Upload
bo-su
View
664
Download
2
Embed Size (px)
DESCRIPTION
Citation preview
Module 5: Forefront TMG Design and Deployment Considerations
© 2009, Microsoft. All rights reserved. All other trademarks are the property of their respective owners.
Module Overview
Logical design considerations
Scalability and availability
Client configuration
Migration options
Logical design considerations
Scalability and availability
Client configuration
Migration options
Lesson 1 – Logical Design Considerations
Design OptionsSingle purpose and location, no high availability
Forefront TMG 2010 Standard Edition
Single purpose and location, high availabilityForefront TMG 2010 Enterprise Edition in stand-alone array
Multiple purposes and/or locations, high availabilityEnterprise Management Server
5
Internet
Forefront TMG Standard Edition
Single Purpose and LocationForefront TMG 2010 Standard Edition (SE)
Light and medium trafficAll-in-one solutionNo high availabilityrequirements
6
Single Purpose and Location
Internet
Stand-aloneArray
Forefront TMG 2010 Enterprise Edition (EE):Stand-alone arrayShared configurationHigh traffic solution
Simple upgrade to EEData maintainedEE license key
Provides high availability and scale out
7
Forefront TMG ArraysShared configuration of EE serversAllows scale out and high availabilitySeen as single entity by clients
Network connections load balanced across the array
Administered as single entityConfiguration settings share across array members
Stand-alone arrayNo dedicated management serverOne server designated as the array managerConsoles redirect to array manager
8
Joining Stand-alone Array
9
Enterprise Management Server (EMS)Dedicated, replicated configuration storeSingle point of administrationUses Windows Server® 2008 Active Directory® Lightweight Directory Services (AD LDS) to host configuration store
Same replication mechanism as Active Directory (AD)Requires Active Directory authentication to replicate
10
Using EMS-managed ArraysArrays can enforce Enterprise policy configured in EMS
Optionally allow local array policy
Define primary and secondary EMS servers for high availabilityArray members query EMS using LDAP
Domain-joined array members authenticate via AD (Kerberos)Workgroup servers or in untrusted domains authenticate using TLS (certificates)
11
Deploying an EMS
Select EMS to be installed on the serverConfigure to create a new enterprise or be a replica of an existing oneSelect the authentication method
12
Creating an Array on EMS
An EMS can store policies for several different arrays, as well as a default enterprise policy
13
Joining EMS-managed ArrayServers select which primary and secondary EMS to use and which array to join
14
Managing Forefront TMG SE from EMS Array
EMS can be used to manage policies for Forefront TMG 2010 Standard Edition (SE) servers
15
Forefront TMG Enterprise Deployment Design
Single, replicated AD LDS databaseHosted on two or more EMS replicasContains one or more arrays of Forefront TMG EE serversOptionally managing Forefront TMG SE servers
Recommended one EMS database per organization
16
Sample Enterprise TMG Deployment
Internet
Branch Office(WAN & Internet link)
Regional HQ
EMS Array
EMSEMS Array
(Web Access)
WAN
Corp HQ
EMS Array(Web Access)
Branch Office(WAN link only)
TMG SE
TMG SEBranch Office
(Internet link only)
EMS
Standalone Array(Publishing)DMZ
EMS Array(VPN)
TMG Management
Site-to-Site VPN
ReplicatedConfiguration
TMG Management
17
EMS Design ConsiderationsIf EMS fails, you cannot monitor array or manage its configuration
Always define at least one EMS replica
EMS cannot be hosted on array membersSample design for EMS high availability:
Deploy two EMS servers (one primary, one replica) in one physical siteDeploy one EMS server (replica) in other physical sitesUse a maximum of 40 arrays or servers per EMS
18
Console Design Considerationsx86 and x64 Management ConsoleRequires Windows Server® 2008 or Windows Vista®Deployed on administrative workstationsRequire LAN-speed and latency to EMS and array members
Otherwise the best option is to use Remote Desktop
19
DNS ConsiderationsWindows can only use one primary DNS serverWhich to use?
ISP DNS servers?Corporate DNS servers?
