane
ClickNewProtocol
CuhnhthmProtocolmichoISAServer,sdngTabToolBoxtrnphnTaskPane.ClickMenu
NewchnProtocol
NamegHTTPNoProxy
ISA Server 2006
ProtocolNamelphnhinthtrnISAServervtrongAccessRule.ProtoclNamechngtacth
ilisaukhicihnhbngTabProperties.
ClickNext
PrimaryConnectionclickchnNew
ClickchnNewkhaibocimcaktnisto.
Protocol:TCP
Port80to80
Direction:Outbound
KhaibochoISAServerthngtincaktnistogmLaiProtocol,hngicadliu,sPort
sdng
ClickOKquaylivimnhnhWizard,kimtracuhnhConnectionvato
363
Saukhicuhnhchngtilunkimtralithngtincuhnh,vicnykhquantrngvnusai
sdndnveccuhnhsai,khngtuntheokhithitk.
ClickNext
ClickNextbquaphncuhnhSecondaryConnection
KhngsdngSecondaryConnectionchoProtol,nudng,chngtacthtothmmtProtocol
khcvihnglInbound.
Reviewcuhnhvathchin
ISA Server 2006
Saukhicuhnh,lunReviewlinhngglm,clickFinishhantt.
ClickFinish
PropertiesProtocolvatovchphnApplicationFilterschngtakhngp
dngbtclaiFilternovoProtocolny.
SaukhicuhnhxongProtocol,chngtacthPropertiesProtocolthayiccthngs
KimtratrongTabParameter
365
KimtratrongphnApplicationFilter,chngtikhnghtcdngthmbtcFilternocho
Protoclny.SdngPort80nhngkhngdngWebProxyFilter
NhngtrafficnoibngProtocolnykhngbnhhngbiFilterWeb
proxy.NhngProtocolnokhngcWebProxyFiltertcdngskhngthcu
hnhHTTPFilter.
42. Cu hnh FTP, SOCKS Application Filter

WebProxychhtrtrnProtocolTCPPort80choWebhocFTP.FTPProxyc
thbthoctttrnISAServer.ChngtacthcuhnhISAServerthnhmt
SOCKSServerchophplmProxychobtkServiceno.Clientscnphici
tMicrosoftISAServerClientscthsdngtnhnngSOCKStrnISA
Server.
EnableSOCKSApplicationFiltertrnISA
ChnConfigurationAddins
ClickphilnSOCKSvchnEnable.
ISA Server 2006
BtSockV4FilterchophpISAServersdngtnhnngSOCKFilter,lcccngdngchybng
SOCKnhFirewallClients.
TrnClientscaISAServercitchngtrnhMicrosoftISAServerClients.
Saukhici,ClientsstngtcnISAServerbngSOCKSTraffic,nidung
cmhatrnngtruyn.
367
SOCKApplicationsdngFirewalllmProxyServervchuynttcccRequestnFirewall.
ISAServerskimsatcnidungcaSOCKApplications.
ViFTPTraffic,ISAServerchchophpReadOnlyttcnhngtrafficralnh
UploadtrnFTPServerukhngchophp,tclUserschcthGETfilet
FTPmkhngthPUTfilelnFTPServer.
CuhnhFTPFilter
VomtProtocolchtrFTP,chnConfiguringFTPFilter
FTPFilterchcthccuhnhtrctiptrongAccessRulenocFTPProtocol.
ClickchnTabProtocolvclicktipFiltering
ISA Server 2006
RulecFTPProtocolcthcuhnhFTPFilter.
ClickchnOptionReadOnly
FTPFilterchchophpngidngcquynReadOnlyviFTServermkhngthghifile.iu
nygipchonhquntrkhilolngvivicmtthngtintrongmngkhingidngchuyntp
369

tinlnFTPServer.
ClickOK
ClickApplychpnhnthayitrnISAServer
NuClientsbntrongLANsdngFTPCommandClientsnykhngththc
hinclnhPUTfilename
ThamkhocutrclnhcaFTP:
ListofFTPcommandsfortheMicrosoftcommandlineFTPclient
CommandlineoptionsAsyourestartingtheprogramfromaDOSprompt:
ftp[v][d][i][n][g][s:filename][a][w:windowsize][computer]
vSuppressesverbosedisplayofremoteserverresponses.
nSuppressesautologinuponinitialconnection.
iTurnsoffinteractivepromptingduringmultiplefiletransfers.
dEnablesdebugging,displayingallftpcommandspassedbetweentheclient
andserver.
gDisablesfilenameglobbing,whichpermitstheuseofwildcardchractersin
localfileandpathnames.
s:filenameSpecifiesatextfilecontainingftpcommands;thecommandswill
automaticallyrunafterftpstarts.Nospacesareallowedinthisparameter.Use
thisswitchinsteadofredirection(>).
aUseanylocalinterfacewhenbindingdataconnection.
w:windowsizeOverridesthedefaulttransferbuffersizeof4096.
computerSpecifiesthecomputernameorIPaddressoftheremotecomputerto
connectto.Thecomputer,ifspecified,mustbethelastparameterontheline.
Clientcommands!Runsthespecifiedcommandonthelocalcomputer
?Displaysdescriptionsforftpcommands
appendAppendsalocalfiletoafileontheremotecomputer
ISA Server 2006
asciiSetsthefiletransfertypetoASCII,thedefault
bellTogglesabelltoringaftereachfiletransfercommandiscompleted(default
=OFF)
binarySetsthefiletransfertypetobinary
byeEndstheFTPsessionandexitsftp
cdChangestheworkingdirectoryontheremotecomputer
closeEndstheFTPsessionandreturnstothecommandinterpreter
debugTogglesdebugging(default=OFF)
deleteDeletesasinglefileonaremotecomputer
dirDisplaysalistofaremotedirectorysfilesandsubdirectories
disconnectDisconnectsfromtheremotecomputer,retainingtheftpprompt
getCopiesasingleremotefiletothelocalcomputer
globTogglesfilenameglobbing(wildcardcharacters)(default=ON)
hashToggleshashsign(#)printingforeachdatablocktransferred(default=
OFF)
helpDisplaysdescriptionsforftpcommands
lcdChangestheworkingdirectoryonthelocalcomputer
literalSendsarguments,verbatim,totheremoteFTPserver
lsDisplaysanabbreviatedlistofaremotedirectorysfilesandsubdirectories
mdeleteDeletesoneormorefilesonaremotecomputer
mdirDisplaysalistofaremotedirectorysfilesandsubdirectories
mgetCopiesoneormoreremotefilestothelocalcomputer
mkdirCreatesaremotedirectory
mlsDisplaysanabbreviatedlistofaremotedirectorysfilesandsubdirectories
mputCopiesoneormorelocalfilestotheremotecomputer
openConnectstothespecifiedFTPserver
promptTogglesprompting(default=ON)
371

putCopiesasinglelocalfiletotheremotecomputer
pwdDisplaysthecurrentdirectoryontheremotecomputer(literally,print
workingdirectory)
quitEndstheFTPsessionwiththeremotecomputerandexitsftp(sameas
bye)
quoteSendsarguments,verbatim,totheremoteFTPserver(sameasliteral)
recvCopiesaremotefiletothelocalcomputer
remotehelpDisplayshelpforremotecommands
renameRenamesremotefiles
rmdirDeletesaremotedirectory
sendCopiesalocalfiletotheremotecomputer(sameasput)
statusDisplaysthecurrentstatusofFTPconnections
traceTogglespackettracing(default=OFF)
typeSetsordisplaysthefiletransfertype(default=ASCII)
userSpecifesausertotheremotecomputer
verboseTogglesverbosemode(default=ON)
HocsdngccGUIModeFTPClientsnh
TotalCommander
CuteFTP
SmartFTP
Downloadbnthdngthcaccphnmmnytitrangwww.tucows.com
ISA Server 2006
CHNGVIII
Cu hnh VPN trn ISA Server 2006
ISA Server l Firewall tng Application, cho php nh qun tr c kh nng xt ni dung
ca gi tin i qua ISA Server mc Payload (TCP Header + Ni dung bn trong gi).
Ngai ra, cng nh cc Firewall khc, ISA Server c kh nng cu hnh thnh mt VPN
Server cho php Clients t xa truy cp (Client to Site) hoc cu hnh lm mt Gateway kt
ni n mt h thng chi nhnh (Site to Site). VPN Server ca chi nhnh c khuyn co l
mt ISA Server 2006, nhng thc t ISA Server 2006 c th kt ni VPN rt tt vi cc thit
b VPN ca cc hng khc.
373

43. M hnh thc hnh
44. Cu hnh cp pht IP ng cho VPN Clients
ClientshocVPNServerkhiquayVPNvoISAServersccpmtachIP
PrivatesdngtrongVPNTunnel.ISAvClientsssdngachIPnycho
phnRoutingtrnVPN.PrivateIPccpphtcthlytDHCPServerhoc
lytdchvRoutingandRemoteAccesstrnWindows2003.
ISAServerthcrasdngRoutingandRemoteAccesscaWindows2003lm
VPNvRouting,ngairaISAServerthmnhngphnFilteringvApplication
Filtercamnhvosnphm.CuhnhRoutingvVPNtrnISAServerddng
hnRoutingandRemoteAccessvgiaodinWebddng.
Ghich:NhquntrcththayigiaodincuhnhWebcaISAServerthngquanhngtrang
webcsntrongISAServer.
IPAddressPoolquynhtrnISAServerlmtkhangachIP.achIPu
tincISAServersdngchochnhmnhkhibttnhnngVPNtrnISA
Serverln.NhngachIPtiptheoscpphtchoClientshocVPNServer
khiquayVPNvoISAServer.
KhangachIPcpphtnykhngctrngNetworkIDvibtklp
mngnocaISAServerhoctrongtanhthngRouting.NutrngNetwork
giacclpmng,ISAServervRouterkhngthRoutingcvbOverlap
Destination.iunycngspdngcho2ISAServerquayVPNvinhautheo
mhnhSitetoSite.
CuhnhISAServercpphtIPchoVPNClients
ChnmcVirtualPrivateNetwork
ISA Server 2006
VPNccuhnhtrongmcVirtualPrivateNetworks
Chnmcs3RoutingandRemoteAccessProperties
ClickchnTabAddressAssignment
AddressPoollkhangIPsccpchoClientskhiktnivoISAServerbngVPN.ClickADD
thmkhangIPscp
ClickUseStaticAddressPool
ClickADDthmkhangIPvoPool
KhangIPbtut172.30.1.1n172.30.1.50htrcho49Clientsktnivo
ISAServerbngVPN.
375
CuhnhkhangIPscpchoClientskhiktnivoISAServerbngVPN
ClickOKquaylivicasProperties,kimtrakhangIPvathm
KimtralikhangIPcpchoClients
ClickOK
ClientskhiquayvoISAServerbngVPNsccpphtccachIPnm
trongkhangtrn,vchachIPutincISAServersdng.Khang
IPnyscsdngtrongVPNTunneltClientsnISAServer.
45. Cu hnh Authentication

AuthenticationtrnISAServerhtrcccProtocolAuthenticationsau
ISA Server 2006
BngphnlaiccProtocolsdngtrongvicchngthccaVPNServer.CcProtocolnyp
dngchohuhtcclaiFirewall,trongcISAServer2006
MSChapV2chsdngchoClientstWindows2000trln.Nuchngta
munktniWindows9XvohthngbngVPNphiEnablethmMSCHAP.
CuhnhAuthenticationtrnISAServerbngcchchnmcs3VPN
PropertiesvchnTabAuthentication,clickduchnMSCHAP.
VoISAServerManagementConsolevchnVirtualPrivateNetwork
Chnmcs3RemoteAccessConfiguration
377

