ISA Server 2000 Quick Start Guide

This Quick Start Guide makes the following assumptions about the Windows 2000 or Windows Server 2003 computer you will be installing the ISA Server 2000 firewall software onto:

Your network will be protected from outside intruders, and your computers will be able to access the Internet, after you complete the procedures in this guide. This Quick Start Guide’s goal is just that: to get you started quickly. The next step, after your firewall is configured and the computers on your network can access the Internet, is to learn about your ISA Server 2000 firewall in more detail. Please see the

ISA Server 2000 Resources section at the end of this document.

Throughout this Quick Start Guide we will refer to internal and external interfaces. The internal interface is the Ethernet card connecting the ISA Server 2000 firewall computer to your private network or LAN. The external interface is a network interface connecting you to the Internet. This external interface can be an Ethernet card, a modem or even a broadband router.

shows the ISA Server 2000 firewall and its relationship to the internal and external networks. The internal interface is an Ethernet card connected to a hub or switch on the internal network and the external interface is an Ethernet card or a modem connecting the ISA Server 2000 firewall to the Internet.

The rest of this Quick Start Guide walks you through each of these steps. Separate sets of instructions are included for Windows 2000 and Windows Server 2003 systems when the procedures differ between the two operating systems. Go to the section in each step applying to your operating system.

The external interface configuration varies depending on the type of interface used to connect to the Internet. There are two primary types of external interfaces:

ISP’s offer “business accounts” that provide a permanent, statically assigned IP address. Hobbyist or home accounts are usually assigned a non-permanent address. Dial-up modem connections, (with the exception of ISDN dial-up connections), usually are assigned non-permanent IP addresses. In this section you’ll see how to configure each connection type.

There are four common situations where you use an Ethernet card on the external interface of the ISA Server 2000 firewall computer:

shows the relationship between the ISA Server 2000 firewall computer and the broadband router.

Setting up a Dial-up Connection section. Do not perform the following steps on configuring the external interface if you use a dial-up connection to connect to the Internet.

The most common situation where an Ethernet card is used on the external interface with a non-permanent IP address is when the Ethernet card is a cable or DSL modem, or it connects to a DSL or cable modem. Your DSL or cable provider will inform you if you have a permanent or non-permanent address.

Perform the following steps if your external interface uses a non-permanent IP address:

1. Right click on the My Network Places icon on the desktop and click the Properties command.
2. In the Network Connections window, right click on the external network interface and click the Properties command.
3. In the network interface’s Properties dialog box, click the Internet Protocol (TCP/IP) entry and then click the Properties button.
4. In the Internet Properties (TCP/IP) Properties dialog box, select the Obtain an IP address automatically option.

   

5. Select the Use the following DNS server addresses option. Enter the IP address of the internal interface in the Preferred DNS server text box. Click OK in the Internet Protocol (TCP/IP) Properties dialog box.
6. Click OK in the internal interface’s Properties dialog box.

Perform the following steps to change the network interface order:

1. Right click on the My Network Places icon on the desktop and click the Properties command.
2. In the Network and Dial-up Connections window, click the Advanced menu, then click the Advanced Settings command.
3. In the Advanced Settings dialog box, click on the internal interface in the list of Connections on the Adapters and Bindings tab. After the internal interface is highlighted, click the up-arrow to move the internal interface to the top of the list of interfaces.

   

4. Click OK in the Advanced Settings dialog box.

Perform the following steps on the Windows 2000 computer to create the dial-up connectoid that connects the machine to the Internet:

