Implementing ISA Server Caching

Caching Overview :

ISA Server supports caching as a way to improve the speed of retrieving information from the Internet. From the internal user’s point of view, caching improves Internet access performance. From the network administrator’s point of view, caching provides the added benefit of reducing the use of network bandwidth. ISA Server extends the benefits of caching by enabling scheduled content download jobs in which ISA Server downloads Internet content to the cache before any user requests the object. You can also combine Web caching with Web proxy chaining to optimize performance further if your organization has multiple locations. This lesson provides an overview of how caching works and how ISA Server 2004 implements caching.

What Is Caching?
One of the primary deployment scenarios for ISA Server 2004 is as a Web proxy server in which ISA Server retrieves information from the Internet for internal clients. ISA Server supports Web caching as a way to improve the speed with which this information is returned to Web clients.

Caching stores Web content on the ISA Server computer in memory or on the server’s hard disk. When a user requests Web information that is in the cache, ISA Server provides the information from the cache, enabling a quicker response to the client. ISA Server 2004 can be configured to enable the caching of Hypertext Transfer Protocol (HTTP) and File Transfer Protocol (FTP) objects.

ISA Server 2004 caching provides the following benefits:
- Improved performance Web caching speeds client response for Internet access by bringing the Web content closer to the user. When a user behind the ISA Server 2004 firewall requests Web content, ISA Server checks to see whether the content is contained in its cache. If it is, the cached content is returned to the user. Accessing Web content from a cache on the corporate network is faster than
requiring a connection to a remote Web server located on the Internet. Recently accessed information is stored in the cache and remains in the cache as long as that content continues to be accessed by users.
- Reduced bandwidth usage Web caching can help reduce the overall bandwidth usage on the organization’s Internet connection. When users request Web content already contained in cache, that content is returned to the user immediately from the cache without requesting the content again from the Internet.

How Caching Works
When a user requests an HTTP or FTP object, the Web proxy client sends the request to the Web proxy filter on ISA Server.
In a forward caching scenario, the following actions occur to complete the client request:
1. The Web proxy client sends a request for content located on an Internet Web server. The Web request is intercepted by ISA Server 2004 and forwarded to the Web proxy filter.
2. ISA Server checks whether the requested content is contained in its cache. If the content is not in the cache, or if the content has expired (that is, the header information in the content indicates that it should no longer be served from a cache), ISA Server 2004 forwards the request to the Web server on the Internet.
3. The Web server on the Internet returns the information requested.
4. The ISA Server Web proxy filter places the Web content in its in-memory cache. ISA Server 2004 uses an in-memory cache to store the most frequently requested content.
5. After placing the Web content in the in-memory cache, ISA Server 2004 Web caching server returns the content to the requesting user.
6. After a time, the ISA Server 2004 Web proxy filter will copy the contents of the inmemory cache to the disk-based cache. If the content is not frequently accessed, the in-memory cache will flush the content and the only copy of the content on ISA server will reside in the disk-based cache.

Caching Scenarios
ISA Server supports both forward and reverse caching.
1- Forward caching occurs when a user on the corporate network makes a request for Web content located on an Internet Web server. The user initiates an HTTP, Hypertext Transfer Protocol Secure (HTTPS), or FTP request to an Internet Web server and the request is intercepted by ISA Server. ISA Server retrieves the content from the Internet Web server, stores that content in its cache, and returns the content to the user.

2- Reverse caching occurs when users on the Internet request Web content located on a server on the corporate network that is accessible through a Web publishing rule. When an Internet user requests content from the internal server, ISA Server forwards the request to the Web server. The Web server sends the requested content to ISA Server, which then returns the content to the Internet user who made the request. In this scenario, ISA Server will cache a copy of the requested information so that the next request for the same information can be provided from the ISA Server cache rather than again accessing the internal Web server.

Configuring ISA Server as a Proxy Server

How to Configure Web and Firewall Chaining
ISA Server 2004 Standard Edition supports the chaining of multiple servers running ISA Server together to provide flexible Web proxy services. These servers can be chained in a hierarchical manner so that one ISA Server computer routes Internet requests to another ISA Server computer, rather than routing the request directly to the Internet. ISA Server also supports Firewall chaining to allow requests from SecureNAT and Firewall clients to be forwarded to another ISA Server computer.

Why Use Web Chaining?
Web chaining is useful if your organization has multiple branch office locations, but all Internet requests are routed through one location at the head office. In this scenario, you can install ISA Server in each office and then configure ISA Server at the branch offices to route all Internet requests to the server running ISA Server at the head office.