CuhnhtipphnRemoteAccessConfiguration
ClickchnTabAuthentication
ChngtibtthmMSCHAPVersion1chophpLegacyClients(Windows9x)ktnivoISA
ServerbngVPN.
ClickOK
NgairanhngOptionskhcchngtakhngsdng,vdnhEAPTLSphi
cSmartCardmicththchinktniVPNc.SmartcchaCertificate
caUserkmtheoPrivateKeychngthcUser.SmartCardmuns
dng,hthngchngtaphicSmartCardReader.Hinnay,SmartCardcha
thcscsdngrngricchthngmngVN.
46. Cu hnh User Account cho VPN Clients

UsersAccounttrnISAServercthsdngWindowsAuthenticationdng
chnhWindowsAccounttrnISAServerchngthcchoUserquayvoISA
ServerbngVPN.
NgaiWindowsAuthentcation,ISAServercthsdngUserAccountti
LDAPServerhocRADIUSServer.
ISA Server 2006
WindowsAuthenticationsdngmtGroup,khaiboGroupnychoISA
ServerchobitnhngUserAccountnmtrongnhmnyscquayVPNvo
ISAServer.
TonhmtrnWindows
VoCOMPMGMT.MSC(ComputerManagement)
VoComputerManagementnhanhbngSnapinCOMPMGMT.MSC
ChnmcLocalUsersandGroups
ClickphichtvoGroupschnNewGroup
ToGroupmitrongLocalAccountDatabasecaISAServer.
GroupNamegVPNClients
379
ClickADDtronglctonhmthmthnhvinchonhm.ThnhvincanhmlcnylUser
trongLocal,hocUsertrnDomainnuISAServercthamgiaDomain(nhngchngtikhng
khuyncosdngtnhnngny)
ClickAddthmMembervoGroupny.ChngtictosnmtUser
AccounttnVPN1/123abc!@#vAddUsernyvonhmVPNClients.
GtnVPN1vophntm,clickOKAddUsernyvonhmVPNClients
ClickAdvancetmUserhocgtrctiptnUsernubit.ClickOKthmUservonhm
ClickOK
ISA Server 2006
ChkhitoUserAccountkhngnnCheckOptionUsermustchange
passwordatnextlogon
BnphibtnhnngUsermustchangepasswordatnextlogonUsercthktniddng.User
khisdngVPNsxacngty,xaingSupportcahthngnnphictothunlitia
khisdnghthng.
KhaiboVPNClientsGroupvoISAServer
ChnmcVirtualPrivateNetwork
Clickchnmcs2WindowsAuthentication
381
CuhnhISAServersdngUsertrnWindowschngthc.WindowsUserscthlLocal
UserhocDomainUser.ChngtikhngchoISAServerthamgiaDomainnhngsdng
RADIUSServercthgipISAServerchngthcbngDomainUsers.
ClickADD
ClickADDthmnhmvophnGroupstrongVPN
GtnnhmVPNClientsvophntm,ClickOK.Nugtnng,chngtas
thmcnhmVPNClientsvoISAServer.ThaotcnychoISAServerbit
nhngUserAccountnonmtrongnhmnyscquayVPNvoISA
Server.
ISA Server 2006
GtnnhmvophnEnthertheobjectnamestoselect.BmCheckNameskimtraxemtnc
ngkhng.NuphnUsernamecgcht(underline)lng.
ClickOK
ClickOK
KhiClientsktnivoISAServersphichngthcbngmtUsernmtrong
nhmny.TrnISAServer,nhquntrchcnthmUservonhmVPN
ClientshocbUserrakhinhmkhiqunlvictruycphthngbngVPN.
47. Cu hnh VPN trn ISA Server (Client to Gateway)

VPNtrnISAServersdngRoutingandRemoteAccesscuhnh,hantan
datrnRoutingandRemoteAccess.ViccuhnhVPNtrnISAServergn
nhtngviccWizardcaISAServer.CuhnhISAServerthnhVPN
Servergm5bc,nhngnhngbctrnchngtacuhnhmtsbc
nhcpIP,UserAccountnnphncnlilBttnhnngVPNtrnISAServer,
kimtraNetworkRulegiaVPNClientsvccNetworkkhctrnISAServer,
cuicngltoAccessRulechophpVPNClientstruycpvoccNetwork
khctrnISAServer.
BtISAServerVPNFunction
ClickchnphnVirtualPrivateNetwork
Clickchnmcs1
383
CuicnglbttnhnngVPNClientstrnISAServer
CheckduchnEnableVPNClientsaccess
XcnhslngVPNTunnelstiacthktnicnglclnISAServer.
ClickOK
KimtraNetworkRulegiaVPNClientsvInternal/External
VPNClientsviInternalssdngkiuilROUTEvcnglaiIPPrivate.
McnhISAServerquynhsnnnchngtakhngcncuhnhgthm
VomcNetworkRulestrnISAManagementConsole
ISA Server 2006
CuhnhNetworkRulestrongmcNetworkscaISAManagementConsole
ChntipTabNetworkRulesvchRuleVPNClientstoInternalNetworks
dngkiuROUTE
ChnTabNeworkRulesvchphnVPNClientstoInternalNetworkmcnhsdngROUTE
VPNClientsvExternalssdngNATgiaotipvinhauvraInternetphi
sdngPublicIP.PrivateIPcNATthnhPublicIPgiaotipviInternet.
385
CuhnhNetworkRulesgiaVPNNetworkvInternet
ChntipTabNetworkRulevxemchititRulesdngkiuNAT
McnhISAServer2006cngcuhnhRulechoVPNsdngNATkhitruycpExternal
48. To v kt ni VPN Clients t Windows

TrnWindowsXPhocClientsmunktnivoISAServerbngVPNchngta
phitoktnitrnWindows.ClientstoSiteVPNchsdngchochnhClients
thi,ktninyskhngcSharechoClientskhcsdng.ClientstoSite
VPNchyuhtrchonhnvinlmvicnh,lmvictinhhocPart
Time/Freelancerktnivocngtymkhngcnphingilmvictrongmng
LAN.
WindowsXPqunlktnimngbngbngphnNetworkConnectionstrong
Windows.cuhnhchoWindowsXPktniVPNchngtavoNetwork
ConnectionsvchnAddNewConnection
ISA Server 2006
SdngNetworkConnectionstrnMyNetworkPlacecuhnhtothmKtnimi
ClickchnOptionConnecttoaNetworkatmyworkplace
ChnOptionConnecttothenetworkatmyworkplace
ClickchnVirtualPrivateNetworkConnection
387
ToVPNConnectiontrnWindowsXPktninVPNServer.Chngtachthchincngvic
nytrnmytnhcangidngchophphlmvictigia,ktnitxaquaInternetvocng
ty.
ClickNext
CompanyNamesltncaConnection,chngtagVietCERTCo.,Ltd
ttnchoKtnistotrnWindowsXP.Khingidnglmvicnhhphisdngktni
nylytinguyntronghthngLANslm
ClickNext
ISA Server 2006
DestinationchnhlachIPPubliccaVPNServerhocDNSNamechngti
tochoVPNServerlvpnserver.vietcert.com.Tnminnyscphngii
thnhachIPthtcaISAServer.
achIPhocHostnamecaVPNServer
ClickNext
Kimtralinhngthngscuhnh
TomtShortcuttrnmnhnhnncaUsertosthuntinkhilmvic
ClickchnAddashortcuttothisconnectiontomydesktoptinchoUserkhi
389

ktnivoCorpLANcaVietCERT.
ClickFinish
KtniWindowsXPvoISAServerbngVPN
DoubleClickvobiutngVietCERTVPNConnectionvato
VPNConnectionsaukhitoracngcqunlbngcngcNetworkConnectionstrnWindows
2003
KhaiboUsername/PasswordnmtrongnhmVPNClientstotrnISA
Server.UserAccountnychcchngnngkhitoktninISAServerbng
VPN,ngairaskhngcsdnglytinguyntrnhthng.Usersau
khiktnivoISAServerbngVPNServerstiptcthchincngvicca
mnhbngUserAccountsdnghngngytrongDomain.
inUsername/Passwordlvpn1/123abc!@#
ISA Server 2006
KtniWindowsXPvohthngVPNServertrnWindows2003
ClickConnect
Nuktnithnhcng,Windowsshinthmtcasnhbndithanh
TaskbarchobitthigianktninVietCERTNetwork.
Suakhiktnithnhcng,VPNConnectionhinthtrnthanhTaskBarcangidng
TrongNetworkConnectionthWindowshinthnhtronghnhsau
391
NetworkConnectiontrnWindowscngchobittrngthihinticaktninyConnected
Ghich:ktnicnISAServerbngVPNthClientsphicngtruynInternetc
thtngtccnachIPcaISAServer.VPNTraffickhiitrnInternetscmha
bngIPSecTunnel,PPTPhocL2TP/IPSec.
KtnithnhcngnISAServerbngVPNchngtasccpmtachIP
choktniVPNnISAServer.MitraffickhinysiquaISAServer,kc
nhngTrafficiraInternet.
TrnClientsglnhROUTEPRINTxemRoutingTablecaClientssaukhi
quayVPNthnhcng
ISA Server 2006
RoutingTabletrnClientssaukhiktnivoVPNServer.DefaultRouteschnVPNServerlm
Gateway,mitraffictClientslcnysiquaVPNServertrongVietCERTLAN.
ChdngDefaultRouteutinsdngGatewayl172.30.1.1.Gatewayny
squnlttcccktnirangaitVPNClientskcnhngktnira
Internet.NhquntrcthcuhnhRoutingtrnClientschoUserphn
lungdliunhsau:InternetibngLocalRoutercaUser,LANTraffici
voISAServerquangVPN.
SdnglnhRouteADD/RouteDELETEthayiRoutingTablecaClients.
ChngtasbDefaultRoutecaVPNvthayvobngmtDestinationca
LAN,DefaultroutessdngLocalRouterADSLcaUser
ROUTEDELETE0.0.0.0
XaDefaultRoutekhngchthngvoVPNServercaVietCERT
LnhnysxattcccDefaultRoutectrongRoutingTablehinti
VROUTEADD192.168.1.0MASK255.255.255.0172.30.1.2
ROUTEADD0.0.0.0MASK0.0.0.010.0.0.2
393
ThayvolchDefaultRouteraGatewaylRouterADSLtigiacangidngvthmmt
EntryvoRoutingTablecaClientschophptruycpmngLAN
SdngLocalRouterlmDefaultGateway
KimtraliRoutingTablebngCommandROUTEPRINT
SdnglnhPATHPINGxemngicagitin
PATHPING192.168.1.2
KtqulgitinivoVPNTunnel
SdnglnhTracertkimtrangivomngLANtClientssaukhiktniVPN
PATHPINGwww.yahoo.com
KtqugitinibngLocalRouterADSLraInternet.
ISA Server 2006
SdngTracertkimtrangiInternet.Ktqunhmongi,InternetTrafficiqua
Gatewaytigiacangidng(RouterADSL)
49. Cu hnh VPN Site to Site vi ISA Server 2006

