Creating and Configuring a New Array and Array Policy

Collections of ISA Server 2004 Enterprise Edition computers can be grouped into firewall arrays. A firewall array shares a common configuration and all computers within the array share a common firewall policy. ISA Server 2004 Enterprise Edition arrays can consist of two or more firewall devices. Arrays make it easy to configure multiple firewalls because a single firewall policy is applied to all array members.

The array concept may be confusing to ISA Server 2004 Standard Edition administrators who are not accustomed to configuring firewall policy for multiple computers through a unified management interface. Configuring array policy for an enterprise array is similar to configuring firewall policy for a single ISA Server 2004 Standard Edition computer. The primary difference is that when configuring enterprise array policy, the same policy is applied to all computers in the array. In contrast, when you configure firewall policy on an ISA Server 2004 Standard Edition computer, policy is applied only to a single computer.

Note that while firewall policy is automatically applied to all computers in an array, there are some configuration options that do not lend themselves to array-level configuration. The ISA Server 2004 Enterprise Edition management interface informs you when you encounter one of these per-server configuration options and allows you to make the appropriate per-server settings when required.

You must create ISA Server 2004 Enterprise Edition arrays because there are no default arrays. In this section, you will perform the following ISA Server 2004 Enterprise Edition array-related tasks:

• Create a new array. There are no default arrays, so you must create a new array to which you will apply firewall policy.
• Configure array properties. There are many characteristics that define an array. The first step after creating a new array is to define these array-specific characteristics, such as addresses used for intra-array communications.
• Create the intra-array network. Each array member in the sample network used in this ISA Server 2004 Enterprise Edition Quick Start Guide has three network interfaces. One network interface is connected to the default External network, another interface is connected to the default Internal network, and the third interface is connected to a network dedicated to intra-array communications. This intra-array communications network is required because you will later enable Network Load Balancing (NLB) for the array. A dedicated network adapter is required because ISA Server 2004 Enterprise Edition integrated NLB uses only unicast mode NLB.
• Configure the Enterprise Remote Management Computers computer set. After creating the array, several network objects are included by default. One of these network objects is the Remote Management Computers computer set. You will need to add the Configuration Storage server, on which you will run the ISA Server 2004 Enterprise Edition management console, to this computer set so that it can manage computers in the ISA Server 2004 Enterprise Edition array.
• Create an array access rule. In this section, you will create an HTTP-only access rule to demonstrate how to create an array-level rule, and then demonstrate how enterprise and array policies interact.
• Move the enterprise access rule below the array access rule. You can move enterprise rules above and below array-level access rules. This section demonstrates how to do this.
• Back up the enterprise configuration. ISA Server 2004 Enterprise Edition allows you to easily back up and restore your enterprise configuration. This section demonstrates procedures for backing up the enterprise configuration.
• Back up the array configuration. In addition to making it easy to back up the enterprise firewall policy, ISA Server 2004 Enterprise Edition makes it easy to back up the array-level policy. This section demonstrates how to back up the array policy.

Create a New Array

The first step is to create a new array. You can create one or more arrays in the ISA Server 2004 Enterprise Edition console from a single management workstation. There is never a need to use RDP to manage the firewall configuration on any array member computer. Perform the following steps to create the new enterprise array:

1. In the ISA Server 2004 Enterprise Edition console, click the Arrays node in the left pane of the console. Click the Tasks tab in the task pane and click Create New Array.
2. On the Welcome to the New Array Wizard page, enter a name for the new array in the Array name text box. In this example, you name the array NEWARRAY. Click Next.
3. On the Array DNS Name page, enter the fully qualified domain name that Firewall clients and Web Proxy clients should use when connecting to the array. In this example, you enter newarray.msfirewall.org. You should create Host (A) records in the Internal network DNS that map the internal IP address of each array member to this name. Enter newarray.msfirewall.org in the Array’s DNS name text box and click Next.
   
4. On the Assign Enterprise Policy page, in Apply this enterprise policy to the new array, select Enterprise Policy 1. Click Next.
   
5. On the Array Policy Rule Types page, select the type of array firewall policy rules that an array administrator can create for the array. This option enables the enterprise administrator to limit the scope of rule types that an array administrator can create and helps centralize control over network firewall security policy. In this example, select the "Deny" access rules, "Allow access" rules, and Publishing rules (Deny and Allow) check boxes. Click Next.
   
6. On the Completing the New Array Wizard page, click Finish.
7. In the Create New Array dialog box, click OK when the array is successfully created.
   

