Understanding and Configuring ISA content groups

Understanding and Configuring ISA content groups

In this tutorial I focus on Content groups and how they function.  I will also show you how to configure content groups. This will enable you to restrict certain objects on the internet specific to webpage’s that you might want to limit either for security reasons or bandwidth limitations that your organization may have.  You also may want to limit access to a specific file types or scripts that may be potentially dangerous to your organization.

What are content groups?

Content groups can be found under the Policy elements object within the ISA server’s MMC console.

Content groups applies to HTTP and tunneled FTP and can be represented as file extensions or MIME types (Multipurpose Internet Mail Extensions), that you can use when creating a site and content rules or a bandwidth rules.  Content groups allow you to restrict specific content that is available on a specific website.  When using HTTP to browse the web, any inbound HTTP traffic will be identified by its mime type, but when tunneled FTP mode is used the traffic is identified by  the file extensions, bear this in mind when using content groups as it can play an important role when creating rules that incorporate HTTP or FTP content groups.

How do content groups work?

Content groups work in the following manner.

1. An ISA client requests HTTP/FTP content from ISA (not HTTPS content).
2. ISA then checks the file or objects extension.
3. The ISA Server then checks if a rule is bound to a content group and if that content group has the file name extension or mime type prescribed within it.
4. IF ISA finds the prescribed mime type or file extension ISA will ether allow or deny the object retrieval depending on what you have configured the ISA server rule to do.
   The figure below depicts the content group’s communication behavior when Http method is used.
   

The figure below depicts the content group’s communication behavior when Http method is used.

Configuring ISA content groups.

1.

To create content groups locate the content group ISA server object under Policy elements then right click on the content group object, then click on new, and then click on content group.

2.

Now you should be presented with the screen above. In the name text field type the name below that type the description.  For the purposes of this exercise you can select the audio and then the x-pn-realaudio plugin object. Then click add and the audio type will be displayed in the right hand screen under selected types.  You have just added a MIME type if you wanted to add a file type you could just type in the extension or you could look for the file extention towards the bottom of the list.

Remember that MIME types are for HTTP and file types or extensions are used for FTP.

Below is a list of the default file associations and extensions that I have gathered together and sorted into four groups.

Summary: In this tutorial I have highlighted and shown you the importance of being able to restrict uses of certain objects or file extensions on the internet.  I have also made you more aware of the different file types that can occur and informed you about them to make it easier when deciding what file types may pose a bandwidth bottleneck or security risk.  Understanding content groups within ISA can prove to be a powerful tool if used as intended.