You can also configure Web chaining so that not all Web requests are sent to the upstream server. For example, you can configure rules for conditionally routing Internet requests, depending on the destination Web server. This is useful if the head office and the branch offices are in different countries. If one of the branch offices has a direct Internet connection and many of the Web sites used by users in that branch office are in the same country as the branch office, you may choose to have the branch office ISA Server computer route all requests for specific domain names directly to the Internet. You can still have the branch office server route all other requests to the headoffice
ISA server.

One of the benefits of using Web chaining is the accumulated caching on ISA Server. If all the servers running ISA Server in the branch offices are configured to forward their requests to the head-office ISA Server, the head-office ISA Server will develop a large cache that contains many requested items. The combination of caching at the local branch office and at head office increases the chances that the Internet content can be delivered to the client with the least use of network bandwidth.

Configuring Web Chaining Rules
To configure Web chaining rules, use the following procedure:
1. In the Microsoft ISA Server Management Console tree, expand the Configuration node, select Networks, and then click the Web Chaining tab.
2. To create a new Web chaining rule, on the Tasks tab, click Create New Web Chaining Rule.
3. On the Welcome To The New Web Chaining Rule Wizard page, in the Web Chaining Rule Name box, type a name for the Web chaining rule. Click Next.
4. On the Web Chaining Rule Destination page, click Add to specify the destinations that will be affected by this rule.
5. In the Add Network Entities dialog box, select the destinations that this rule will apply to. For example, if the rule should apply to all Internet requests, expand Networks, then click External. Click Close.
6. On the Web Chaining Rule Destination page, click Next.
7. On the Request Action page, select how the request should be processed. You have three options:
. Retrieve Requests Directly From The Specified Destination—In this case, the Web request is routed directly to the Internet.
. Redirect Requests To A Specified Upstream Server—In this case, the Web request is routed to the server that you specify.
. Redirect Requests To—In this case, the request is routed to the specified Web site.
To configure Web chaining, select Redirect Requests To A Specified Upstream Server and then click Next.
8. On the Primary Routing page, shown in Figure 5-8, in the Server box, type the name of the server to which this server will send the requests. You can also specify the port numbers for HTTP and SSL and configure an account that will be used to authenticate at the upstream ISA Server. Click Next.
9. On the Backup Action page configure what ISA Server should do if the upstream ISA Server is unavailable. You have three choices:
. Ignore Requests—In this case, ISA Server will not respond to client requests.
. Retrieve Requests Directly From The Specified Destination—In this case, ISA Server will route the request to the Internet.
. Route Requests To An Upstream Server—In this case, you can specify an alternative upstream server.
Select the option you require and then click Next.
10. On the Completing The New Web Chaining Rule Wizard page, review the configuration and then click Finish.
11. After creating the Web Chaining rule, you can configure how the ISA Server computer will bridge HTTP and HTTPS requests when using the Web chaining rule. To configure bridging, click the Web chaining rule and then, on the Tasks tab, click Define SSL Bridging For Selected Rule. On this page, you can configure how to redirect HTTP and SSL requests when sending the requests to the upstream server.

Configuring ISA Server as a Proxy Server

How Does a Reverse Web Proxy Server Work?
A reverse Web proxy server operates in much the same way as a forward Web proxy server. However, instead of making Internet resources accessible to internal clients, reverse proxy makes internal resources accessible to external clients.

The following steps outline how a reverse Web proxy server works:
1. A user on the Internet makes a request for an object located on a Web server that is on an internal network protected by a reverse proxy server. The client computer performs a DNS lookup using the fully qualified domain name (FQDN) of the hosting server. The DNS name will resolve to the IP address of the external network interface on the proxy server.
2. The client application sends the request for the object to the external address of the proxy server.
3. The proxy server checks the request to confirm that the URL is valid and to ensure that there is a policy in place that allows access to the requested content.
4. The proxy server also checks whether the requested object already exists in its local cache. If the object is stored in the local cache and it is current, the proxy server sends the object to the client from the cache. If the object is not in the cache, the proxy server sends the request to the appropriate server on the internal network.
5. The Web server response is sent back to the proxy server.
6. The object is returned to the client application that made the original request.