1. Right click the My Network Places icon on the desktop and click the Properties command.
2. In the Network and Dial-up Connections window, double click on the Make New Connection icon.
3. In the Location Information dialog box, enter your area code and access number if required. Click OK.
4. Click OK in the Phone and Modem Options dialog box.
5. Click Next on the Welcome to the Network Connection Wizard page.
6. Select the Dial-up to the Internet option on the Network Connection Type page and click Next.
7. On the Welcome to the Internet Connection Wizard page, select the I want to set up my Internet connection manually, or I want to connect through a local area network (LAN) option and click Next.
8. Select the I connect through a phone line and a modem option on the Setting up you Internet connection page and click Next.
9. On the Step 1 of 3: Internet account connection information page, type in the correct Area code and Telephone number for your ISP Internet connection. Click Next.
10. On the Step 2 of 3: Internet account logon information page, type in the User name and Password provided to you by your ISP and click Next.
11. On the Step 3 or 3: Configuring your computer page, type in a Connection name. For example, name the connection ISP Internet Link. Click Next.
12. Select No on the Set Up Your Internet Mail Account page and click Next.
13. Click Finish on the Completing the Internet Connection Wizard page.
14. The ISP Internet Link entry now appears in the Network and Dial-up Connections window and it has a telephone icon associated with it.
15. Right click the ISP Internet Link and click the Properties command. In the ISP Internet Link Properties dialog box, click on the Options tab. If you want the link to automatically redial if the connection is dropped, put a checkmark in the Redial if line is dropped checkbox. You can then configure the Redial attempts and Time between redial attempts to meet your preferences. The default Idle time before hanging up value is set to never. If you want the modem to drop a connection after an idle period, change this value.

    NOTE:

    
    Modem networks and applications require frequent connections to the Internet. You should anticipate that the dial-up connection will remain connected most of the time as internal network hosts connect to the Internet at any time of day for a variety of reasons.
    

Perform the following steps on the Windows Server 2003 computer to create the dial-up connectoid that connects the machine to the Internet:

1. Right click the My Network Places icon on the desktop and click the Properties command.
2. In the Network Connections window, double click on the New Connection Wizard icon.
3. Click Next on the Welcome to the New Connection Wizard page.
4. On the Network Connection Type page, select the Connect to the Internet option and click Next.
5. On the Internet Connection page, select the Connect using a dial-up modem option and click Next.
6. On the Connection Name page, type ISP Internet Link in the ISP Name text box and click Next.
7. On the Phone Number to Dial page, type the area code and phone number you use to connect to the ISP in the Phone number text box and click Next.
8. On the Connection Availability page, select the Anyone’s use page and click Next.
9. On the Internet Account Information page, type in the User name and Password provided to you by your ISP. Confirm the password in the Confirm password text box. Place checkmarks in the Use this account name and password when anyone connect to the Internet from this computer and Make this the default Internet connection checkboxes. Remove the checkmark from the Turn on Internet Connection Firewall for this connection checkbox. Click Next.
10. Click Finish on the Completing the New Connection Wizard page.
11. The Connect ISP Internet Link dialog box appears. Click the Properties button.
12. On the ISP Internet Link Properties dialog box, click on the Options tab. If you want the connection to automatically redial if the link is dropped, put a checkmark in the Redial if line is dropped checkbox. You can configure custom Redial attempts and Time between redial attempts values if you select this option. If you want the connection to drop after a period of idleness, then change the value in the Idle time before hanging up list box. If you do not want the link to drop, select the never option in the idle time drop down list. Click OK after making the changes.
13. Close the Connect ISP Internet Link dialog box.

    NOTE:

    
    Modem networks and applications require frequent connections to the Internet. You should anticipate that the dial-up connection will remain connected the most of the time as internal network hosts connect to the Internet at any time of day for a variety of reasons.
    

Perform the following steps to install the DNS Server service on a Windows 2000 computer:

1. Click Start point to Settings and click Control Panel.
2. In the Control Panel window, double click on the Add/Remove Programs entry.
3. In the Add/Remove Programs window, click on the Add/Remove Windows Components button.
4. In the Windows Components Wizard dialog box, select the Networking Services entry in the list of Components. Do not put a checkmark in the checkbox! After highlighting the Networking Services entry, click the Details button.
5. In the Networking Services dialog box, put a checkmark in the Domain Name System (DNS) checkbox and click OK.

   

6. Click Next in the Windows Components dialog box.
7. If terminal services is enabled on the machine, click Next in the Terminal Service Setup dialog box.
8. Click OK in the Insert Disk dialog box. In the Files Needed dialog box, provide a path to the i386 folder in the Copy files from text box, then click OK.
9. Click Finish in the Completing the Windows Components Wizard page.
10. Click Close in the Add/Remove Programs window.

Perform the following steps to install the DNS Server service on a Windows 2000 computer:

1. Click Start point to Control Panel and click Add or Remove Programs.
2. In the Add or Remove Programs window, click on the Add/Remove Windows Components button.
3. In the Windows Components Wizard dialog box, select the Networking Services entry in the list of Components. Do not put a checkmark in the checkbox! After highlighting the Networking Services entry, click the Details button.
4. In the Networking Services dialog box, put a checkmark in the Domain Name System (DNS) checkbox and click OK.