Configure Array Properties

In the left pane of the ISA Server 2004 Enterprise Edition console, expand the Arrays node, expand the NEWARRAY node, and then expand the Configuration node. With each of these nodes expanded, you can see all nodes and subnodes used to configure the array. The first step is to configure the general properties of the array. Perform the following steps to configure the array properties:

1. Click the NEWARRAY node in the left pane of the console, and then click the Tasks tab in the task pane. On the Tasks tab, click Configure Array Properties.
2. The first tab you see in the NEWARRAY Properties dialog box is the General tab. There is nothing you need to configure on this tab.
3. Click the Policy Settings tab. On the Policy Settings tab, you can change the enterprise policy assigned to the array. You can also change the array firewall policy rule types that can be configured on this array. In this example, you do not make any changes on this tab.
   
4. Click the Configuration Storage tab. On the Configuration Storage tab, you can enter the name of the Configuration Storage server in Configuration Storage server (enter the FQDN). This value is entered by default during installation of the Configuration Storage server. You can also enter an alternate Configuration Storage server in Alternate Configuration Storage server (optional). Configuring an alternate Configuration Storage server provides fault tolerance in the event that the default Configuration Storage server is not available. Array members check the Configuration Storage server for updated policy based on the setting in the Check the Configuration Storage server for updates every box. The default is every 15 seconds, but you can configure the update interval to be any value. In this example, you do not make any changes on the Configuration Storage tab.
   
5. On the Intra-Array Credentials tab, you configure the method for which credentials an array member should use when performing intra-array communications. Because all array members and the Configuration Storage server are members of the same domain, the default setting is Authenticate using the computer account of the array member. If all computers were not members of the same or trusted Active Directory domain, you would select the Authenticate using this account (for workgroup configuration only) option. In this example, you do not make any changes on the Intra-Array Credentials page.
   
6. Click the Assign Roles tab. On the Assign Roles tab, you configure the users and groups that are allowed management roles for this array. Click the Add button on the Assign Roles tab. Use the Browse button to select a user or group to which you want to assign an array management role. Click the drop-down arrow for the Role list. You can assign users or groups to one of the following array roles: ISA Server Array Administrator, ISA Server Array Auditor, or ISA Server Array Monitoring Auditor. In this example, you assign the MSFIREWALL\Domain Admins group the ISA Server Array Administrator role. Click OK.
   
7. Click Apply, and then click OK in the NEWARRAY Properties dialog box.
   

Create the Intra-Array Network

Each member in the array on our example network has a third network adapter installed that is dedicated to intra-array communications. This is required because later you will enable ISA Server 2004 Enterprise Edition integrated Network Load Balancing (NLB) within the array. ISA Server 2004 Enterprise Edition NLB uses only unicast mode NLB. To prevent issues related to unicast mode NLB, you need a network interface dedicated to intra-array communications.

The ISA Server firewall array members consider all addresses that are not part of a defined ISA Server firewall network to be part of the default External network. To prevent routing errors, you must create an ISA Server firewall network definition for the intra-array network. Perform the following steps to create the intra-array network:

1. In the ISA Server 2004 Enterprise Edition console, click the Networks node located under the Configuration node. Click the Tasks tab in the task pane and click Create a New Network.
2. On the Welcome to the New Network Wizard page, enter a name for the new network in the Network name text box. In this example, you name the new network Intra-array Network. Click Next.
3. On the Network Type page, select the Perimeter Network option and click Next.
   
4. On the Network Addresses page, you configure the addresses used on the intra-array network. You can use the Add Range, Add Adapter, or Add Private buttons to add the address range defining the network. However, you are not able to use the Add Adapter button in this example, because there are no computers assigned to the array yet. Because there are no computers assigned to the array, the Configuration Storage server does not have information about the array member adapters. In this example, click the Add Range button.
   
5. In the IP Address Range Properties dialog box, enter the first and last addresses in the range in the Start address and End address text boxes. In this example, enter a Start address of 222.222.222.0 and an End address of 222.222.222.255. Click OK.
   
6. Click Next on the Network Addresses page.
   
7. Click Finish on the Completing the New Network Wizard page.

Configure the Enterprise Remote Management Computers Computer Set

To manage the enterprise array computers from a management station running the ISA Server 2004 Enterprise Edition console, the management station must be added to the Enterprise Remote Management Computers computer set. This computer set network object is created for you automatically. You only need to add the address of your management station to the computer set. In this example, you will add the IP address of the Configuration Storage server to this computer set. Perform the following steps to add the Configuration Storage server to the Enterprise Remote Management Computers computer set:

1. In the ISA Server 2004 Enterprise Edition console, click the Enterprise Policy 1 node in the left pane of the console. In the task pane, click the Toolbox tab.
2. On the Toolbox tab, click Network Objects. On the Network Objects tab, expand the Computer Sets folder.
3. Double-click the Enterprise Remote Management Computers computer set.
4. In the Enterprise Remote Management Computers Properties dialog box, click the Add button, and then click the Computer menu item.
   
5. In the New Computer Rule Element dialog box, enter a name for the management station in the Name text box. In this example, you name the entry Enterprise Management Station. In the Computer IP Address text box, enter the IP address of the management station. In this example, the IP address of the management station is 10.0.0.4, so enter 10.0.0.4 in the text box. Click OK.
   