SitetoSiteVPNrtquantrngkhiktninhiuchinhnhvinhauvthct
rtnhiuhthngsdngVPNSitetoSitektniccchinhnhcamnhli
vinhau.
VietCERTsdngVPNSitetoSitetrnISAServerktnicchthngchi
nhnhcamnhvinhau,vsdngISAServerlmVPNServerchoClientskt
nivoLAN.ViccuhnhVPNtrnISAServertrnnquddng,khng
gingnhtrnISAServer2000,chngtakhngcnImportbtcthgt2ISA
Server(HomehocRemote)mchcncuhnhmibnISAServermtRemote
Networklxong.NetworkktnibngVPNctothnhmtNetwork
ObjecttrnISAServer.
CuhnhVPNSitetoSitetrnbtcthitbnocngphituntheoccnguyn
tcgilcchBINDINGsauy
ToDemandDialInterfaceviDialoutUsername+DialInUsernametrn
VPNServer.DemandDialInterfacesctotrn2VPNServersvinguyn
tcsau
DialOutUsername1=InterfaceName2
395
ThchinngcchBINDINGtrnc2VPNServerthchinVPNSitetoSitetheonguyn
tc:DialoutUsernamephitrngviInterfaceNamecaVPNServerbnkia.
ChngtistoktniVPNcho2ISAServer2chinhnhSiGnvH
Ni.
Bng
ChngtakhngthchntoDemandDialInterfacenhngthngquaISA
ServerchngtatoRemoteNetworkNetworknysctotrnISAServer
vchaccachIPcanhngClientschinhnhHNisctruycpvo
ISAServer/InternalsaukhihthngVPNhanchnh.
VoISAServerManagementConsolevchntipmcVirtualPrivateNetwork
TrongcasDetailsPanechnTabRemoteSites
SdngTabRemoteSitetoVPNNetworkchoISAServer.
ClickCreateVPNSitetoSiteConnectiontrongcasTaskPane
ISA Server 2006
ToVPNNetworkbngTaskPanetrnISAServerManagementConsole.
NetworkName:HaNoichphnnychngtaphigng,vNetwork
NamechnhlphnDemandDialInterfacesctotrnRoutingandRemote
Access.DemandDialInterfacesBINDngnuUsernamesdngchng
thcviVPNServer(DialInUsername)ngviInterfaceNamecaInterface
ny(tcHaNoi).TchInterfaceName=Usernamennsaukhicuhnhxong
RemoteNetworkchngtaphitomtUserAccounttrnISAServervAdd
vonhmVPNClients.UserAccountnycUsernametnHaNoi,Passwordl
123abc!@#.UserAccountnyscISAServerchinhnhHNisdng
chngthckhiquayvoISAServerSiGn.
397
NetworkNamechnhlDemandDialInterfaceNamesctotrndchvRoutingandRemote
Access.InterfaceNamephichnhxcviDialInUserAccounttotrnVPNServerny.
ClickNextvchnPPTPConnection.ChngtiktniVPNgia2chinhnh
caVietCERTbngPPTPVPN.PPTPkhngbomtbngLT2P,saukhicgi
cuhnhcPPTPchngtishngdnchuynsangL2TPConnectionv
phicIPSechocCertificate.
ISA Server 2006
ChnlaiktniVPNviNetworkny,mcnhchngtichnPPTPcthhtrchonhng
thitbkhngphiISAServercngcthktnic.
ClickNext
MicrosoftrtkkhinhcnhngidngphitomtAccountcngtnvi
NetworkNamechngtaangto.ClickOKtiptc,phntoUseraccount
chngtasthchnsaukhixongWizardny.
ISAServercnhbongidngkhicuhnhNetworkNamelphicmtUsernamecngtnvi
NetworknamectoraVPNServerbnkiasdngchngthc
ClickOK
achIPchngtakhaibokhangachIPsdngchinhnhHNicho
ISAServer.NhngIPchngtagyscAddvoNetworkmangtn
399

HaNoitrnISAServer1chinhnhSiGn.
achIPcaVPNServerchinhnhHNi.
ClickNext
KhaiboUserAccountsdngchngthckhiquayVPNviISAServerchi
nhnhHNi.UseraccountnyphibttnhnngDialInvtrngtnvi
NetworknameSaiGonbnISAServer2006caHNithchincch
BINDING.
ISA Server 2006
KhaiboUsernamevPasswordsdngchngthcvichinhnhHNi.SaigonslInterface
NamehaycngilNetworkNametrnVPNServerHNi.
ClickNext
CuhnhkhangachIPcpchomngHaNoi.KhangIPnychnhlkhang
IPtrongvngLANcaISAServerchinhnhHNi.TrnISAServerSiGns
hiuHaNoilmtNetworktrongphnNetworkDefinitionvpdngvoRule
nhmtNetworkthngthng.
ClickADDRANGEthmkhangIPsdngtrongVPNNetworkny.ViISAServerSiGn
thNetworkRangesbaogmnhngachIPcamngLANbnchinhnhHNi.
ClickAddrange..thmkhangIPvoWizard.KhangIPchngtasthml
192.168.2.0192.168.2.255lkhangIPsdngbnmngLANchinhnhH
Ni.
401

KhangIP192.168.2.0chnhlkhangIPsdngtrongmngLANcaVietCERTHNi.
ClickOKquayliWizard
KimtrakhangIPvathm
KimtralikhangIPsaukhiADDRANGE,vcbitchnusaistchnysdnnvic
Routingkhngng,VPNConnectionbli
ClickNext
CheckchnIllcreateanetworkrulelatervphiphntchhthngvcquyt
nhngn.
ISA Server 2006
TtoNetworkRule.ISAServer2006cthtoNetworkviccmngkhc,nhngchngtikhng
thchintnhnngnybngWizard
ClickNext
Kimtralinhnggcuhnh
403
Kimtralitanbqutrnhcuhnh,cthsdngntBackthayi
ChNetworkNamephikhpviUsernamechngtatora
ClickFinish
WindowscnhbongidngstngRestartlidchvRoutingand
RemoteAccess.ISAServertndngdchvnycaWindowschyVPN.
ISAServer2004cngnh2006sdngdchvRoutingandRemoteAccesslmVPNServer
ISAServer2006hnISA2004vphntinlivbomt.ISAServer2006rtk
khicnhbongidngtrongsutqutrnhcuhnh.ISAServer2006nhcnh
ngidngnhnggcnthitsaukhicuhnhxongWizardny.
ISA Server 2006
ISAServercnhbongidngnhngvicphilmtiptheosaukhicuhnhWizard
TiptctoUserAccountmangtnHaNoitrnISAServerchinhnhSi
Gn
VoComputerManagement(COMPMGMT.MSC)
VoComputerManagementbngCOMPMGMT.MSC
ChnmcLocalUsersandGroups
ClickphichutvophnUserschnNewUser
405
QunlUserAccounttrnfileSAMbngcngcComputerManagement
UsernamegHaNoi,Passwordg123abc!@#
ToUserAccountbngComputerManagementvkhngsdngOptionUsermustchange
Passwordatnextlogon.TnhnngnychnndngchoUserngnhphthng
ClickOK
VoUserstrongmcLocalUsersandGroupsvPropertiesUserHaNoi
ISA Server 2006
PropertiesUseraccountcuhnhcctnhnngchoVPNvRemoteAccess
ClickchnTabDialIn
ClickchnOptionAllowAccess
ChnTABDialIncuhnhchophpquayVPN
ClickOK
CuhnhVPNtrnISAServerHNi
TiptheocuhnhVPNtrnISAServer2chinhnhHNi.ISAServerchi
407

nhnhHNissdngNetworkNametnSaiGonvikhangachIPlcc
ClientstrongmngInternalcaISAServerSiGn.
VoISAServerManagementConsolecachinhnhHNi
ClickmcVirtualPrivateNetwork
TrnISAServerHNi,chngticngsdngTabRemoteSitecuhnhVPNNetwork
ClickmcCreateVPNSitetoSiteConnection
ToVPNNetworkchoISAServerHNibngTaskPane
NetworkNamechngtagSaiGon.Cngphnchtngtnhkhicuhnh
ISAServer1tiSiGn,NetworkNameslDemandDialInterfacetoratrn
ISAServer2tiHNi.NuNetworkNamesaiInterfaceNamesaiCu
hnhVPNsblivkhngthBINDINGc.
ISA Server 2006
NetworkNamechngtitochoISAServerHNilSaiGonchnhmngLANSiGn
ClickNext
LaiVPNProtocolchngtimuncuhnhylPPTPcsncchmha
khitruyndliuquaInternet.Saubithchnhnychngtishngdn
cuhnhVPNviL2TP/IPSec
409
ChnlaiVPNConnectionchngtisdngktnilPPTP
ClickNext
ISAServercngcnhbongidngvvictoAccountcngtnviNetworkNamevato
ClickOK
CuhnhachIPcaISAServercatngcngtyVietCERTSiGn.Khic
kchhat,ConnectionnytngktninVPNServermangach
203.162.24.33.
ISA Server 2006
achIPcaVPNServerchinhnhSiGn.IPnylIPcaExternalInterfacetrnISAServer
ClickNext
inUsername/PasswordktniviISAServerSiGn.
KhaiboUserAccounttrnISAServerchinhnhSiGnISAServerHNicthsdng
chngthc
ClickNext
411

ClickAddRangethmkhangIPsdngchoNetworkSaiGon
ADDRangethmkhangIPcamngLANangsdnghthngSiGn.
KhaibokhangIPangsdngSiGnl192.168.1.0192.168.1.255
Khangmng192.168.1.0angcsdngtiVietCERTSiGn
ClickOKquayliviWizard
KimtrakhangIPvacuhnh,khangIPnykhngctrngvimngIP
hinti.
ISA Server 2006
KimtraliNetworkRangesaukhithm
ClickNext
NetworkRulechngtistcuhnhsaumkhngcnsdngWizard
ClickNext,phnRoutingchngtiscuhnhbngNetworkRule.
413
VcngkhngsdngWizardcuhnhAccessPolicy.Vicnychngtaslmsaukhicuhnh
xongWizard
TiptheocngClickNextbquaphncuhnhAccessRulebngWizard,chng
tiscuhnhbngManualcgidnmbthn.
ISA Server 2006
KimtralithngscuhnhmtlnnatrckhiClickFinish
Reviewliqutrnhvacuhnh,ClickFinish.ISAServerhngdntipngi
dngphicuhnhthmNetworkRulevAccessRulemicthktnic
haihthngny.
415
ISAServernhcnhnhngviclmcnthiutrongkhicuhnhWizard
ClickOK
SaukhicuhnhVPN,ISAServertomtNetworkmangtnSiGnvnm
trongphnVPNRemoteSite.
ClickAPPLYchpnhnthayitrnISAServer
hiuvnhn,chngtimicgiClickvophnNetworkstrongmc
ConfigurationxemNetworkSaiGonctoranhthno
ISA Server 2006
KimtraNetworkSiGnvato.SaiGonlcnylmtNetworknmtrongISAServerHNiv
mangachIPRange192.168.1.0
NetworkSaiGonnyscsdngtrongccRulecuhnhcaISAServerH
Ni.
TiptheocuhnhNETWORKRULEgia2Networkchngtavato.
chinhnhSiGn,trnISAServerchngtaxtccmiquanhcanhng
Networkvinhau.HaNoiNetworksiviInternalbngROUTE,chngtato
mtNetworkRulechoInternalHaNoiibngkiuROUTE.
RuleName
SourceNetwork
Destination
Relationship
HaNoiInternal
HaNoi
Internal
ROUTE
ChntipmcNetworkRules
CuhnhNetworkRulesdngISAServerManagementConsole.
417