   

5. Click Next in the Windows Components dialog box.
6. Click OK in the Insert Disk dialog box. In the Files Needed dialog box, provide a path to the i386 folder in the Copy files from text box, then click OK.
7. Click Finish in the Completing the Windows Components Wizard page.
8. Close

the Add or Remove Programs window.

The DNS Server on the ISA Server 2000 firewall machine performs DNS queries for Internet host names on the behalf of computers on the internal network. The DNS Server on the ISA Server 2000 firewall is configured as a caching-only DNS server. A caching-only DNS Server does not contain information about your public or private DNS names. The caching-only DNS Server can resolve Internet host names and cache the results, but it does not answer DNS queries for names on your private internal network DNS zone or your public DNS zone.

However, if you have an internal network DNS server to support an Active Directory domain, you can configure the caching-only DNS server located on the ISA Server 2000 firewall to refer requests to your internal network domain to the DNS server on your internal network. The bottom line is that the caching-only DNS server on the ISA Server 2000 firewall computer will not interfere with your current DNS server setup (if you have one already).

In this section we provide instructions on how to configure the DNS Server service on Windows 2000 and Windows Server 2003 computers.

Perform the following steps to configure the DNS service on the Windows 2000 computer:

1. Click Start, point to Programs and point to Administrative Tools. Click on the DNS entry in the Administrative Tools menu.
2. Expand all nodes in the left pane of the DNS console. Right click on your server name, point to View and click on Advanced.
3. Right click on the server name in the left pane of the console and click the Properties command.
4. In the server Properties dialog box, click on the Interfaces tab. Select the Only the following IP addresses option. Click on any IP address in the list of IP addresses that is not the IP address on the internal interface. Select this non-internal interface IP address and click the Remove button. Click Apply.
5. Click on the Forwarders tab. Put a checkmark in the Enable forwarders checkbox. Type in the IP address of your ISP’s DNS server in the IP address text box and click Add. Put a checkmark in the Do not use recursion checkbox. Click Apply and the click OK.

   

6. Right click on the server name in the left pane of the console, point to All Tasks and click on Restart.

Perform the following steps only if you have an internal network Active Directory domain and an existing DNS server on the internal network:

WARNING:

DO NOT perform the following steps if you do not already have a DNS server on your internal network. These steps are only for those networks already using Windows 2000 or Windows Server 2003 Active Directory domains.

The DHCP Server service can be installed on Windows 2000 and Windows Server 2003 computers. The procedure varies slightly between the two operating systems. In this section we discuss procedures for installing DHCP Server service on Windows 2000 and Windows Server 2003 computers.

Perform the following steps to install the DHCP Server service on a Windows 2000 computer:

1. Click Start point to Settings and click Control Panel.
2. In the Control Panel window, double click on the Add/Remove Programs entry.
3. In the Add/Remove Programs window, click on the Add/Remove Windows Components button.
4. In the Windows Components Wizard dialog box, select the Networking Services entry in the list of Components. Do not put a checkmark in the checkbox! After highlighting the Networking Services entry, click the Details button.
5. In the Networking Services dialog box, put a checkmark in the Dynamic Host Configuration Protocol (DHCP) checkbox and click OK.

   

6. Click Next in the Windows Components dialog box.
7. If terminal services is enabled on the machine, click Next in the Terminal Service Setup dialog box.
8. Click Finish in the Completing the Windows Components Wizard page.
9. Click Close in the Add/Remove Programs window.

Perform the following steps to install the DNS Server service on a Windows 2000 computer:

1. Click Start point to Control Panel and click Add or Remove Programs.
2. In the Add or Remove Programs window, click on the Add/Remove Windows Components button.
3. In the Windows Components Wizard dialog box, select the Networking Services entry in the list of Components. Do not put a checkmark in the checkbox! After highlighting the Networking Services entry, click the Details button.
4. In the Networking Services dialog box, put a checkmark in the Dynamic Host Configuration Protocol (DHCP) checkbox and click OK.