How to Configure ISA Server as a Proxy Server :
You can deploy ISA Server 2004 as a Web proxy and a Winsock proxy server. In fact,as soon as you enable access to Internet resources for internal clients, ISA Server begins to operate as a Web proxy server. However, there are also several Web proxy server settings that you can modify on ISA Server.
You can configure several Web proxy settings on ISA Server. To do so, perform the following procedure:
1. In the Microsoft ISA Server Management Console tree, expand the Configuration node and select Networks.
2. Click the network whose Web access properties you want to configure. If you are configuring access to the Internet for internal clients, select the Internal network.Click Edit Selected Network.
3. Click the Web Proxy tab to configure the Web Proxy settings for ISA Server. The interface is shown in Figure 5-3. First, ensure that Enable Web Proxy Clients is selected. This is selected by default.

On the Web Proxy tab, you can choose to enable or disable HTTP connections on the specified port number. You can also enable or disable Secure Sockets Layer (SSL) connections. If you select this option, ISA Server will listen for HTTPS connections on the port specified. If you enable SSL, you must also configure a certificate that will be used for SSL authentication and encryption. Web browsers cannot use this setting for Internet access, but it can be used for Web chaining scenarios.
4. To configure the Advanced Settings, click Advanced. The interface is shown in Figure 5-4. On this tab, you can configure the number of connections, which will limit the number of users that can connect to the ISA Server at one time. You can also specify a connection timeout value, which sets a timeout limit for idle connections.

5. To configure ISA Server as a Winsock proxy server, you must configure the Internal network properties so that Firewall clients are supported. To configure this, click the Firewall Client tab on the Internal network properties and ensure that Enable Firewall Client Support For This Network is selected.

Installing and Managing ISA Server Clients

What Is a Web Proxy Client?
A Web Proxy client is a client computer that has an HTTP 1.1–compliant Web browser application and is configured to use the ISA Server computer as a Web Proxy server. Virtually all current Web browsers comply with this HTTP standard, so any client computer can be configured as a Web Proxy client, including computers which are SecureNAT or Firewall clients.

When a Web Proxy client tries to access resources on the Internet, the requests are directed to the Firewall service on the ISA Server computer. If the access rule is configured to require
authentication, the ISA Server computer requests authentication from the Web Proxy client. The Firewall service then determines whether the user is allowed to access the Internet and checks the access rules to determine whether the request is allowed. For example, you can configure access to rules to block access to specified sites, or to block requests with certain keywords in the client request. The Firewall service may also cache the requested object or serve the object from the ISA Server cache.

One of the advantages of using Web Proxy clients is that most client computers already run compatible Web browsers, so Web Proxy clients require no special software to be installed. However, you must configure the Web browser to use the ISA Server computer as a proxy server. In most cases, this is a simple configuration. If you install Firewall Client software, you can use it to configure the Web browser to use the ISA Server computer as a proxy server. After you have completed the initial configuration of theWeb Proxy client, you can also automate the configuration of the Web Proxy clientusing the ISA Server Management Console.
Using Web Proxy clients provides several advantages:
■ As mentioned earlier, almost all client computers already run compatible Web browsers, which means you do not need to install any software on the client computers.All you need to do is configure the software, and this can be automated.
■ Web Proxy clients support authentication, so you can restrict access to Internet resources based on users and groups.
■ Client computers can be running any operating system that supports compatible Web browsers.
■ All client requests and responses are passed through the Web Proxy filter on ISA Server. This means that you can use application layer filtering to filter all trafficfrom the Web Proxy clients to the Internet, and from the Internet to the Web Proxy clients.

Guidelines for Choosing an ISA Server Client
ISA Server clients are used to provide access to Internet resources. This means that one of the choices that you must make as you deploy ISA Server 2004 is which ISA Server client you will deploy.

11 Deploying, Configuring, and Managing SSL Certificates

Renewing SSL Certificates :
Like any other public key certificate, each SSL certificate has a lifetime. At some point in the future, the certificate will expire. You should plan to renew the certificate three to six months prior to the expiration to ensure that there is no period during which the certificate is invalid.

The specific process you use for renewing the certificate will vary. If you are using a certificate issued by a public CA, the CA will provide a renewal process. If you are using a certificate issued by Certificate Services, you can renew the certificate by using Web enrollment, the Certificates snap-in, or the Web Server Certificate Wizard.

Configuring Firewalls :
Applications use a unique port number for SSL-protected communications. As a result,you must change your firewall configuration to allow the encrypted traffic.

There are two approaches to allowing SSL traffic through a firewall. The first approach is to open the firewall to allow all traffic with a designated port. The typical ports that various applications use for SSL are listed in Table 11.2. Although this will allow SSL sessions to be established through the firewall, the firewall will not be able to analyze the contents of the SSL-encrypted packets. As a result, the firewall will be able to use only the origin and destination of the packet to determine whether to let packets through.