ClickCreateaNetworkRuletrongcasTaskPane
RuleNamegHaNoiInternal.
NetworkRuleNamechcgitrhinth,biuthtnhchtcaRuleny
ClickNext
SourceNetworkclickADD
ISA Server 2006
ClickADDthmNetworkSourcevoRule
ChnmcNetworkvDoubleClickvInternal
ChnNetworkInternalavoSource.
KimtraNetworkvathm
419
PhnSourcechngtichcnthmInternalmkhngcnphithmmngSiGnhayHNiv
NetworkRulesdngcch2chiu
ClickNext
TiptcthmDestinationNetwork,clickADD
ClickADDthmDestinationNetworkvoRule
ChnmcNetworkvDoubleClickvoHaNoi
ISA Server 2006
DoubleclickchnHNiNetworkvoRule
ClickClosequayliviWizard,kimtraNetworkvathm
ClickNextxcnhmiquanhgia2mngny.CnglaiPrivateIPnnsc
miquanhROUTE.
421
Miquanhgia2NetworknyslROUTEvcngmangachIPPrivate
ClickNext
Kimtraliqutrnhcuhnh,clickFinish
ISA Server 2006
KimtralivictoRuletrckhiclickFinish
Kimtraliktqucuhnh
Saukhicuhnhxong,mtRulemisxuthintrongNetworkRules
TiptctoNetworkRuleHNivDMZNetworktiSiGnibngkiu
NAT
Haimngmang2laiachIPkhcnhaunncmiquanhNAT
RuleName
SourceNetwork
Destination
Relationship
HaNoiDMZ
HaNoi
DMZ
NAT
NetworkRulesqunlccmiquanhgianhngNetworkquaISAServer
423
RuleNamegHaNoiInternal.
NetworkRulenamethhinmiquanhgiaccmng
ClickNext
ISA Server 2006
ClickADDthmNetworkvoSourcecaRule
ChnmcNetworkvDoubleClickvoDMZNetwork
ChnNetworkDMZtrnISAServerSiGn
KimtraNetworkvathm
425
ChnDMZNetworkvoSource
ClickNext
ADDthmNetworkvoDestination
ChnmcNetworkvDoubleClickvoHaNoi
ISA Server 2006
NetworkchngtisdngslHaNoi
TDMZNetworkcaISAServerSiGnnviISAServerHNimngInternalsdngRule
ny
miquanhROUTE.
427
V2NetworknysivinhaubngcchNATvkhclaiachIP
ClickNext
ISA Server 2006
KimtralncuitrckhiclickFinish
Kimtraliktqucuhnh
Saukhicuhnh,RulemixuthintrongTabNetworkRule
XttrnISAServer2tiHNichngtatoNETWORKRULEgiaNetwork
SaiGonvInternalibngROUTE
RuleName
SourceNetwork
Destination
Relationship
SaiGonInternal
SaiGon
Internal
ROUTE
CuhnhNetworkRulebngTabNetworkRuletrnISAServerHNi
429
ToNetworkRulebngISAServerTaskPane
RuleNamegSaiGonInternal.
NetworkNametchoRule
ClickNext
ISA Server 2006
ClickADDthmNetworkvoRule
ChnmcNetworkvDoubleClickvInternal
DoubleClickvoInternalavoRule
KimtraNetworkvathm
431
InternalNetworkscavoRule
ClickNext
ClickADDthmDestinationNetwork
ChnmcNetworkvDoubleClickvoSaiGon
ISA Server 2006
DoubleClickvoSaiGonthmvoRule
SaiGonNetworkslDestinationtrongRule
miquanhROUTE.
433
Miquanhgia2mngnyslROUTEvcnglaiachIP
ClickNext
ISA Server 2006
KimtralncuitrckhiclickFinish
Kimtraliktqucuhnh
KimtraRulesaukhicuhnhbngWizard.ChphiclickApplylucuhnh
CuhnhAccessRulecho2NetworkVPN
VcuicngltoACCESSRULEchoc2ISAServercgiaotipvinhau
bnglaitrafficg.ChngtathchincuhnhAccessRuletrnc2ISAServers
SiGnvHNivAccessRulekhngctnhnng2chiu.Sourcev
Destinationphichac2Networkmicthgiaotipc2chiu.
CuhnhtrnISAServer1SiGn
ChngtichophpnhnvinSiGncktnirachinhnhHNilyti
nguynSharevtruycpvoWebServerttiHNi
Source:Internal,HaNoi
Destination:Internal,HaNoi
Protocol:HTTP,NetBIOSDatagram
User:Everyone
Scheduler:Always
ContentType:AllContenttypes
TnRule
Protocol
Source
Network
Destination Users
Network
Ghich
435

SaiGon
HaNoi
HTTP,
NetBIOS
Datagram
Internal,
HaNoi
Internal,
HaNoi
AllUsers
Chophp
UsertSi
Gntruy
cpraH
Niv
ngcli
ChnFirewallPolicy
CuhnhAccessRuletrongmcFirewallPolicy
ToAccessRulebngTaskPane
RuleNamegSaiGonHaNoi
ISA Server 2006
RulenamechobitmngnysitNetworknonNetworkno
ChophpRulenyciquaISAServernukhpvicciukindiy
437
ChnSelectedProtocolthmvonhnglaitrafficgsciquaISAServer
TrongphnComponentDoubleClickvoccProtocolchophplytinguyn
quanmng:NetBIOS
ISA Server 2006
TmvDoubleClicklnltccProtocolschophpnuClientstSourceNetworkirang
DestinationNetwork
439
CcProtocoltrongbngtrnyscchophpiquaISAServer
ClickNext
PhnSourceclickAdd
ClickADDthmNetworkSourcechoRule
TrongmcAddressRangechnInternalNetworkbaogmkhangIPcamng
LANVietCERTSiGn.
ISA Server 2006
DoubleclickInternalNetwork
NuccProtocoltrongbngtrncSourceIPnmtrongkhangInternalvHNisccho
php
ClickNext
PhnDestinationchngtachophpccClientsnyractruycpquamng
LANbnchinhnhHNinnchngtiscuhnhDestinationgmInternal
vHaNoiNetwork.ClickAddchnmcNetworks
441
ThmDestinationNetworkchoRule
DoubleclickvoInternalvHaNoichophp2Networksnycthtngtcln
nhau.Nuchgn1NetworkvoSourcevDestinationthtrafficchcthi
cmtchiu.
DoubleclickthmInternalvSiGonNetwork
ISA Server 2006
TrafficnoitLANSiGnvLANHNiviccProtocoltrongbngtrnscphpiqua
ISAServer
ClickNext
chnAllUsers.
AllUsersSetchophpttcmingiuciquaISAServerny
ClickNext
443
KimtratrckhiClickFinish
Reviewqutrnhcuhnh
ClickFinish
RulemitorachophpchinhnhHNivSiGncthgiaotipvinhau
saukhiktniVPNthnhcng.
CuhnhtrnISAServer2HNi
VngclitrnISAServer2chinhnhHNichngticngcuhnhRule
tngtnhSiGn,chophpnhnvinSiGnctruycpvoWeb
ServerHNilytinguynSharevtruycpWebApplicationHNi.
NuthiubccuhnhnythVPNchodktnithnhcngvnkhngth
tngtccgia2mngvchcn1ISAServerkhngquaphp,trafficsb
chn.
Source:Internal,SaiGon
Destination:Internal,SaiGon
Protocol:HTTP,NetBIOSDatagram
ISA Server 2006
User:Everyone
Scheduler:Always
ContentType:AllContenttypes
TnRule
Protocol
Source
Network
Destination Users
Network
Ghich
SaiGon
HaNoi
HTTP,
NetBIOS
Datagram
Internal,
SaiGon
Internal,
SaiGon
Chophp
UsertSi
Gntruy
cpraH
Niv
ngcli
AllUsers
ChnFirewallPolicy
445
ToFirewallPolicytrongTaskPane
RuleNamegSaiGonHaNoi
ToRuleNameddngqunl
ISA Server 2006
ChophpccClientsiquaISAServernukhpvicciukinbndi
ClickADDthmccprotocolchophp
TrongphnComponentDoubleClickvoccProtocolchophplytinguyn
quanmng:NetBIOS
447
ChnccProtocolnhthngnhttrongbngtrn
ISA Server 2006
NhngProtocoltrongbngnyscphpquaISAServer
ClickNext
PhnSourceclickAdd
ThmAccessRuleSourceNetwork
TrongmcAddressRangechnInternalNetworkbaogmkhangIPcamng
LANVietCERTSiGn.
DoubleClickthmccNetworkvoRule
449

ThmmngInternalvSiGnvoRule
ClickNext
PhnDestinationchngtachophpccClientsnyractruycpquamng
LANbnchinhnhHNinnchngtiscuhnhDestinationgmInternal
vHaNoiNetwork.ClickAddchnmcNetworks
ClickADDthmDestinationNetworkvoRule
DoubleclickvoInternalvHaNoichophp2Networksnycthtngtcln
nhau.Nuchgn1NetworkvoSourcevDestinationthtrafficchcthi
cmtchiu.
ISA Server 2006
ThmNetworkvoDestination
DestinationNetworkphibaogmInternalvSiGnvAccessRulekhngcxttheo2chiu
nhNetworkRule
ClickNext
chnAllUsers.
451
ChophpttcmingiucquaISAServertheoRuleny
ClickNext
Reviewqutrnhcuhnh
ClickFinish
SaukhicuhnhtrnISAServerHNi,chngtitinhnhktniVPN2
ServersnybngcchtomttrafficmichoDemandDialInterfacetktni.
ChngtisdnglnhPING
ISA Server 2006
ngtrnISAServerSiGnthchinlnhPINGsauy
PING192.168.2.100
C:\>ping192.168.2.100
Pinging192.168.2.100with32bytesofdata:
Destinationhostunreachable
Requesttimedout.
Requesttimedout.
Replyfrom192.168.2.100:bytes=32time=94msTTL=120
ViachIP192.168.2.100lIPcamtmyClientstrongmngLANcachi
nhnhHNi.
Ghich:VPNSitetoSitetrnISAServerstngktnigia2ISAServerskhicmtRequest
nomungin2chinhnh.DemandDialInterfacetrnISAServerstngktni.Vic
RoutingtrnISAServersdngdchvRoutingandRemoteAccessnhngthayvolcuhnh
bngNetworkRule.
CuhnhLT2P/IPSecVPNConnection
cuhnhL2TPVPNchngtacncmttrong2dchvsau:IPSechoc
CertificatemhanidungcagiL2TP(vnL2TPkhngcmha).
IPSecsdngPresharedKeychngthc.TrnISAServermunktnibng
L2TP/IPSecPresharedKeychngtaPropertiesNetworkVPN
453
CuhnhthngschoRemoteSiteNetworkktnibngVPNnISAServerny
VchnmcTabProtocol
ISA Server 2006
KhaiboPresharedKeychoNetworkny.PresharedKeyphigingnhauchaibnISAServerH
NivSiGn
CheckchnOptionL2TPvinPresharedKeyvocasbndi.Preshared
Keyphicbomt,khngbl.
ClickOK
TiptccuhnhcngmtPresharedKeytrnISAServerchinhnhcnli
(SiGn).
455
CHNGIX
Trin khai Caching trn ISA Server 2006
ISA Server c mt tnh nng c o m t c lai Firewall phn cng no c th snh kp l
cung cp tnh nng truy cp Internet vt tri (Internet Acceleration). ISA Server c cu
hnh thnh mt Proxy Server cha ni dung trang web m Clients truy cp, ng thi
Proxy Server cng c s dng lm Firewall dng HTTP hoc FTP. Trong bi LAB
ny chng ta s cu hnh Proxy, Caching Rule v Scheduler Download Content cho ISA
Server 2006.
ISA Server 2006
50. Tm hiu v Caching

ISAServergm2tnhnngchnhlFirewallvAcceleratorchoInternet.ISA
ServertngtcInternetbngtnhnngCachecamnh.ISAServercthc
cuhnhthnhmtProxyServer.XtvtnhnngProxy,ISAServerlngc
vinngutrongWebCaching.
CchCachegipISAServertngtcInternetkhiUsertruycp.Mitrangweb
ibngHTTPhocFileibngFTPcISAServerCacheli(RAMhoc
HDD).KhicmtClientsth2truycp,ISAServersdngCachesnc
cungcpchoClients.
TnhnngCachetrnISAServerrtnhanhnhtndngMemoryCachebngRAM
ISAServerCachetrongRAMvsauchuynxungbnh.McnhISA
Serversdng10%RAMchovicCache.Chngtacthcuhnhlisphn
trmRAMsdngnysaukhiciISAServer.
Tronglnsdngsau,nucClientsnotruycpvongtrangwebnm
trongCache,ISAServerslynidungttrongCachera
457
TtcccHTTPRequestucISAServerCacheli.
ISAServerhtrForwardCachingchoClientstrongLANtruycpInternetv
ReversedCachingchoInternetUsertruycpvoServertrongLAN.
ISA Server 2006
MtvtnhnngCachetrnISAServer
51. Cu hnh ISA Server 2006 thnh Proxy Server