Solutions:Use Corporate DNS servers and forwardersHost DNS service locally
Use conditional forwarding for internal DNS zonesForward all other queries to to ISP DNS servers
20
Domain vs. WorkgroupWorkgroup scenarios
Unauthenticated inbound and outbound trafficFor example, Secure Mail Relay
Web site publishing using LDAP, RADIUS, or SecurID tokensVPN with RADIUS authenticationOutbound Web Access using RADIUS
Deployment considerationsRequire certificates on all EMS and array members
21
Web Proxy Chaining
Main scenarioSite with no Internet link
Default rule is to retrieve directlyChain all Web requests, or just requests to specific destinationsAlso used for site redirection
22
Web Proxy Chaining
23
Internet
Branch Office(WAN and
Internet link)
Small Branch Office(Link to Regional HQ)
Disaster Recovery site
TMG ArrayTMG Array
WAN
Head QuartersBranch Office
(WAN link only)
TMG SE
TMG SE
Regional HQ
TMG Array
Internet
ISP 1
ISP 2
TMG Array
ISP Link
Chaining
Client Traffic
Sample Web Proxy Chaining Design
Lesson 2 – Scalability and Availability
Scalability and AvailabilityService scale out and high availability options
Network load balancingCache Array Routing Protocol (CARP)
Connectivity high availability through Internet service provider (ISP) redundancy
26
Network Load Balancing (NLB)Provides high availability at host level
When the host is off its traffic is redirected to other members of the NLB cluster
Allows scale outUses client IP instead of cookie for session affinity
Works with any IP device
Built in Windows feature, integrated with Forefront TMG
Single affinity
Use forWeb proxy (outbound)Web and server publishing (inbound)Remote access through VPN
Network Load Balancing
NLB hosts share the sameMAC address and Virtual IP
NLB Cluster
Client(s)
Internet
The network floods the incoming client
request
One server accepts the client requestA response is sent back to the clientA client initiates a request to an NLB
cluster
Host 3
Host 1
Host 2
L2 or L3 Switch
NLB ModesUnicast
MAC address overwritten with shared MACPrevents node-node communicationNot supported on Microsoft Hyper-V™Switch flooding issues
MulticastAdds multicast MAC addressMay require ARP table entry at router/L3 switch
IGMP MulticastOnly sends to ports in IGMP groupNot RFC-compliant
29
Enabling NLB Integration
30
Maintaining NLB Settings
Web Content CachingForward proxy caching
Cache objects requested by internal web proxy clients
Reverse proxy cachingCache static content from published web sitesReduces load on Web servers
Cache rules based on destination onlyNetworks, IP ranges, DNS domains, URLs
Security Support
32
Enabling CachingDefine cache drives on array members
33
Enabling CachingDefine cache settings
34
Cache Array Routing Protocol (CARP)Distributed caching algorithm
Returns the IP address or host name of the caching server most likely to have a cached copy of the contentPer fully qualified domain name (FQDN), not per page
Allows the implementation of a single, logical cache (scales linearly)Implemented using script that runs client-side or server-side
Server-side – Allows members of the Forefront TMG array to fetch content in other array membersClient-side – Allows Web proxy clients to fetch the content directly from the appropriate array member
Server-side CARP
NLB Cluster
with CARP
enabled
Client / Downstrea
m Proxy
Internet
Host 3
Host 1
Host 2
1. Client requests URL
2. NLB hash:Hash(Client IP) = Host 3
3. Host 3 gets CARP hash:Hash(URL) = Host 2
4. Forwards request to Host 25. Host 2 gets CARP hash:Hash(URL) = Host 2
6. Checks cache/fetches object
7. Caches object/returns to Host 3
8. Host 3 returns to client
Client-side CARP
NLB Cluster
with CARP
enabled
Internet
Host 3
Host 1
Host 2
2. Client gets CARP hash:Hash(URL) = Host 2
3. Forwards request to Host 2
4. Host 2 gets CARP hash:Hash(URL) = Host 2
5. Checks cache/fetches object
6. Caches object/returns to client
Client / Downstrea
m Proxy
1. Client gets WPAD.dat orauto configuration script
37
Enabling CARPServer-side:
Enable per networkCARP exceptions per network
Client-side:Use configuration script provided by the array
Provided by WPAD or by the Use automatic configuration script option
Load factor
38
CARP and Kerberos
39
CARP, NLB, and High AvailabilityClient-side CARP is not a high availability solution
Browser restart on node failure
If you need high availability:Enable CARP on serverConfigure clients to use NLB address(disables client-side CARP)
If you want cache efficiency and performance:Enable CARP on serverConfigure clients to use client-side CARP
Use WPAD or automatic configuration script
40
Internet Service Provider (ISP) RedundancyEnables utilizing two ISPs for external connectivity
