howto://Installing Microsoft Forefront TMG 2010, part two

Welcome back. In our last post we began our install of TMG 2010. We’ll pick right up with that in just a moment, but in case you didn’t read that one, or just want a summary, here is where we stand. We’ve just completed the install of TMG 2010 Enterprise on a Server 2008 R2 machine with two NICs. The server was configured with one NIC on the Internet, and one on the internal network. Following the install, we launched the Management console, and here we are for part two, all caught up and ready to rock and roll.

When we launch the management console, the first thing we’ll see is that our install is not really done. Despite the fact that we configured our internal network during the initial setup (ala ISA 2006 style,) we need to configure network settings. Until we finish this process, not even our TMG server has full Internet access, so you’

Click the first step to launch the Network Setup Wizard. Clicking next presents you with a choice of network setup options, and if you have used ISA 2006 before, you’ll recognise those as the network templates.

If you remember what we discussed in part one of this post, we are deploying TMG as an Edge firewall, so we’ll just click next. The next step is to identify the network adapter connected to our LAN. We’ll pick the internal NIC from the dropdown box and see the settings populate like this.

You may recall that our network is a simple, single subnet. If we had other internal subnets, and did not get our routing table squared away before we began the install, we could add them here. Note though that adding them here does not carry them through to the operating system’s routing table. You will still need to do the old route add –p routine. With nothing needing adjustment here, we’ll click Next again, and select/configure our Internet settings.

Since our ISP (TWC) assigns a an ip.addr through DHCP, we’ll use that option. They want $20 a month for a static, but in a future post, we’ll discuss ways around that. It is just DHCP after all. </wink> Click next again, and accept the prompt about system policy allowing DHCP replies on the external interface. Read the summary and click Finish. You’ll be warned that you might be disconnected (if you are using RDP) but I haven’t seen that happen. If it does, just reconnect.

The next step is to configure system settings. Click the option to begin.

This step is really more of a confirmation than anything else. We belong to the domain, so this just has us confirm those settings and move along.

Click Define deployment options to proceed. In the following screens, we are going to set the basis for TMG’s protection/control of the internal network, more than any ingress firewall or application publishing. We’ll leave the defaults in place, and then make a couple of tweaks to permit outbound traffic. After starting the wizard, our first choice is to use the Microsoft Update service or not.

You may have WSUS instaled internally, but many more updates come from this, including malware site lists, definition files, etc. so our best bet is to leave the default and click next.

TMG comes with two add-ons. The Network Inspection Service is free, and Web Protection comes with a 120 evaluation license. NIS helps to secure your VPN connections, and Web Protection screens your clients from web based threats while they are surfing, so we want both. Future posts should cover both of these in more detail (wow, I am setting myself up for a LOT of writing!)

Clicking Next takes us to settings for updates, customer feedback, and the level of participation. Leave all at the default for now, or change them if you wish to what you are comfortable with. Click through to the end, and notice we have a new option checked; Run the Web Access wizard.

Click close, and off we go. Allons ‘zee!

Again, we’re most interested in getting up and running (and preserving default settings for future posts) we we’re just going to click through the next several screens. You’ll see that they set up a block for minimum URL categories, including anonymizers, bot nets, pr0n, etc. Then you can configure unrestricted users if so required. It’s when we get to Malware Inspection Settings that things get interesting.

Defaults include blocking encrypted zips. This is good in that it prevents infected files that cannot be scanned from being accesses, but it may also cause problems if encrypted zips are a normal part of your business process. We’re going to leave it be and keep going…decide for yourself how critical this is for your company.

The next two screens are both wicked cool, and kind of scary. TMG can do inspection of HTTPS delivered content. It does this by basically pulling off a man-in-the-middle attack. Your clients encrypt between themselves and TMG, and TMG encrypts between itself and the destination server. The first screen is enabling this; the second determines whether or not your users are informed.

I seriously doubt you want to block HTTPS traffic, but you better make sure that your AUP covers everything, including notification of monitoring.

Now, you might be asking yourself how this little bit of eldritch magick is accomplished. The next screen hold the secret sauce.

The TMG server will generate certificates dynamically for any https site your users visit. In order to trust those certs, the TMG CA must be installed as a trusted root. By providing the credentials above, TMG can install the root CA through group policy. There are some critical points about this, though.

• Only Internet Explorer and Chrome on domain members will automatically trust these certificates.
• Firefox, Opera, and any browser on non-domain members will require that you install the root certificate manually.
• The default GPO refresh interval will mean that you may have some clients pop warnings anyway. Just do a gpupdate /force to get past that.

The next screen is where you set aside some disk space for caching web content. On a production box, you will want to use a separate physical disk (or array) for best performance. For our little lab box, I am just going to set aside 100MB.

Clicking Next this time takes us to finishing the wizard. If you used domain admin creds, the root certificate will be added to your GPO and you will see this.

I’m really quite sorry, but we are not done. Almost, but not quite. You should now see the actual TMG management console. Notice up top?

You need to click apply, click the radio button to save the changes and restart the services, and then provide the reason (think configuration change management and documentation) before those settings take effect. Do so, give it a few seconds, and then check your system tray.

So now we have Internet connectivity for our internal network, right? Uhm, yeah, not so much. Our TMG server has connectivity, but we still must permit our internal clients to access the tubes. In the management console, go up and select Firewall Policy, then edit rule number two.

At the very least, add DNS so that your internal DNS server can resolve external names.

Apply the change, give it a few moments, and you should be able to hit the web. However…

• Most of your internal clients won’t have updated group policy yet, so any https sites they try to visit will throw an error about an untrusted certificate.
  
  Remember, GPUPDATE /FORCE will fix this, but only after GP has replicated throughout the domain, and only for domain members running IE and Chrome.
• Remember that if you’re using your TMG as your gateway, you need to configure all your internal hosts to use the TMG’s internal ip.addr as their default gateway.
• You are only permitting HTTP, HTTPS, and DNS traffic to pass right now. FTP, IM, and other business-critical traffic is blocked. If you need to permit any other outbound traffic, and you don’t feel like tackling this on your own, don’t start your deployment until you read this upcoming post on configuring access rules.

Sound off! If you liked what you just read, have any difficulties following the instructions, or have tips for streamlining the process, leave a comment!

You might also enjoy:

1. howto://Installing Microsoft Forefront TMG 2010, part one
2. howto://Fix 0×80070422 errors with Microsoft Forefront or Windows Update
3. howto://publish a web farm using TMG 2010-part two
4. howto://publish a web farm using TMG 2010-part one

Tagged as: howto, isa & tmg, windows