ISAServermcnhlmtProxyServerlngnghetrnPort8080nhng
khngCachecnhlinidungcawebtrncngmCachevoRAM.Sau
khiServerkhingli,nhngCachenysmt.cuhnhISAServerthnh
proxy,cngvictiptheocnlmlnhlisPortmProxyServerangs
dng(cthithnh3128hoc6667)vnhdunglngcngscs
dnglutrCache.
nhliPortcaProxyServerISA
ClickchnmcConfiguration
ChntiptabNetwork
CuhnhProxyPorttrongphnNetworkcaISAServerManagementConsole.
ClickphivoNetworkInternalvchnProperties
459
CuhnhPortsdngchoInternalNetworkbngmngInternal
ChntiptabWebProxy
KimtraducheckEnableHTTPProxyServer
VlngnghetrnPort8080
PhnSSLProxychngtachacncuhnh.ChcuhnhOptionnynumun
UsersdngProxykhitruycpvocctrangwebHTTPS.
ISA Server 2006
CuhnhAuthenticationchoWebClientskhitruycpInternet.
ClickAuthenticationcuhnhcckiuchngthciviccUsersdng
InternetquaProxy.
461
McnhkhngyucuWebProxyClientsphichngthckhisdngInternet
CcOptioncuhnhtrongcasnythcrakhngcnthit,vISAServerc
cchchngthcbngAccessRule.NucheckOptionRequireallusersto
authenticatecthgylichonhngsessionkhngthcungcp
Username/PasswordcnhWindowsUpdate.Microsoftkhngkhuynco
ngidngchnOptionny.VkhiquytnhsdngOptionny,nhqun
trphichcrngttccctraffickhirangaiInternetquaProxyphic
Username/Password.KiuchngthclIntegratedsdng
Username/PasswordcaWindowschngthc.
ClickOKngcasPropertiesli
Ghich:TrongNetworkLocalHostcngcphnWebProxytngtnhInternalnhngsdng
vochcnngScheduleDownloadContentchochnhISAServersdng.Ccmngkhcmuns
dngchcnngCache,nhquntrphibtcuhnhEnableHTTPCachetrnNetworktngng.
ChngticlickEnableHTTPCachetrnInternaliucnghalchhtrtnhnngCachenu
ClientssdngnmtrongmngLANInternalmangach192.168.1.0/24
ISA Server 2006
CuhnhWebProxychochnhISAServersdng
TiptheolnhdunglngcngsdngchaCachetrnISAServer
cngsdngchaCachetrnISAServerphicnhdngviNTFS,
dunglngCachechngtisdnglul12GBvclutrtrnmt
khicngringangsdngStriptngtctiaqutrnhghivcweb
cache.RAMtrnServerISAchngtisdng2GBRAMvcuhnh60%RAM
sdngchoCache.
VoISAServerchnmcConfiguration
ChnmcCachevchmcCacheangtrngthiDisable
463
BttnhnngCachetrnISAServerbngcchkhaiboachaCache
TrongcasTaskPanechnDefineCacheDrive
CuhnhachaCachechoISAServer
ChncngD:angchaCachevD:angcnhdngNTFStrnmth
thngStripgm3cng4GB
ClickSet
VchsthayitrongcasCache
ISA Server 2006
XcdnhdunglngchoISAServersdngchaCache.cginnsdngCachelmtcng
chyRAIDtngtnhPerformance
ClickOK
ChphnCachetrthnhEnabled
465

TnhnngCachechinthsaukhiquynhcngchaCache
Cuhnh%RAMsdngchoCache
ClickphivomcCachetrnISAServervchnProperties
CuhnhcctnhnngcaCachebngcasProperties
ChnTabAdvanced
ClickvophntrmRAMsdng,mcnhangl10%,chngticuhnhli
thnh60%theokhach.MiObjectkhilutrnRAMcaISAServercdng
lngkhngqu12,8KB.Dunglngnycngnhthtctruycpcng
nhanhvRAMxlstthn.
ISA Server 2006
QuynhtngdunglngRAMsdngchovicCaching.Dunglngctnhtheophntrm
catngsRAMtrnISAServer
ClickOK
Saukhitruycpmtvitrangweb,nidungCachetrnISAServersclu
vocngngdnURLCachetrnD:caISAServer.
52. Cu hnh Client s dng ISA lm Proxy Server

MunsdngtnhnngProxythccClients(trnhduytWeb)phihtrtnh
nngCache.ChngtisdngIE7vFirefoxchoUserduytWeb.iviIE
chngticthsdngPolicycuhnhvtttnhnngcuhnhProxytrn
IEngisdngkhngththayithngstytin.ViMozillaFirefoxth
iunylkhnghtvchcthcuhnhManualtrntngClients.
CuhnhProxySettingstrnIE
VoMenuToolsInternetOptions
467
CuhnhProxybngInternetOptioncaInternetExplorer
ChnTabConnection
ClickchnntLANSettings
ISA Server 2006
CuhnhProxytrnClientssdngLANSettingstrongBrowser
ClickduUseaProxyServerforyourLAN
VgachIPcaISAServervisPort8080
ClickchnduBypassproxyServerforlocaladdresschophpClientskhngs
dngProxyServerkhitruycpccWebServernmtrongmngLAN.
469
KhaibothngtinvProxyServertrnInternetExplorer
CuhnhAutoIEProxySettingsbngGroupPolicy
PolicycthcpdngtOUhoccpDomainbucccClientphi
tuntheo.ChngtisdngmtGPOtrnOUVietCERTbucccClients
phituntheoPolicyny.
EditGPOchnmcUserConfiguration
ChnWindowsSettings
ChnInternetExplorerMaintenance
ChnConnection
DoubleClickmcProxySettings
ISA Server 2006
ClickPropertiesProxySettingstrongPolicycuhnhchohnglatClients
ThitlpthngsIPvPortnhcuhnhphnManual
CuhnhProxySettingsbngPolicytrnGPO
ClickOK
ny,ccClientsccuhnhProxycgntPolicy,nhngUsersvn
471

cththayikhihsdngIE.ChngtacthtttnhnngiProxy
SettingstrnIEcaUserbngGroupPolicy.
CngtrongcngmtGPOchngtichntipAdministrativeTemplatestrong
phnUserConfiguration
ChntipmcWindowsComponents
TrongmcnychntipInternetExplorer
TmnOptionDisablechangingProxySettings
SdngPolicycuhnhtttnhnngthayiProxySettingstrnClients.
DoubleClickvothngsny
EnableSetting
ISA Server 2006
EnabletnhnngkhaProxyvClickOK
ClickOK
ClickngcasGPOnyli
CuhnhMozillaFirefoxthnhClientscaProxyServer.
VoFirefoxchnMenuToolsInternetOption
473
ClickOptiontrongMenuToolscaFireFox
ChnTadAdvanced,trongcasAdvancedtiptcchnNetworkvclicknt
Settings
SdngtnhnngAdvancedchntipNetworkcuhnhProxySettings
ISA Server 2006
inthngscaProxyServerlachIPcaISAServerviPort8080.Cch
inthngtincngtngtnhcctrnhduytwebkhc.
CuhnhProxySettingstrnMozillaFireFox
53. Tm hiu Default Cache Rule

McnhISAServercmtDefaultCacheRulechophpCachelitanbcc
nidungibngHTTPvFTPquaISAServer.ChodClientscsdngProxy
haykhngnhngnidungHTTPvFTPvnclulitrnISAServernh
voApplicationProtocolWebProxyFilter.
ChcnngcaCacheRulechoISAServerbitcchnoCacheWeb,nidung
Cachecdunglngtilbaonhiu,khinothCachevtrangnokhng
cnCachenidung
475
PhntchCacheRuletrnISAServervccgitrmcnhcaCacheRule
PropertiesCacheRuleDefaultcaISAServerxemccthngsny.
ChnhngglDefaultcaISAServerthkhngthcuhnhlicvRule
nyscpdngsaucng,mcutin(Order)mcnhlLast.
54. To Cache Rule

TomtCacheRulequynhCachetanbnidungWebcatrang
microsoft.comvibtknidunggvthngxuyncpnhtCachetrang
nyvnhnvintrongphngbanR&DcaVietCERTrthaylythngtin
trongtrangwebny
ToCacheRule
ChnCachetrongmcConfiguration
ISA Server 2006
CuhnhCacheRuletrnISAServerManagementConsole.
ClickphivoCachechnCreateaCachingRulebncasTaskPane
ToCacheRulemibngISAServerManagementConsole.
NamechnCacheallMicrosoftContent
477
CacheRuleNamechcgitrhinth
ClickNext
DestinationxcnhitngnostcdngRuleny.Destinationcthl
mtNetwork,hoccthlmttrangWeb,ServerIP
ClickAddthmDestination
ClickAddthmRuleDestinationchobititngnotcdnglnCacheRuleny
ISA Server 2006
ChngtitomtComponentURLSetvinidungltrangwebca
Microsoft.com
ClickMenuNewvchnURLSet
DestinationchnhmttrangwebchngtisdngURLSet
NamechngtithinthlMicrosoftWebSitevClickAdd,chngti
thmdngURLhttp://microsoft.com
479
ClickADDthmccNetworkvoURLSet
ClickOKvDoubleClickvoMicrosoftWebSitetrongphnComponent.
ISA Server 2006
URLSetsaukhitoshinthtrongNetworkEntities
ClickClosequaykiWizard,kimtraDestinationvathm
ClickADDthmMicrosoftWebSitevomcDestination
ClickNext
QuynhthigianlyCachetInternet(CacheRetrieval).bomthngtin
lunlunmi,chngtichnOptionutin,nutrongCachebExpired,
ISAServerslyCachetrctiptrnInternet.
481
ClickchnOptionkhinoISAServerslyCachettrangWeb
ClickNext
QuynhnidungnoscCache.ChngtimcnhchoISAServerly
CachevkhngcnlynidungcanhngDynamicWebSite(LogonSession)
ISA Server 2006
XcnhkhinoslyCachetWebvISAServer
ClickNext.CacheRulenyschophpISAServerCachelinhngnidungi
bngSSL.MuncuhnhcCacheSSLProxythISAServer
ChophpISAServerCachenidungtSSLWebSite
ClickNext
ChophpISAServerCachenidungcaHTTPvthigianTTLchoCachel1
ngy.
483
BttnhnngCacheHTTPWebSite.
ClickNext
ChophpISAServerCachelinidungcaFTPDownloadtnhngtrangweb
caMicrosoft.
ISA Server 2006
BttnhnngCacheFTPSite
ClickNext,ReviewlinidungRulecuhnh
485

KimtraliRulesaukhicuhnh
ClickFinish
QuaylimnhnhchnhviRulevacto.
thayi,ClickphichutvoRulenyvchnProperties.
RulesaukhitoshinthtrongISAServerManagementConsole.
CacheRulekhngCachemttrangweb
Trangwebvietnamlab.comkhitruycpttrongLANskhngCachelitrn
ISAchngtistomtCacheRuletcdnglnDestinationl
www.vietnamlab.comvgnvoCacheRulelkhngCachenidungttrang
ny.
VoCachetrongmcConfiguration
ISA Server 2006
CuhnhCacheRulebngmcCacheRuletrongISAServerManagementConsole.
ClickvomcCreateaNewCacheRule
ToCacheRulemibngISAServerManagementConsole.
PhnNamegDontCacheVietnamlab
CacheRuleNamechngtisdngychcgitrhinthtrongISAServer
ClickNext
487