   

5. Click Next in the Windows Components dialog box.
6. Click Finish in the Completing the Windows Components Wizard page.
7. Close

the Add or Remove Programs window.

The DHCP Server must be configured with a collection of IP addresses it can assign to computers on your network. The DHCP Server also provides other networking information to your computers, such as a DNS Server and default gateway addresses. The DNS server and default gateway addresses for your computers will be the IP address on the internal interface of the ISA Server 2000 firewall. The DHCP server uses a DHCP scope to provide this information to the internal network clients. You will create a DHCP scope that provides the correct information.

The procedure varies slightly for Windows 2000 and Windows Server 2003 computers. We will discuss each configuration in this section.

Perform the following steps to install ISA Server 2000 on the Windows 2000 computer:

1. Double click on the ISAAutorun.exe file in the ISA Server 2000 share point or allow the ISA Server 2000 CD-ROM to autorun.
2. Click the Install ISA Server icon on the initial Microsoft ISA Server Setup page.
3. Click Continue on the Welcome to the Microsoft ISA Server installation program page.
4. Enter your CD key on the CD Key page and click OK.
5. Click OK on the page showing your registration number.
6. Click I Agree on the License Agreement page.
7. Click the Full Installation button on the Installation Type page.

   

8. Click Yes on the dialog box informing that the ISA Server schema has not been installed in the Active Directory.
9. Select Integrated Mode in the mode type page. Click Continue.

   

10. Click OK in the dialog box informing that IIS W3SVC service must be stopped.
11. On the cache size page, select an NTFS formatted drive and then type 150 in the Cache size (MB) text box. Click Set, then click OK.
12. Click the Construct Table button on the LAT configuration page.
13. In the Local Address Table dialog box, remove the checkmark from the Add the following private ranges… checkbox. Confirm that there is a checkmark in the Add address ranges based on the Windows 2000 Routing Table checkbox. Put a checkmark in the checkbox next to the internal interface network interface card. Click OK.

The next step is to install ISA Server 2000 Service Pack 1:

1. From another computer that has Internet access, go to http://www.microsoft.com/isaserver/downloads/default.asp and download ISA Server 2000 Service Pack 1. Scan the download for viruses and copy the file to the ISA Server 2000 firewall computer. (The computer you download the file from can not be behind the ISA Server 2000 firewall because the firewall does not allow access to the Internet yet.)
2. Double click on the isasp1.exe file.
3. On the Choose Directory for Extracted Files dialog box, enter C:\ISASP1 in the Choose Directory for Extracted Files text box. Click OK.
4. Click I Agree in the Microsoft ISA Server 2000 Service Pack dialog box.
5. Click OK in the dialog box informing that the update was successful and that the system must be restarted.
6. When the system restarts, download the ISA Server 2000 Feature Pack 1 file isafp1.exe from http://www.microsoft.com/isaserver/downloads/default.asp and scan the file for viruses. Copy the file to the ISA Server 2000 firewall and double click it. (The computer you download the file from can not be behind the ISA Server 2000 firewall because the firewall does not allow access to the Internet yet.)
7. In the Choose Directory for Extracted Files dialog box, type C:\ISAFP1 in the Choose Directory for Extract Files text box and click OK.
8. Click I Agree on the License Agreement page.
9. Remove the checkmark from the Read about ISA Server Feature Pack 1 checkbox and click OK.

IIS services should be disabled on the firewall for security and performance reasons. Perform the following steps to disable IIS services on the ISA Server 2000 firewall:

1. Click Start, point to Programs and point to Administrative Tools. Click the Services entry.
2. Locate the following services in the Services console:

   FTP Publishing Service

   Network News Transport Protocol (NNTP)

   Simple Mail Transport Protocol (SMTP)

   World Wide Web Publishing Service

3. Perform the following steps for each of these services:

   a. Right click on the service and click Properties.

   b. In the Startup type drop down list, select the Manual entry.

   c. Click the Stop button.

   d. Click Apply and click OK.

None of these services will start automatically when the ISA Server 2000 firewall machine restarts. The ISA Server 2000 firewall software is now installed and ready to be configured for secure Internet access.

