50357 a enu-module01
-
Upload
bo-su -
Category
Technology
-
view
609 -
download
1
description
Transcript of 50357 a enu-module01
Module 1: Forefront Threat Management Gateway (TMG) 2010 Overview
© 2009, Microsoft. All rights reserved. All other trademarks are the property of their respective owners.
Module Overview
Introduction to Forefront TMG
Deployment scenarios
Basic configuration concepts
Introduction to Forefront TMG
Deployment scenarios
Basic configuration concepts
Lesson 1 – Introduction to Forefront TMG
Forefront Edge Security and Access Products
Before Now
Network Protection
Network Access
The Forefront Edge Security and Access products provide enhanced network edge protection and application-centric, policy-based access to corporate IT infrastructures
Integrated and comprehensive protection from Internet-based threats
Unified platform for all enterprise remote access needs
The Threat LandscapeVulnerabilities down, threats upIncreasing sophistication of threatsThreats moving to the application layerRising threats
PhishingSpam and malicious e-mailBlended threats
Forefront TMG Value Proposition
Firewall – Control network policy access at the edge
Secure Web Gateway – Protect users from Web browsing threats
Secure E-mail Relay – Protect users from e-mail threats
Remote Access Gateway – Enable users to remotely access corporate resources
Intrusion Prevention – Protect desktops and servers from intrusion attempts
Comprehensive
Integrated
Simplified
Forefront TMG Deployment Scenarios
•All-in-one solution for medium businesses
•Firewall, VPN, Web security, IPS, e-mail relay in a single box
Unified Threat Management
(UTM)
•Authenticating proxy with security
•Web antivirus and URL filtering
•Inspection of HTTP and HTTPS traffic
Secure Web Gateway
•Secure Web publishing
•Dial-in VPN
•Site to site VPN
Remote Access Gateway
•Antispam
•Antivirus
•E-mail filtering
Secure E-mail Relay
Features Summary
• VoIP traversal• Enhanced NAT• ISP link redundancy
Firewall
• HTTP antivirus/antispyware
• URL filtering• HTTPS forward inspection
Secure Web Access
• Exchange Edge integration
• Antivirus• Antispam
E-mail Protection
• Network inspection system
Intrusion Prevention
• NAP integration with client VPN
• SSTP integration
Remote Access
• Array management• Change tracking• Enhanced reporting• W2K8, native 64-bit
Deployment and Management
• Malware protection
• URL filtering• Intrusion prevention
Subscription Services
Network layer firewall
Application layer firewall
Internet access protection (proxy)
Basic OWA and SharePoint publishing
IPSec VPN (remote and site-to-site)
Web caching, HTTP compression
Web antivirus, antimalware
URL filtering
E-mail antimalware, antispam
Network intrusion prevention
Features SummaryComparing with ISA Server 2006ISA Server
2006Forefront
TMG
New
New
New
New
Enhanced UI, management, reporting New
Exchange publishing (RPC over HTTP)
Windows Server® 2008 R2, 64-bit (only) New
E
Forefront TMG LicensingTwo editions and Two Client Access Licenses (CALs)
Standard EditionFull UTM
Enterprise Edition Scalability and management
Web protectionE-mail
protection
Subscriptions
Comparing Forefront TMG Editions
Standard Edition Enterprise Edition
Number of CPUs Up to 4 CPUs Unlimited
Array/NLB/CARP support
Enterprise management
Yes, with added ability for EMS to manage SEs
Publishing
VPN support
Forward proxy/cache, compression
Network IPS (NIS)
E-mail protection Requires Microsoft® Exchange Server License (Server + CALs)
and installation by the admin
SubscriptionsSubscription-based licenses
Sold as Client Access Licenses (CALs) Charged per user/per year
Protection ComponentsE-mail protection
AntispamAntivirus
HTTP protectionAntimalwareURL filtering
Network Inspection System is free!