DestinationchngtichpdngRulenychonhngtrangwebkhngcn
Cache,mttrongnhngtrangnylww.vietnamlab.com.Chngtitinhnh
tomtURLSetmangtnwww.vietnamlab.com
ClickAddthmDestinationvoWizard
ClickADDthmDestinationvoCacheRule
ClickNewURLSet
DestinationchngtistolURLSet
ISA Server 2006
PhnNamegVietnamLABWebSite
PhnURLClickNewvghttp://www.vietnamlab.com
URLSetchngtithmachtrangwebvietnamlab.com
ClickOKquaylicasComponent.DoubleClickvoURLVietnamLAB
489
VietnamLABURLSetsaukhitochinthtrongNetworkEntities
ClickADDvkimtraliDestinationtrongWizard
ClickNext.Optionnycthmcnhvtrangwebnychngtakhng
Cachethkhngcnquantmn.
ISA Server 2006
QuynhthigiankhinoslyCache
ClickNextvchnDonotCachethisContent
491

CuhnhActionquynhkhngCachenidungtrangWebquynhtrongRule
ClickNext
Reviewliqutrnhcuhnh
KimtraliRuletoClickFinish
ClickFinish
55. Cu hnh Scheduler Download Job

SchedulerDownloadchophpISAServertngDownloadvcpnhtthng
tintrongCachecamn.SchedulerDownloadstngkhitomt
Connectionntrangwebnodonhquntrquynhvdownloadtonb
nidungcatrangwebvvluvoCache.
ISA Server 2006
ISAServerCachenidungvoRAMvsavocng
ngthigianquynh,ISAServerslynidungtrangweb.ScheduledJobc
thcthchinduynhtmtlnhoclplinhiuln.ISAServerrtdcu
hnhviccWizardcxydngrttrcquan.
cuhnhSchedulerJobISAServercnphibttnhnngProxytrnLocal
HostvEnableSystemPolicychophpISAServersdngtnhnngny.
EnableProxySettingstrnLocalHost
VomcNetworktrongmcConfiguration
493

CuhnhProxySettingstrnLocalHosttrongmcNetworkcaISAServerManagementConsole.
ChnTabNetwork
ClickphivoLocalHostvchnProperties
CuhnhPropertiestrnLocalHostbttnhnngProxychochnhISAServer
ChnTabWebProxy
CheckduEnanableHTTPProxy
XcnhPortmcnhl8080
ISA Server 2006
CuhnhProxySetting:PorttrnLocalHostvchpdngchoISAServer
ClickOK
CuhnhSystemPolicychophpSchedulerDownloadhatng
VoFirewallPolicy
495

CuhnhSystemPolicytrongmcFirewallPolicycaISAServerManagementConsole.
TabTaskPanechnEditSystemPolicy
CuhnhSystemPolicytrnISAServer
cuhnhSystemPolicyvEnabletnhnngScheduleDownload
BttnhnngScheduledDownloadContenttrnISAServerchophptdownloadnidungtrang
webtheothigiannhtrc
ClickOk
ISA Server 2006
ToScheduleDownloadJob
VomcCachetrongConfigurationchnTabContentDownloadJobs
CuhnhContentDownloadJobtrnISAServertngDownloadmttrangWebtheothigian
nh
ClickvomcScheduleaContentDownloadJobbncasTaskPane
ClickScheduleaContentDownloadJobtomtcngvicmiDownloadtrangWebvvCache
tiISAServer
PhnNamegDownloadICTExpress.com
497
ContentNamechobitsDownloadtrangwebICTExpress.com
ClickNext
ClickchnDownloadhngngy
ISA Server 2006
TrangwebscDownloadhngngy
ClickNext
Xcnhthigianthchintaskny,ngynobtu,thigianbtu
Volc5h07phtsngtrckhingidngngnhphthng
Phntiptheortquantrng,quytnhngsaicaScheduleJobny
WebSitegvohttp://www.ictexpress.comvchphichttp://nukhng
ISAServersboli.
JobnyskhngDownloadnhngtrangwebhocngLinknongaitrang
www.ictexpress.comvsucamilinktkhngqu4ln.
499
CuhnhthngschoSchedulerDownloadquynhslngvsucaLink
ClickNext
QuynhCacheRulechoringJobny.ISAServermcnhchCachenhng
ObjectnycCacheHeader.NhngitngDownloadbngJobnycth
cuhnhtheomtCacheRulechoringmnh,hocsdngCacheRulemc
nhcsncaWindows.
ISA Server 2006
QuynhsDownloadvCachenhnggchotrangwebny
Reviewliqutrnhcuhnh
KimtralitanbqutrnhcuhnhScheduleDownloadContent
501

ClickFinishktthcqutrnhtoScheduleJob
ng5hsnghngngy,ISAServerstngdownloadtanbnidung
trangwebwww.ictexpress.comvvCachelncng.
ISA Server 2006
CHNGX
Monitor ISA Server 2006
Cng vic thng xuyn nht v quan trng nht ca mt nh qun tr mng l xem xt h
thng mnh chy nh th no, nht l trn mt h thng kh nhy cm l Firewall, con ng
chnh ca h thng khi ra Internet. ISA Server cung cp cho nh qun tr mt h thng
Logging, Monitor trng thi hat ng ca bn thn ISA Server cng nh ca tan h thng
mt cch trc quan nht.
503

56. Tng quan v h thng Monitor
NhquntrISAServerchcuhnhISAServervonhnglchthngcs
thayi,vchyucuhnhlcbanukhimicitISAServer.Cngvic
thngxuynnhtcaccnhquntrltheoditnhhnhhatngcaISA
ServerhaycngilMonitoring,Auditing.
ISAServercungcpringmtphnMonitoringchonhquntrcththeo
ditnhhnhhatngcaISAServer.Chyunhquntrssdngphn
DashboardxemhatngchungcaServer.
SdngmcMonitoringtrongISAServerquansttnhhnhhatngcaISAServer
TrongphnDashboard,nhquntrcthnhntngquanvISAServergm
cccasbntrong
ISA Server 2006
TngquangiaodinMonitoringtrnISAServer
ngmcas(ThugncastrongDashboard)
505
ThunhccphntrongDashboard
ThitlpmtRefreshchoMonitoring
TrongcasTaskPanechnRefreshRate
CuhnhmtlmtigiaodincaMonitoringtrnISAServer
ISA Server 2006
57. Cu hnh Alert

ChcnngAlertscnhbochonhquntrbitmtthngipglinquan
nBomthocsantancaISAServer.MicrosoftsdngtngTrigger
nilniuny,cnghalnuISAServerthymttnhnngnotn
ngngquynhstngbolnmtAlertchongidng.
VoAlerttrongphnMonitoring
XemthngtintrongAlertcaISAServer.AlertthngbotnhhnhkhncptrnISAServer
BttnhnngAlertDefinition
VoAlertchnmcConfigureAlertDefinitionbncasTaskPane
507
CuhnhcciukinchoAlert
ClickvoOptionAlertDefinitionvClickOK
ChnccAlertConitionhocclickADDthmmi
TnhnngnyschophpnhquntrtnhnghachoISAServerhiukhi
nothcntomtAlert.Tiptheonhquntrsttoraccnhnghacho
ISAServerhiukhinotoraAlert.
ISA Server 2006
ThmAlertDefinition
VoMonitoringchnmcAlert
ClickConfigureAlertDefinitiontrongphnTaskPanevClickAdd
ClickADDthmAlertDefinition
TiptheoWizard
AlertNamehinthcnidungcaAlert
ClickNext,chnAlertEvents
509
ChnlaiEventvOptionthmcaEventny
ClickNext,quynhhngmcchoAlert
PhnlaiAlertsthngbotrnISAServerMonitoring
ISA Server 2006
ClickNext,quynhnhnghnhthccnhbochoISAServerkhigp
ConditionthamnviAlerttora.
KhaibonichathngtinvAlert.ISAServercthluthngthngtinvoWindowsEventLog
ClickNext,chngtichnSendanemailmessagennISAServeryucungi
dngcuhnhSMTPServer.ChngtidngSMTPServercaVietCERTtia
ch203.162.23.34
511
CuhnhthngtinvMailServerchophpISAServergiMailnnhquntrkhicAlertxut
hin
ClickNext
ReviewliqutrnhcuhnhAlert
ISA Server 2006
ClickFinishktthcqutrnhtoAlert.
SaukhitoAlertDefinition,nhquntrcththayibngcchchnAlert
DefinitionvClickEdittrongcasTaskPaneConfigureAlertDefinition
513
AlertDefinitionhinthsaukhicuhnhvcthClickEditthayinidungbntrong
TrongphnnychngtasphicuhnhAlertConditionlkhinovtrong
iukinnoISAServerstoraAlert
CuhnhAlertEvents
ClickchnTabEvents
VchntipnhngEventnostoraAlerttrnISAServer.
NucnthmiukinphbncthClickAdditionalCondition
Trnychliukin,tiptheonhquntrphiquynhtipCondition
xyrabaonhiuln,trongthutngSecuritychngtagilThreshold,tcls
lnxyraskinhaygiltngng.
TrongTabEventschntipmcNumberOfOccurrencesvchnbaonhiuln
sxyraActionvtiptcchnslnEventxyratrongmtgiytrckhi
Actionxyra
ISA Server 2006
ChngtichnOnlyifthealertwasmanuallyresettnhtkhiResetAlert,nu
gpngngmithcscnhbothnhAlert.NucgichnImmediately,
Alertcthxuthinnhiuhn.
CuhnhthuctnhchoAlertsaukhitobngWizard
SaucnglcuhnhAlertAction
PhnnysquytnhlmgkhicAlertxyrangtheoDefitionchngta
nhngha
ChnTabActiontrongAlertDefinition
515
ChnActionsthchinkhixuthinAlertny
ISAServercthgiEmailcnhbochonhquntrnuAlertnyxyra.
cuhnhISAServergiEmailcgicnmtSMTPServer.Chngtisdng
SMTPServercaVietCERTtiach203.162.23.34
CuhnhthngtinvMailServerchophpISAServergiEmailchonhquntr
KhigpAlertxyra,ISAServercthchymtchngtrnhnochng
liskindinratrongAlert.
ISA Server 2006
ChymtngdngnokhigpAlertny
ISAServerctnhnngcamtIPS(InstrusionPreventionSystem)nncth
Stopbtkdchvnotheoyucucanhquntrkhigpsc.
TthocmccdchvcaISAServernugpAlertny
AcklowledgemtAlert
KhicAlertcnhbochonhquntr,cngviccaanhtacnlml
AcklowledgechoISAServerbitltibitriISAServerkhngcnh
bona.
517

ClickphivoccAlertvbmAcknowledgeSeletedAlerts
AcknowledgemtAlertchoISAServerbitnhquntrnmctnhhnhvAlertny
Ghich:CuhnhmttnhnngkhhaycaISAServer2006lphthinnutrongmngcmt
DHCPServernocpsaikhangIPchoClients.InvalidDHCPOfferAlertcbtsntrongISA
Server2006
TiptheolResetmtAlert
VoISAServervchnmcMonitoringAlert
ChnAlertcnReset
BncasTaskPaneClickResetSelectedAlert
ISA Server 2006
ResetmtAlertbngTaskPane
ClickYes
ISAServermunsxcnhncangidng
KimtraliAlertvaResetmt
519