The next step is to install ISA Server 2000 Service Pack 1:

1. Go to http://www.microsoft.com/isaserver/downloads/default.asp and download ISA Server 2000 Service Pack 1. Scan the download for viruses and copy the file to the ISA Server 2000 firewall computer. (The computer you download the file from can not be behind the ISA Server 2000 firewall because the firewall does not allow access to the Internet yet.)
2. Double click on the isasp1.exe file.
3. On the Choose Directory for Extracted Files dialog box, enter C:\ISASP1 in the Choose Directory for Extracted Files text box. Click OK.
4. Click I Agree in the Microsoft ISA Server 2000 Service Pack dialog box.
5. Click OK in the dialog box informing that the update was successful and that the system must be restarted.

There is a hotfix required to allow all ISA Server 2000 services to work properly in Windows Server 2003. Perform the following steps to install this hotfix:

1. Go to the http://www.microsoft.com/isaserver/ site and click the link to download required updates for Windows Server 2003. Scan the file for viruses and then copy the isahf255.exe file to the ISA Server 2000 firewall. Double click on the file. (The computer you download the file from can not be behind the ISA Server 2000 firewall because the firewall does not allow access to the Internet yet.)
2. In the Choose Directory for Extracted Files dialog box, type in C:\isa255 in the Choose Directory For Extract Files text box and click OK.
3. Click I Agree in the Microsoft ISA Server 2000 Update dialog box.
4. Click OK in the Microsoft ISA Server 2000 Update Setup dialog box informing that ISA Server 2000 has been successfully updated.

ISA Server 2000 Feature Pack 1 contains important hotfixes and enhancements. All ISA Server 2000 firewalls should have ISA Server 2000 Feature Pack 1 installed on them. Perform the following steps to install ISA Server 2000 Feature Pack 1:

1. Download the ISA Server 2000 Feature Pack 1 file isafp1.exe from http://www.microsoft.com/isaserver/downloads/default.asp and scan the file for viruses. Copy the file to the ISA Server 2000 firewall and double click it. (The computer you download the file from can not be behind the ISA Server 2000 firewall because the firewall does not allow access to the Internet yet.)
2. In the Choose Directory for Extracted Files dialog box, type C:\ISAFP1 in the Choose Directory for Extract Files text box and click OK.
3. Click I Agree on the License Agreement page.
4. Remove the checkmark from the Read about ISA Server Feature Pack 1 checkbox and click OK.

The ISA Server 2000 firewall software is now installed and ready to be configured for secure Internet access.

ISA Server 2000 configuration is the same for both Windows 2000 and Windows Server 2003. From this point onward, the same procedures apply to ISA Server 2000 firewall software installed on both Windows 2000 and Windows Server 2003.

The goal is to provide Internet access for all the computers on the internal network while protecting the internal network from external intruders. The following procedures insure internal network computers have the greatest level of Internet access with the best possible performance without requiring more advanced configuration.

The ISA Server 2000 firewall has a built-in packet filter that can allow the firewall to obtain a non-permanent IP address for a cable or DSL connections. This filter does NOT apply to dial-up connections. If your external interface uses DHCP to obtain an IP address, then you must enable the DHCP packet filter. Perform the following steps to enable the DHCP packet filter:

1. Click Start and point to Programs. Point to Microsoft ISA Server and click the ISA Management entry.
2. In the ISA Management console, expand the Servers and Arrays node and then expand the server name. Expand the Access Policy node and click on IP Packet Filters.
3. In the right pane of the ISA Management console you will see the DHCP Client packet filter. This packet filter is disabled by default. You must enable this packet filter to allow the external interface of the ISA Server 2000 firewall to obtain an IP address. Double click on the DHCP Client packet filter. On the General tab, put a checkmark in the Enable checkbox. Click Apply and then click OK.

   

4. Open a command prompt window on the ISA Server 2000 firewall computer, type ipconfig /renew and press ENTER. You should be able to successfully renew your IP address.

Protocol Rules allow internal network computers access to specific application protocols when connecting to Internet servers. Examples of such protocols include the HTTP protocol that allows you to connect to Web servers and the FTP protocol that allows you to connect to FTP servers. You will create an “All IP Traffic” Protocol Rule that allows your network computers access to all Internet network protocols included in the Protocol Definitions node in the ISA Management console. Perform the following steps to create the Protocol Rule:

WARNING:

This configuration allows your network computers to access almost all content available on the Internet. However, there are some Internet applications that require special configuration. If you find that there are Internet applications that do not work for you, please refer to the ISA Server 2000 Resources section for helpful information on solving the problem.