Translating Licenses
ISA Server SE
ISA Server EE
Forefront TMG 2010 SE
Forefront TMG 2010 EE
Forefront TMG 2010 EE
Covered by Software Assurance
Available per user/device, per year
Today At Launch
Lesson 2 – Installation and Initial Setup
15
System Requirements
Minimum Recommended
Processor 2 core (1 CPU x dual core) 64-bit processor
4 core (2 CPU x dual core or 1 CPU x quad core) 64-bit processor
Memory 2 gigabytes (GB) of memory
4 gigabytes (GB) of memory
Hard Disk Space 2.5 GB of available hard disk space*
2.5 GB of available hard disk space*
Hard Disks One local hard disk partition formatted with NTFS
Two disks for system and logging, and one for caching and malware inspection
Network One network adapter for communicating with the internal network
One network adapter for each network connected to the Forefront TMG 2010 server
Operating System Windows Server® 2008 x64 with Service Pack 2, or Windows Server® 2008 R2
* Exclusive of the hard disk space used for caching and for storing temporary files
Installation PrerequisitesBasic installation
Connected to the network, with DNS server settings configuredRequired operating system components:
Windows® Roles and FeaturesMicrosoft® .NET Framework 3.5 SP1Windows Web Services API Windows Installer 4.5
Preparation Tool installs the required components
For the Secure Mail Relay usage scenarioExchange Edge Transport Role
Microsoft® Exchange Server 2007 with Service Pack 1, or Microsoft® Exchange Server 2010
Microsoft® Forefront™ Protection 2010 for Exchange Server
17
Installation
18
Installation
19
Initial ConfigurationGetting Started Wizard
20
Configuring Network Settings
Select the network topology used:
Edge firewall3-Leg perimeterBack firewallSingle network adapter
Network Setup Wizard
21
Define the IP configuration for each network adapterAssign adapter to the appropriate network
Configuring Network SettingsNetwork Setup Wizard
22
Define host name, domain membership and DNS suffix
Configuring System SettingsSystem Configuration Wizard
23
Configuring Deployment Settings
Activate subscription licensesEnable malware protection and intrusion preventionConfigure signature update schedule and response policyJoin the Customer Experience Improvement Program (CEIP) and the Microsoft Telemetry Service
Deployment Wizard
24
Configuring Deployment SettingsDeployment Wizard
Lesson 3 – Basic Configuration Concepts
26
Configuration Concepts
Forefront TMG supports unlimited network adaptersLimited by hardware
Network Adapters
27
InternetISP 1
ISP 2
DMZ EXT
DMZ INT
LAN 1
LAN 3
LAN 2
TMG
Branch
VPN client
Configuration ConceptsNetworks
Internal
External
Local Host
DMZ InternalDMZ External
VPN Clients
28
Configuration Concepts
Networks configuration model the enterprise network infrastructure
Contains all reachable IPs for network adapterCannot overlap with other NetworksStatic or dynamic
Networks
Configuration ConceptsNetwork Sets
InternetISP 1
ISP 2
DMZ EXT
DMZ INT
LAN 1
LAN 3
LAN 2
TMG
Branch
VPN client
DMZ Networks
30
Configuration Concepts
Network Sets are used to group one or more networksDefined by selecting the networks included in the set (Include) or a set of networks excluded from the set (Exclude)Used in the definition of network and policy rules
Network Sets
31
Configuration Concepts
Define allowed traffic flowsDetermine the relationship between two networks
RouteBi-directionalSource address not modified
NATUni-directionalSource address is modified
Required for non-Web access and Server Publishing rules
Web proxy filter ignores network rules
Network Rules
32
Configuration Concepts
New Feature: Enhanced NATSpecify the IP address to be used when doing NAT
Network Rules
33
Configuration Concepts
Display the routing table used between networksSet via route –p add command or GUI
Routing
34
Forefront TMG PolicyThree types of rules:1. Network rules2. System policy3. Firewall policy
35
Single Adapter ScenarioForefront TMG supports using a single network adapterSupported scenarios
Secure Web Gateway (forward Web proxy and cache)Web Publishing (reverse Web proxy and cache)Remote client VPN access
Unsupported scenariosApplication layer inspection (except for Web proxy)Server publishingNon-Web clients
Firewall clientSecure NAT
Site-to-site VPNs
36
Single Adapter Scenario
Internet
LAN 1
LAN 3
LAN 2
TMG
VPN Client
Internal
Local Host
VPN Clients
37
Common Configuration MistakesMultiple default gateways
Define only one default gateway
Not adding reachable addresses to networksEnsure all reachable addresses added
DNS resolution issuesDNS server list is system wide, not per adapterUse the internal DNS servers, or host a DNS server service locally and use conditional forwarding
Questions
Lab 1: Forefront TMG Installation
In this lab, you will:
Install Forefront TMG on a Windows Server® 2008 R2 serverPerform an initial configuration of Forefront TMG using the Getting Started wizards
Lab 1 - Exercises 1 and 2Estimated completion time: 45 min
© 2009 Microsoft Corporation. All rights reserved. Microsoft, Forefront, Windows and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.