SaukhiReset,AlertcxakhiISAServer
58. Session Monitor

ISAServerchophpnhquntrxemccphinktninISAServer,ccphin
ktninycthlVPN,HTTP,WebProxy
BmvoTabSessiontrongphnMonitorchngtacththycccSession
angktnivoISAServer.
NgtktnimtSession
TrongccSessionnychngtacthngtktnimtSessionno
IntheconsoletreeofISAServerManagement,clickMonitoring.
ChnTabSessionstrongcasDettailPanecaISAServer
ChnSessionphhpcnngt
TrnTabTaskPanechnDisconnectsession
FiltervicMonitorSession
HocchMonitormtSessioncthnothidatrnachIPcaClients
VoISAServerManagement,clickMonitoring.
TrongDetailspane,ClickSessionstab.
TrongcasTasksPane,clickEditFilter.
ISA Server 2006
EditFilterqunlccSession
casmcFilterby,chnmttrongnhngOptionsauy:
Activation.Sessionckhitokhino,tnhbngthigian
ApplicationName.FilterdatrntncangdnggitrafficquaISAServer.
ClientHostName,ClientIP,orClientUsername.FilterdatrnachIPc
thcamtHostno.
SessionType.FilterdatrnlaiClientskhitoktni:Firewallclient,
SecureNAT,VPNclient,VPNsitetosite,hocWebproxyClients.
ServerName.XcnhdatrnServername.
SourceNetwork.KhitotSourceNetworkno
TiptheotrongmcConditionvValue,xcnhnhngiukinphhpv
chnAddtoList.
Lplibc4v5ngthithmnhiuiukinvomcFilter,sauchn
StartQuery.
521
TruyvnmcchlcccSessiontheoiukin
SaikhiclickStartQuery,phnMonitoringSessionchxuthinnhngSession
nothangiukincaphnFilter.
ExportFilterDefinition
TtcnhngFilterDefitionnychngtacthlulibngtnhnngExportca
ISAServer
TrongcasTasksPane,clickExportFilterDefinitions.
ISA Server 2006
XutthngtincuhnhSessionthnhtptinXML
TrongphnFilename,xcnhtntptinXMLcnlulivClickSave.
ChnngdnlutptinXMLccuhnh.TptinXMLnycngnncbomt
523
ImportFilterDefinition
VsaucthnplichoISAServertrongtrnghpcnphchihoccu
hnhmitrnmtISAServerkhc.
TrongcasTasksPane,clickImportFilterDefinitions.
NugpschoccuhnhsaicthsdnglitptinXLMnybngchcnngImport
TrongphnFilename,xcnhtntptinXMLcnnpvClickLoad.
ISA Server 2006
ChntptinXMLcnnpvclickLOAD
TmdngSessionMonitoring
PhnmonitorccphinktninycthchimnhiutinguyntrnISAServer
nnchngtacthtmdng
TrongcasTasksPane,clickPauseMonitoringSessions.
525
TmthingngtnhnngkimsatccphinktniquaISAServer
HocngngluntnhnngMonitorSession
TrongcasTasksPane,clickStopMonitoringSessions.
ISA Server 2006
TthntnhnngkemsatccktnitrnISAServer
59. Cu hnh Logging

ISAServerstoLOGtheoccnhnghadonhquntrtora,LOGcaISA
ServercthclutrongchnhISAServerdngfiletexthocluvoSQL
Database.LoglnhnggISAServermthmthunhnlivhinthlncho
nhquntr
LoggingtheotngdchvcaISAServer
TrongcasDetailPanechnTabLogging
TrncasTaskschnnhngOptionsauy
ConfigureFirewallLogging.CuhnhLogfilechodchvMicrosoftFirewall
ConfigureWebProxyLogging.CuhnhLogfilechoWebProxy
527
CuhnhFirewallLogginvWebproxyLoggingtrnISAServer
TrnTabLog,ClickchnOptionEnableloggingforthisservice
BttnhnngLoggginchoISAServer
LuliccLogkhichngkhpviccRulechngtatora
ISA Server 2006
ChngtacthLoglinhngRequestkhpvinhngAccessRuletoratrn
ISAServer.cuhnhLoggingtrntngAccessRulechngtalmnhsau
VoISAServerManagementchnmcFirewallPolicy.
TrongcasDetailchnnhngRulenocnbttnhnngLog
ClickphivoRulechnProperties.
CuhnhLoggingchotngRulebngmcFirewallPolicy
TrnTabActiontrongcasPropertieschnOptionLogrequestsmatchingthis
rule.
529
BttnhnngLoggingtheotngRule
ChLoglinhngphncnthit,chngtacthchn
TrntabFields,chnnhngphnnocnLoggingli
ISA Server 2006
ChntnghngmccnLogging
MunchnttcClickSeletectAll
HocbchnttcClickClearAll.NhngphnnoChecktrongphnFieldny
sclulitrongLog.ChngtacthcuhnhLoggingnhngphnnocn
thitfileLognhgn,tintrongvicMonitor.
LuLogfilevoSQLServer.
CctptinLogcthclutrctipvoDataBaseSQLtrnSQLServer.ISA
ServerkhiciscmtphnSQLClientsktnivoISAServer
531

TrnTabLogchnSQLdatabase.
ChnnilutrcctptinLog
ClickOptionscuhnhthmthngtinchoSQLClients.
ISA Server 2006
CuhnhthngtinSQLServervDatabasechophpISAServerlutrLogfile
LunidungLogfilevoServer192.168.1.5tidatabaesIsaserver,sdng
UsernamesqldbtrnWindowsluLogvoSQL.
HoclucctptinLogvoFiletrnISAServer
TrongTabLog,clickFile.
533
HocchnnilutrchnhlthmccitcaISAServer
NgairacuhnhchititbngcchclickvoOptions
ISALogsfolderorThisfolder.LachnnilutrchoLogfile
Compresslogfiles.OptionnysnncctptinLogli
Deletelogfilesolderthan(days).XcnhsngyLogfilesbxakhiISA
Server,sdngOptionnytxavthugnDatabase.
ISA Server 2006
ChnnilutrtptinLog
ChngtacthgiihnvdunglnglutrLogfile
TrongTabLog,clickFile.
ClickntOptions
XcnhdunglngcatptinLogbngcchgsGBvoLimittotalsizeof
535

logfiles(GB).NuchnOptionny,cgicthchntipmttrong2
Optionssauy:
Deletingolderlogfilesasnecessary.XainhngLogckhidunglngLog
by.
Discardingnewlogentries.NgngkhngtipnhnthmCacheEntrynanu
Cacheby
ISAServercthtnhdunglngcngcnlicnthitchohatngcaISA
ServervkhiluCache,ISAServerschakhangdunglngnyrakhng
luLog.ChnMaintainfreediskspace(MB)vgdunglngtnhtheoMB
ISAServerchali.
CuhnhccthngschoLogFile
LcLoggingtheoiukinhinth
TrnISAServer,phnhinthLogcngcthcchnlccthddng
quanst
ISA Server 2006
TrncasTaskschnEditFilter
XuhnhccFilterchomcLogging
TrongcasFilterby,chnmttrongnhngphncnLogli
TiptheophnConditionvValue,chnnhngmccnthitLoglivClick
AddToList.
Lplibc4v5thmcciukinvodanhsch,sauClickStart
Query.
537
Chncciukinsdngtruyvn.BmStartQueryhinthngnhngthngtinkhpvi
nhngiukintrn
LuLogDefinition
ISAServercthlulinhngDefinitionchoLogFilebngcchExportthnh
tptinXML
TrncasTaskschnExportFilterDefinitions.
ISA Server 2006
XutccthngtincuhnhbngtnhnngExport
TrongphnFilename,gtntptin.xmlcnlulivClickSave.
TptinlutrdngXMLcngnncbomt
ChphnnykhngphilulinhnggLog,mchllunhngphn
LogFilterDefinition.
539

VsaunplichoISAServer
TrncasTaskschnImportFilterDefinitions.
NptptinXMLvoISAServerbngchcnngImport
TrongphnFilename,gtntptin.xmlcnnpvClickLoad.
ISA Server 2006
ChntntptinXMLcnnpvclickLOAD
LuphnhinthLog
Vnhngghinthtrnmnhnh,chngtacngcthluli
CopyAllResultstoClipboard.ChnttcnhngLoganghinthtrongphn
DetailPane.
CopySelectedResultstoClipboard.ChnOptionnyCopyttcnhng
phnLogEntrynoangcchn,sdngphmCTRLchnnhiuEntry
541
NhquntrcthanhngthngtinhinthtrnmnhnhISAServerManagementConsole
voClipboadvdnramtngdngWorksheetkhcnhExcel
60. Cu hnh Report

ISAServerstoraccreporttheoyucucanhquntr,Reportlccbn
bococaISAServervtnhhnhhatngcamnh,tnhtrangbnh,lu
lngtruycp
ToReporttrongISAServer
TrongcasDetailPane,clickchnTabReports
ISA Server 2006
ChnTabReporttheodiccReporttrnISAServer
TrntabTask,clickGenerateaNewReport.
TomtReportmitrnISAServerbngTaskPane
XcnhtnReportcnto
543
VicttnmtitngtrnISAServerttstosddngkhiqunl
Clicknext,xcnhnidungcaReport
ISA Server 2006
CuhnhnhngphncntoReport
ClickNext,chnthigianxemReport
ThigianstoReporttgiaiannonthiimhinti
ClickNext
cgicthsdngtnhnngPublishReportanidunglnmtthmcShare
ClicknextbquaphnPublishing,chngtascpsau
TiptheophncuhnhgiEmailkhitoReport,sthngbon2ach
545

Emailtrn.
VthngbochonhquntrkhicReportmihanttvchgithngtinvcngvic.ISA
ServerkhnggiReportnachEmailcuhnhtrongphnny
ClickTestkimtraEmailcsdngchaykhng.
ClickNext
ReviewliqutrnhReport
ISA Server 2006
KimtralncuikhicuhnhReportGeneration
ClickFinish
SaukhitoReportclitktrongphnReportcaMonitoring
ReportJobsaukhitochinthtrnISAServerManagementConsole.
547

MunXemReportclickchnReportvtrongcasTaskPanechnView
SeletectedReport
SdngchcnngViewtrongTaskPanehinthnidungcaReport
CasViewReporthinradngWeb
ISA Server 2006
ReportchinthbnggiaodinWeb.Thngtinkhchitit;vngidngcthchnnhng
hngmckhccasbntri
ToReporttheothigianthc
TrongcasDetailchnTabReports
TrongcasTask,clickCreateandConfigureReportJobs.
549
TovcuhnhReportJob
ClickAddthmthuctnhchoReport
ClickADDthmReportJobchoISAServer
GtnchoReport,ylphnhinthtrongSnapin
ISA Server 2006
ReportJobName
ClickNext,quynhnidungchoReportschanhngg
551
CchngmccntoReport
ClickNext,quynhthigianstoraReport,mcnhthigiantol1:AM
hngngy,nhquntrcththayiphnnytrongphnPropertiesca
Report
ISA Server 2006
QuynhthigianstoReport,mcnhthigiantol1:00sngmingy
ClickNext,bquaphnPublish
ChngtikhngdngchcnngPublishbngWizardmscuhnhsau
553