Perform the following steps to disable the HTTP Redirector Filter:

1. Open the ISA Management console, expand the Servers and Arrays node, and then expand your server name. Expand the Extensions node and then click the Application Filters node.
2. In the right pane of the console, double click on the HTTP Redirector Filter entry.
3. In the HTTP Redirector Filter Properties dialog box, remove the checkmark from the Enable this filter checkbox. Click Apply and then click OK.

   

4. In the ISA Sever Warning dialog box, select the Save the changes and restart the service(s) option and click OK.

An ISA Server 2000 firewall computer using a dial-up connection to connect to the Internet requires a Dial-up Entry in the ISA Management console. The Dial-up entry depends on the Dial-up Networking connectoid you configured for your dial-up connection. Perform the following step to configure the Dial-up entry in the ISA Management console:

1. Open the ISA Management console, expand the Servers and Arrays node and expand your server name. Expand the Policy Elements node and click on the Dial-up Entries node. Right click the Dial-up Entries node, point to New and click Dial-up Entry.
2. In the New Dial-up Entry dialog box, type ISP in the Name text box.
3. Click the Select button. In the Select Network Dial-up Connection dialog box, select the dial-up connectoid you use to connect to your ISP and click OK.
4. Click the Set Account button. In the Set Account dialog box, type in the user name your ISP has assigned to your dial-up account. Type in the password your ISP has assigned to your account in the Password text box and confirm the password in the Confirm password text box. Click OK.
5. Click OK in the New Dial-up Entry dialog box.
6. Right click on the Network Configuration node in the left pane of the ISA Management console and select the Use primary connection option. In the Network Configuration Properties dialog box, put a checkmark in the Use dial-up entry checkbox.
7. Click Apply and then click OK in the Network Configuration Properties dialog box.

Internal network computers are set up as ISA Server SecureNAT clients. A SecureNAT client is a machine with a default gateway address set to an IP address of a network device that routes Internet-bound requests to the internal IP address of the ISA Server 2000 firewall.

When internal network computers are on the same network ID as the internal interface of the ISA Server 2000 firewall, then the default gateway of the internal network computers is set as the internal IP address on the ISA Server 2000 firewall machine. This is how the DHCP scope on the DHCP server located on the ISA Server 2000 firewall is configured.

In this section we configure internal network computers that are on the same network ID as the internal interface of the ISA Server 2000 firewall and clients that may be located on network IDs that are not on the same network ID. This latter configuration is more common on larger networks that have more than one network ID on the internal network.

Internal network clients should be configured as DHCP clients. The DHCP client is able to request IP addressing information from a DHCP server. In this section you will see how to configure the Windows 2000 client as a DHCP client. The procedure is similar for all Windows-based clients. Perform the following steps to configure the internal network client and a DHCP client:

1. Right click on the My Network Places icon on the desktop and click the Properties command.
2. In the Network Connections window, right click on the external network interface and click the Properties command.
3. In the network interface’s Properties dialog box, click the Internet Protocol (TCP/IP) entry and then click the Properties button.
4. In the Internet Properties (TCP/IP) Properties dialog box, select the Obtain an IP address automatically option.

   

5. Select the Use the following DNS server addresses option. Enter the IP address of the internal interface in the Preferred DNS server text box. Click OK in the Internet Protocol (TCP/IP) Properties dialog box.
6. Click OK in the internal interface’s Properties dialog box.

DHCP clients on remote networks are computers that have a router (or layer 3 switch) separating them from the internal interface of the ISA Server 2000 firewall. DHCP clients on these remote networks are not able to contact the DHCP server located on the ISA Server 2000 firewall because the DHCP messages can’t pass routers by default. Most routers allow you to configure them to pass these DHCP requests using methods variously described as “IP Helper”, “BOOTP relay” or “DHCP relay”. Check your router documentation for detailed procedures on how to allow the DHCP requests from clients on remote networks to contact the internal interface of the ISA Server 2000 firewall computer.

The procedures described in this Quick Start Guide are designed to provide a quick and reliable method for creating a secure firewall configuration while allowing a rich Internet experience for internal network clients. However, there are some common problems you may encounter which are related to the type of Internet connection you use on the external interface of the ISA Server 2000 firewall.