6. Click Apply, and then click OK in the Enterprise Remote Management Computers Properties dialog box.

Create an Array Access Rule

To demonstrate the interactions between enterprise policy and array policy access rules, you will create an access rule in the array policy allowing outbound access only to HTTP. Perform the following steps to create the HTTP-only access rule:

1. In the ISA Server 2004 Enterprise Edition console, expand the Arrays node, and then expand the NEWARRAY node. Click the Firewall Policy (NEWARRAY) node in the left pane of the console.
2. Click the Tasks tab in the task pane, and then click Create Array Access Rule.
3. On the Welcome to the New Access Rule Wizard page, enter a name for the access rule in the Access rule name text box. In this example, you name the rule Array – HTTP only. Click Next.
4. On the Rule Action page, select the Allow option and click Next.
5. On the Protocols page, confirm that the Selected protocols option is selected in the This rule applies to list, and then click the Add button.
6. In the Add Protocols dialog box, expand the Common Protocols folder. Double-click HTTP and click Close.
   
7. Click Next on the Protocols page.
   
8. On the Access Rule Sources page, click the Add button.
9. In the Add Network Entities dialog box, expand the Enterprise Networks folder, and then double-click Enterprise Internal. Click Close.
   
10. Click Next on the Access Rule Sources page.
    
11. On the Access Rule Destinations page, click the Add button.
12. In the Add Network Entities dialog box, expand the Networks folder, and then double-click the External network. Click Close.
13. Click Next on the Access Rule Destinations page.
14. On the User Sets page, accept the default entry All Users and click Next.
15. Click Finish on the Completing the New Access Rule Wizard page.
16. The array firewall policy should now look like the display in the following figure.
    

Move the Enterprise Access Rule Below the Array Access Rule

You can move enterprise access rules contained in the enterprise policy assigned to the array to be evaluated either before or after array-level rules on a per-rule basis. To do this, you must change the enterprise rule’s position in the enterprise policy configuration.

Perform the following steps to move the enterprise access rule:

1. Click the Enterprise Policy 1 node in the left pane of the ISA Server 2004 Enterprise Edition console. The following figure shows the configuration of the current enterprise policy.
   
2. Click the Enterprise All Open access rule and click the Move Down button (represented by a down-pointing blue arrow in the MMC button bar). The enterprise policy now looks like what appears in the following figure.
   
3. Click the Firewall Policy (NEWARRAY) node in the left pane of the console. You can see that the Enterprise All Open access rule now appears below the array policy rule.
   
4. Return to the Enterprise Policy 1 node and move the Enterprise All Open access rule to the top of the list. Later in this ISA Server 2004 Enterprise Edition Quick Start Guide, you will test the effects of moving enterprise policy access rules.
5. The basic enterprise and array configuration is now complete. Click the Apply button to save the changes to the firewall policy.
   
6. Click OK in the Apply New Configuration dialog box when the configuration is successfully applied.

Back Up the Enterprise Configuration

At this point, you are ready to back up the Enterprise Policy configuration. The enterprise policy can be backed up to an .xml file and that file can be used to restore enterprise policy in the event of a disaster causing loss of the Configuration Storage server. Perform the following steps to back up the enterprise configuration:

1. In the ISA Server 2004 Enterprise Edition console, click the Enterprise node in the left pane of the console. Click the Tasks tab in the task pane, and then click Export Enterprise Configuration.
2. Click Next on the Welcome to the Export Wizard page.
3. On the Export Preferences page, select the Export user permission settings check box and click Next.
4. On the Export File Location page, enter a path and name for the enterprise configuration backup file. In this example, enter C:\enterprise_config in the Save the data to this file (enter the full path) text box. Click Next.
   
5. Click Finish on the Completing the Export Wizard page.
6. Click OK after the dialog box appears informing you that the export was successful.

Back Up the Array Configuration

You should also back up the array configuration at this point. Perform the following steps to back up the array configuration to an .xml file that you can use to later restore the array in the event that the Configuration Storage server is lost:

1. In the ISA Server 2004 Enterprise Edition console, click the NEWARRAY node in the left pane of the console. Click the Tasks tab in the task pane, and then click Export (Back Up) Array Configuration.
2. Click Next on the Welcome to the Export Wizard page.
3. On the Export Preferences page, select the Export confidential information and Export user permission settings check boxes. Enter a password and confirm the password in the Password and Confirm password text boxes. Click Next.
   
4. On the Export File Location page, enter a path and file name for the array backup file. In this example, enter C:\array_backup. Click Next.
   
5. Click Finish on the Completing the Export Wizard page.
6. Click OK after the dialog box appears informing you that the export was successful.

[Topic Last Modified: 02/26/2008]