Two modes of operationFailover – Primary and backup ISPLoad balancing and failover – Connections distributed between two active ISPs
Percentage of connections routed through each ISPNetwork rules can be use to route subnets through a specific link
Lesson 3 – Client Configuration
42
Client TypesWeb proxy client
CERN-compatible browsers/applications
SecureNAT clientAny host supporting IP
Forefront TMG clientFormerly ISA firewall clientWindows computers
Client Comparison
FeatureSecureNAT
ClientForefront TMG Client
Web Proxy Client
Installation required
IP Routing configuration
Yes Web browser configuration
OS Support Any OS supporting
TCP/IP
Windows only Any proxy-aware Web application
Protocol support
Requires application filters for multiple-
connection protocols
All Winsock applications
HTTP, HTTPS, and FTP
download
User-level authentication
No Yes Yes
44
Web Proxy Client ConfigurationGenerate configurationDiscover configuration
Automatic configuration scriptWeb Proxy Auto Discovery (WPAD)Static proxy configuration
Enforce configurationManualGroup policyForefront TMG client
45
Generate Web Proxy Client Configuration
46
Discover Web Proxy Configuration
Script maintained by arrayhttp://<FQDN>/array.dll?Get.Routing.Script
Configures:Web proxy address and portSite and domain bypassAlternate proxyCARP membership
Configure via site group policy object (GPO) forroaming clients
Automatic Configuration Script
47
Discover Web Proxy Configuration
Allows Web clients to autodiscover the Web proxy using DNS or DHCPDNS client queries for host wpad in each DNS suffix
Not location aware
DHCP client queries lease for option 252
http://<FQDN>:80/wpad.datLocation aware
Takes precedence over Automatic Configuration Script
Can be enabled via GPO
Web Proxy Automatic Discovery (WPAD)
48
Discovery Web Proxy Configuration
Configurable via GPOBest option with NLB or other load balancing solutionsSupported by all platformsLimitations:
Disables client-side CARPIf NLB is used, clients use NTLM authenticationCannot define alternate proxy
Static Proxy Configuration
Enforce ConfigurationManual browser configuration
Can be scripted
Active Directory GPORestricted to domain membersDefined per domain, site ororganizational unit (OU)
Forefront TMG ClientClient configures browser settings
SecureNAT clientsOnly requires proper routingClients perform DNS resolutionLimitations:
No user information passedNo support for secondary connections(without application filter)
Use for:Non-Web protocolsSimple, unauthenticated protocolsNon-Windows systems
51
Enhanced NATSpecify IP used for NAT from source to destination network
Solves issues with SMTP Sender Policy Framework and other IP-based authorization policies
Web proxy and NAT-based access rules onlyOverrides ISP redundancy load balancing mode
52
Forefront TMG ClientFormerly known as ISA Firewall clientSupports all WinSock-based applications
FwcWsp.dll registered with WinSock protocol stackFwcWsp tracks all WinSock callsAll remote TCP calls sent to FWC listener (TCP 1745)User information passed on all requests
Use for:User-based access authentication to non-Web protocolsComplex protocols with secondary connections
53
Forefront TMG Client DiscoverySecure discovery using Active Directory, with fallback to DHCP and DNS
Secure discovery uses AD to store discovery information for domain membersForefront TMG client and Web proxy discoveryAllows global and site-specific markersConfigured using TmgAdConfig.exeTmgAdConfig add –site <Site> -type <winsock|webproxy> -url
<URL>
54
Server-side ConfigurationDomains and Addresses tabs determine routing
55
Client-side Configuration SettingsClients settings stored in the following files:
Management.iniCommon.iniApplication.ini
Client settings defined in the console are delivered to the client during restart, and then every six hours
Manual refresh also possible
56
Client-side Configuration
Users can use the client to configure HTTPS Inspection notifications and Automatic Detection options
Lesson 4 – Migration Options
Migration from ISA Server to Forefront TMG
ISA Server 2004/2006 settings can be exported to a file and then imported on Forefront TMG SE or EE
Export confidential information option must be set
ISA Server EE can be migrated to Forefront TMG EMSNo in place upgrade option
ISA Server x86 only, Forefront TMG x64 only
ISA Server SE Forefront TMG SE
Forefront TMG EE standalone server
ISA Server EE Forefront TMG EMS
Upgrading from Forefront TMG SE to EESimply select the Upgrade to Enterprise Edition option on the System Properties
Enter the Forefront TMG 2010 Enterprise Edition product key
No need to rerun setup
Questions
© 2009 Microsoft Corporation. All rights reserved. Microsoft, Forefront, Windows and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.