Cable modem connections with non-permanent IP addresses on the external interface of the ISA Server 2000 firewall computer usually work fine when the DHCP Client packet filter is enabled. However, some cable providers use variants of the DHCP protocol that do not work correctly with the ISA Server 2000 firewall’s DHCP Client packet filter.

If you find the connection to the Internet stops after it has been functional for a period of time, perform the following steps to confirm the problem:

1. Open a command prompt and type ipconfig /all and press ENTER
2. If you see that the IP address for your PPP connection is 0.0.0.0, this indicates that the ISA Server 2000 firewall was not able to renew its IP address because the cable company is using an incompatible DHCP method.
3. Close the command prompt window.

If you encounter this problem, you have two choices:

• Put a cable router in front of the ISA Server firewall and use an Ethernet connection on the external interface of the ISA Server 2000 firewall computer. Configure the external interface of the ISA Server 2000 firewall to use the internal IP address of the cable router as its default gateway
• Use a script that disables the ISA Server services on and renews the firewall’s IP address on a periodic basis. You can download the script from the www.isatools.org  site. The script is at http://www.isatools.org/ISA_IP_Refresh.vbs  Schedule this script to run with a periodicity of less than half the lease period used by the cable network’s DHCP server. You can determine the lease period by examining the output of the ipconfig /all command.

DSL connections using ATM routers almost never introduce problems for ISA Server 2000 firewalls. However, there are often issues with using a PPPoE dial-up connectoid. The most common issue is related to the MTU (Mean Transfer Unit) setting on the clients and server. You can learn more about the problem and how to fix it at http://www.isaserver.org/tutorials/ISA_Server_2000_and_DSL_by_David_Fosbenner.html 

If you prefer to not change the MTU settings on all your computers, then you can put a cable router in front of the ISA Server firewall and use an Ethernet connection on the external interface of the ISA Server 2000 firewall computer. Configure the external interface of the ISA Server 2000 firewall to use the internal IP address of the cable router as its default gateway. This configuration allows the ISA Server 2000 firewall to have a permanent IP address on its external interface.

The first place to look for Help is the ISA Server 2000 Help File. The Help file contains a wealth of information on almost every component and feature included with ISA Server 2000 firewalls. Check the Help File first to see if it has the information you need.

The Microsoft official ISA Server 2000 Web site is located at www.microsoft.com/isaserver  Visit this site regularly for information about ISA Server 2000 and new documents that help make setting up and maintaining your ISA Server 2000 firewall even easier.

The Microsoft discussion groups are a place you can go to read about the experiences of other ISA Server 2000 firewall owners. You can also ask questions of other ISA Server 2000 firewall owners. There are a number of people on these groups who help ISA Server 2000 firewall owners, and some of them are Microsoft Most Valuable Professionals. This is designation given to people who are ISA Server 2000 firewall experts. Visit the Official Microsoft discussion groups at http://www.microsoft.com/isaserver/community/newsgroups/default.asp 

ISAServer.org is an independent Web site dedicated to the ISA Server firewall community. The ISAServer.org site has hundreds of articles on ISA Server firewall configuration, maintenance and management. The discussion boards there are very active and some of the foremost ISA Server firewall experts in the world are regular attendees of this highly interactive site. Visit the site at www.isaserver.org 

Configuring ISA Server by Dr. Thomas Shinder is the best selling book on installing and configuring ISA Server 2000. This book helps you understand how ISA Server 2000 firewalls work and how to configure them. Novice ISA Server 2000 firewall uses will benefit most from this book.

Dr. Tom Shinder’s ISA Server and Beyond is for the experienced ISA Server 2000 firewall administrator. This book provides detailed information on configuring ISA Server 2000-based DMZs, such as trihomed and back to back DMZ segments. There is also detailed information on how to place an Exchange Server on the ISA Server 2000 firewall, for those ISA Server 2000 owners who must run Microsoft Exchange on the firewall computer.

This book by Bud Ratliff and Jason Ballard provides hundreds of focused step by step procedures on common ISA Server 2000 related tasks. Experienced ISA Server 2000 administrators will find this book a great “peripheral brain” that reminds how to perform ISA Server 2000 related tasks that they haven’t performed for a while or have never performed.

Reprinted with Permission from Microsoft.