Let me out! Configuring outbound access rules in TMG 2010

When last we discussed TMG 2010, we completed our install and initial configuration, and were permitting outbound HTTP, HTTPS and DNS traffic. While that was a great start, I doubt it was even minutes before you found out how many other protocols you’re using without even noticing it until something blocks it. Remember, TMG is a proxy/firewall, and the one consistency amongst all firewalls is the concept of ‘implicit deny.’ In other words, that which you have not explicitly defined as permitted is going to be denied.

In my experience, what most companies opt to do with outgoing traffic is to permit everything by default. It’s only after they determine that this is a bad idea that they start to try to block specific things. While therein lies the path to madness, I have to recognise that this is probably the situation that you are in if you are doing this at work. If you are at home, your kids are probably screaming that IM no longer works, and your own torrents (of the latest Ubuntu version of course!) probably ground to an abrupt halt, and you really want to open things up, so we’re just going to embrace the madness and do an ip any rule to start. In a follow-up post, we’ll cover how to bring order to chaos by identifying the traffic we want, creating the rules to permit it, and ultimately, disabling the ip any rule.

We’ll begin by logging on to our TMG console, and browsing down to the firewall policy.

• Right-click Firewall Policy, scroll down to New, and over to Access Rule.
  

• As with most things Microsoft, this will launch a wizard. Our first step is to name our access rule. I like short, descriptive names, and I prefer CamelCase to make things readable and easier to script later, so I will call this AllowAllOutbound and then click Next.
   

• The default action is to deny. As we’re looking to permit all, we need to click Allow, and then click next.
  

• The next screen is where we need to define the traffic for this rule. Again, our choice is pretty easy based on our goal, “All outbound traffic” and then we click Next.
  

• The next step has us decide whether or not to enable malware inspection for this rule. This may be a bit confusing, as we’re dealing with an outgoing rule, but the help file defines this as “Outbound inspection refers to HTTP requests that originate from clients on networks protected by Forefront TMG.” This is not going to inspect the replies. So if you want to be a good citizen of the tubes, and you acknowledge that your client might have picked up the e-flu somewhere along the way, enabling this could protect the rest of the world from an infected client. We’ll tick the Enable option and then click Next.
  

• Now we need to define the source of this outgoing traffic we’re allowing. Assuming you want to cover all your users, click Add, expand Network Sets, and choose All Protected Networks, which will include your TMG server(s), your internal clients, and your VPN clients. Click to add them, then click Close, then click Next.
  

• In this step, we’re defining just where we want to permit this outgoing traffic. Since we’re trying to implement ip any, click Add, expand Network Sets, and choose All Networks (and Local Host.) Add them, click Close, and then click Next.
  

• Since we want this to apply to all users, click Next.
  

Hit Finish, and make sure the rule is at the top of the stack as #1. If it is not, click to highlight it, then click “move selected rules up” on the right-hand task pane until it is. Then hit Apply, enter your reason for this change, and you’re done.

Please keep in mind that we’ve just opened the flood gates, permitting all outbound traffic. That’s web, IM, P2P, and anything else. If that is really what you (or management) want then great, but in an upcoming post we’ll go over how to identify traffic that we want to permit and how to create a rule specifically allowing it. Once we have all desired traffic defined, we can disable the AllowAllOutbound rule and be in a much more secure posture.

How does your company approach outgoing traffic? Is it ip any, everything through a proxy, or somewhere in between. Leave a comment and share your war story!

You might also enjoy:

1. I Want My File Access Old Skool!
2. howto://Installing Microsoft Forefront TMG 2010, part two
3. howto://shape traffic on tmg 2010
4. howto://enable xbox live behind TMG 2010

Tagged as: howto, isa & tmg, windows