Configuring ISA outbound web listener.

In this tutorial I will show you why it is sometimes useful to change the out going web listener, and where you can change it. A listener is a port on the ISA server that is listening for TCP (transmission control protocol) connections. ISA server is configured by default to listen on port 8080 but most of the organizations I have dealt with are upgrading from either Microsoft Proxy or from another type of Fire walling product and they have quite a few web proxy clients that have a hard coded proxy setting within their Internet explorer browser.

In this window in Microsoft Internet explorer you can hard code the IP address of your ISA Server Also note the port number.

To get to the window displayed above Click tools > Internet options > Select Connections > Then select (LAN) settings.

When upgrading one of these types of companies I normally ask them if they are prepared to change all of the port numbers in the proxy settings of the web browser to 8080 and most of them would rather I change the port number to 80 on the ISA server. This in affect means the web proxy service will listen on port 80 and not the default port 8080. Please be aware that port 80 is the same port that is used by IIS. It is not recommended that you install IIS on your ISA server. If you install IIS make sure you configure IIS to use a port other than 80, the typical choice these days is 81.

To check what ports are listening on your ISA server you can use the built in command line utility called netstat. Netstat displays current TCP/IP protocol connections and statistics and is useful in seeing what machines are connected to your ISA server and which TCP/IP protocols the machines are using on what ports.

Here is an example of the netstat utility if you add the –a switch you can see all connections and listening ports.

To configure the listener on the ISA server you must Right click on the ISA server computer picture in the ISA MMC.

Then Click Properties.

You will then be presented with this window after you click Outgoing Web Requests.

To change the default listener port is quite simple. In the TCP port: dialog box type in the desired port number. In this example I have used port 80. Using the same window you can also change the SSL listener port. Most browsers use port 443 so I have left the port as the default port used. You can also configure Incoming Web Request in much the same way. The listeners IP address is also configured in this window. This is typically the Internal NIC of the ISA server if you are configuring Outgoing Web requests. Please note that you need to restart the Web Proxy service after changing the port number. I like to restart the whole machine I have always done this so I normally (bounce the box).

One very useful feature of the Outgoing Web requests page is that you can configure the number of connections allowed to the outbound listener and also the idle time allowed before the ISA server closes these connections. I find this very handy when setting up a head office environment with many branch offices. You are able to limit the users from bombarding your ISA server with requests because you have throttled them down, and they will only be able to make a specified number of connections.

You can do this by clicking on the configure… button in the Outgoing Web Requests window.

Summary: I have seen quite a few ISA installations with different outgoing port numbers. I would not recommend you changing the port number based on a security basis. What I mean by this is so that no one will guess what port the ISA is doing web proxy on. There are lots of sniffers out there that tell you what ports are listening. I would recommend you rather keep the port to the default port as everything seems to work better that way, then again its personal preference.