ClickNext
CuhnhphnEmailthngbochonhquntrkhicReportuctora.
CuhnhthngtinvMailServerchoISAServergithngbochonhquntrsaukhito
Report
ClickNext
Reviewliqutrnhcuhnh
ISA Server 2006
KimtraReportJob
ClickFinish
ISAServercthmtReportJobmangtnRealtimeMonitorsttoReport
hngngyvolc1:00AM.(1gisng)
SaukhiktthcqutrnhtoReportJob,quaylivicasReportJobs
PropertieschngtacthmtJobtnRealTimeMonitor
555
ReportJobsuakhitochinthtrnISAServer
ChnReportJobvClickEditthayithigiantoReport,chngtitora
volc7hsng.Thayisgithnh7hsng.
ISA Server 2006
CuhnhlithigiantoReporttrnISAServer
ClickOK.Nhvycmi7hsnghngngyISAServerstoramtReportv
giEmailthngbochonhquntr.
TomtcsdliugmccReporttrnISAServer
TrongcasTask,clickConfigureLogSummary.
557
CuhnhLoggingvReporttrnISAServer
TrnTabLogSummary,chnOptionEnabledailyandmonthlysummaries.
TrongphnSpecifythegenerationtimexcnhchoISAServerbitthigian
nostoReport
TiptheocgiquynhchoISAServerbitnilutrReport
McnhISAServerssdngthmcISASummariestrnchnhmyISA
Server,chnOptionISASummariesfolder.
NumunluReportmtthmckhc,chnThisfolder,vtiptheoclick
BrowsevClickchnFoldernocnluReport
CuhnhslngReportscluli.
TrongphnNumberofsavedsummaries,mcDailysummaries,gslng
ReportEntryscloglitrongngy.
McMonthlysummariesxcnhslngReporttrongthng
ISA Server 2006
NilutrReportvslngReporttiahngngyvhngthngISAServercthto
NgnkhngchotoDatabasechaReport
TrongcasTask,clickConfigureLogSummary.
TrongTabLogSummary,bducheckEnabledailyandmonthlysummaries.
559
BthoctttnhnngMonthlyReport
ThayiNidungvThigiantoraReport
TrongcasTask,clickCreateandConfigureReportJobs.
ChnReportJobcncuhnhvClickEdit.
ISA Server 2006
ClickEditthayithngtintrongReportjobvato
TabContentchophpchnnhngnidungnoscto
Summary
Webusage
Applicationusage
Trafficandutilization
Security
561
ChncchngmcstoReport
TiptheochnTabSchedule
ChngtimuntoReporthngngynnchnEveryday.
NgairacgicthtotheonhngngyxcnhbngcchchnOnthe
followingdaysvchnnhngngynocnReport.HcchntoReporttheo
thng,clickEverymonth,onthisdatevxcnhsngytrongthngsto
Report
ISA Server 2006
XcnhlithigiankhinoctoReport
SaukhicReport,chngtacthxemtrctiptiISAServerhocthchin
chcnngPublishReport
CuhnhnidungReport
TrongcasTaskchnmttrongnhngOptionsauycuhnhnhng
phntngng
CustomizeSummaryContent
CustomizeWebUsageContent
CustomizeApplicationUsageContent
563

CustomizeTrafficandUtilizationContent
CustomizeSecurityContent
CuhnhthngtinReportchotnghngmc
TrnmiTabtrongmcIncludethisnumberofgslngEntrysclu
voReport.ClickOKchpnhnsthayiny.
ISA Server 2006
XcnhthngsstoReportchotnghngmc
CngbmtReport
TrongcasDetailchnTabReports,chnReportcnPublish
TrongcasTaskchnclickPublishSelectedReport.
565
SdngchcnngPublishReportlnmtthmcSharenochophpngikhccthxem
quaReportbngngdnUNC
PhnBrowseforfolderchnthmcluliccReport,thmcnyphil
mtthmccShare
ChnnilutrLogchoISAServer.McnhthmcchaLognmtrongthmccitISA
Server\ISASummarries
NgicthmquynsktninthmcSharenyxemnhngReport
ISAServertora.
XaReport
ISA Server 2006
TrongcasDetailchnTabReports,chnReportcnxa
TrongcasTaskchnclickDeleteSelectedReport.
XaReportsdngISAManagementConsole
ClickYes.
ISAServerlunnhcnhngidngkhiquytnhmtvicg
61. Monitor Connectivities

Sdngchcnngnyxcnhchtlngcangtruynmng,hocxc
nhnxemngtruyncnhatngchaykhng.Connectivitiessktni
nmttrangwebvlynidungcatrang.ChngtacthchnHTTP
Methodthvitrangweb(GET,POST,)
TomtBkimtraktni
VoISAServerManagement,clickchnTabMonitoring.
567

TrongcasDetailPanechnTabConnectivity
ChnmcConnectivityVerifierscuhnhphnkimsatktnichoISAServer
TrnTabTask,clickchnCreateNewConnectivityVerifier.
TomimtConnectivitybngISAServerConsole
NamegCheckwww.vietcert.comchobitskimtraktnintrangweb
VietCERT.com.Namechcgitrhinth,khngcgitrviISAServer
(khngphnbitchhoavthng)
ISA Server 2006
CuhnhNamechoConnectivity.Namechcgitrhinth
ClickNext
KhaibotrangwebhocServercnkimtra,tiptheolchnlaidchvcn
kimtra.RingHTTPcphnMethodlGEThocPOST,hocchnthunl
khitoktniTCPnServer.
569
ClickchnCategorylWeb
ClickNext
KimtraliqutrnhcuhnhbngcasReview
ISA Server 2006
KimtraliqutrnhtoConnectivitysaukhicuhnhWizard
ClickFinish
ISAServershikinngidngkhibttnhnngny,vConnectivity
VerifierlkimtrangktnitISAServernServercnkimtrannphi
cmtSystemPolicycbitchophpISAServerkhitoktni.Hocnh
quntrcthtoAccessRulechophpISAServer(Localhost)cphpkt
ninServer(thnglExternal)
ISAServercnhbophibttnhnngchophpISAServercktnibngHTTPConnectivity
ClickYes
571

cgimunthamkhoquaSystemPolicychophpISAServerctokt
ninServercthvoSystemPolicytrongphnFirewallPolicy
CuhnhSystemPolicytrnISAServerchophpsdngtnhnngHTTPConnectivity
ClickOK
QuayliviConnectivityVerifiervPropertiesphnCheckwww.vietcert.com
chngtavato
ISA Server 2006
ClickphichnPropertiesvoConnectivitycuhnhthngssaukhito
TrongcasProperties,cgicththayicchthckimtravi
ConnectivityVerifiervato.
PropertiescuhnhliphngthcsdnglytrangWeblGET
573

ClickOK
CuhnhmcSpecifythetimeoutresponsethreshold(msec)xcnhsmili
giycktlunServerkhngthtngtcc.
ChnOptionTriggeranalertiftheserverresponseisnotwithinthespecified
timeoutkhitomtAlertnuServerbTimeout
ConnectivityshinththngbotrongAlertnukhngtngtccnngServertrong
khangthigianTimeoutquynhl5000ms
phnGrouptypechnmttrongnhngOptionsauyllaiServerskim
tra.
ActiveDirectory
DHCP
DNS
ISA Server 2006
Others
PublishedServers
Web(Internet)
TttnhnngKimtraktni
VoISAServerManagement,clickchnTabMonitoring.
TrongcasDetailPanechnTabConnectivityvchnConnectivityVerifier
nocnxa
TrnTabTask,clickchnDelete
XaConnectivityVerifiertrongISAManagementConsole.Ngaicchxa,nhquntrcth
ExportthnhXMLfilevsauclickDisablethayvDelete.
62. Qun l cc dch v ca ISA Server

ISAServercthStarthocStopdchvFirewallvRoutingandRemoteAccess
TrongDetailspane,clickServicestab.
Chnnhngdchvcnqunl:MicrosoftDataEngine,MicrosoftFirewall
service,hocMicrosoftISAServerJobSchedulerservice.
TrongTabTasks,clickStartSelectedServiceStartdchvhocclickStop
SelectedServicettdchvnudchangcm
575
SdngTaskPaneltrnISAServerttdchv
63. Qun l Server Performance

NhquntrcthsdngtnhnngPerformancetrongWindowsquanst
ccthnhphntrongISAServerthigianthc
VoISAServerPerformanceMonitortrongStartMenu
SdngSnapinPerformancetrnISAServerchophptheodiISAServertheothigianthc.Vic
theodinyrtcnthitchoccnhquntrbitctnhhnhhatngcaFirewall.
ISA Server 2006
Clickphivophnbiuangchytheothigianthc,clickchnAdd
Counter
ClickADDCOUNTERthmCountervoStatistics.Counterllaidliucnheodibng
PerformanceSnapin.
ChnnhngCounternocnthitcnthmvoqutrnhMonitor
577
ChnCountersthmvocasStatisticstheodi.NgidngcthclickExplaincgii
thchthmvCountercnthm.
ClickExplainbnscISAServergiithchCounterchcnnglmg
PerformanceckmtheogiithchchotngCoutersthmvotrongPerformancegipnhquntr
ddngquytnhkhithmCouter
ClickClosequayliviPerformanceMonitor
cgicthlulinidungcaPerformanceMonitorthnhmttrangweb
dnghtmlcthxemlisau.
ClickphilnmnhnhPerformancechnSaveas
ISA Server 2006
PerformanceSnapinchophpxutktquhinthtrnmnhnhStatisticscamnhthnhtptin
HTMbngchcnngSAVEAS
Clickchnngdntptinhtmlmunluli
TntptinHTMchngtisluliktqucaPerformancelPformance
ClickSave
579

Munxemlinidung,clickvofilehtmlvalu,mInternetExplorervt
ngviewngtptincnxem
XcnhtptinHTMcxutratSnapinPerformancekmtheocaISAServer.
VxemlinidungbngInternetExplorer,nidungltnhcxutrat
Performance
ISA Server 2006
TheoditnhhnhhatngcaISAServerbnggiaodinperformance.Tronghnhlktqu
cxutradngWeb.
VietCERT Co., Ltd

Linking People to Technology
Add1:18/161c2,TranQuangDieuStr,03Dist,HCMC,Vn
Add2:09,588Str,PhuocLongAWard,09Dist,HCMC,Vn
Tel: 8489319986, 9350582 Fax: 848 8435010
URL: http://www.VietCERT.com
Email: info@VietCERT.com
Taxcode:0303693120
Hotline:8490 8185013 Mr Toan
581

Isa 2006

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Isa 2006

Uploaded by

Copyright:

Available Formats

Mc lc

Mhnhchobithchnh ....................................................................... 102

CclaiClientscaISAServer2006 ....................................................... 102

Telecom Network Solutions

ImportccAccessRule .............................................................................. 216

PhntchcchNATcaNetworkRule ............................................... 221

Phntchcutrccamtgitin ........................................................... 226

PhnlaiccFirewall ................................................................................ 233

CuhnhPerimeterNetwork ................................................................... 234

CuhnhSystemPolicies .......................................................................... 240

CuhnhhthngInstrusionDetectionService ................................... 251

Bt/TtcctnhnngbomtchoIP ...................................................... 264

CuhnhDNSchoPublishingRule ........................................................ 272

ToWebPublishingRule .......................................................................... 273

ToSecureWebPublishingRule ............................................................. 289

CuhnhServerPublishingRule ............................................................. 289

PublishingcchthngServerMultiMedia .......................................... 297

CuhnhSMTPPublishingRule ............................................................. 311

CuhnhOWAPublishingRule .............................................................. 318

ISA Server 2006

CuhnhRPCPublishingRule ................................................................ 335

CuhnhPublishingRulechoClientssdngPOP3vIMAP4 ....... 339

TmhiuApplicationFiltertrnISAServer2006 ................................. 350

CuhnhHTTPWebFilter ....................................................................... 355

CuhnhFTP,SOCKSApplicationFilter ............................................... 366

Mhnhthchnh ..................................................................................... 374

CuhnhcpphtIPngchoVPNClients ......................................... 374

CuhnhAuthentication ........................................................................... 376

CuhnhUserAccountchoVPNClients ............................................... 378

CuhnhVPNtrnISAServer(ClienttoGateway) ............................. 383

TmhiuvCaching .................................................................................. 457

CuhnhISAServer2006thnhProxyServer ...................................... 459

CuhnhClientsdngISAlmProxyServer .................................... 467

ToCacheRule ........................................................................................... 476

CuhnhSchedulerDownloadJob ......................................................... 492

Telecom Network Solutions

TngquanvhthngMonitor .............................................................. 504

CuhnhAlert ............................................................................................ 507

SessionMonitor .......................................................................................... 520

MonitorConnectivities .............................................................................. 567

ISA Server 2006

Telecom Network Solutions

Ci t Web Server IIS 6.0

ISA Server 2006

Telecom Network Solutions

ISA Server 2006

Telecom Network Solutions

ISA Server 2006

Telecom Network Solutions

ISA Server 2006

Telecom Network Solutions

ISA Server 2006

Telecom Network Solutions

ISA Server 2006

Telecom Network Solutions

ISA Server 2006

Telecom Network Solutions

ISA Server 2006

Telecom Network Solutions

ISA Server 2006

Telecom Network Solutions

ISA Server 2006

Telecom Network Solutions