Isa 2006 lab p3

ISA Server Tài liệu thực hành dành cho học viên

VSIC Education Corporation Trang 103

Module 8: Configuring Virtual Private Network Access for Remote Clients and Networks Lab 1: Cho user external quay VPN veà ISA, chöùng thöïc user treân ISA vaø truy caäp taøi nguyeân trong internal. Xaây döïng moâ hình nhö hình veõ

1. Taïo user u1 treân Isa server, click phaûi vaøo user u1 choïn properties, choïn theû dial-

in, choïn option Allow Access ok ( cho user u1 ñöôïc pheùp quay VPN). Taïo group VPN add user u1 vaøo group naøy.

2. Vaøo Isa choïn Virtual Private Network , choïn theû VPN Clients trong theû naøy goàm coù 5 böôùc thöïc hieän VPN.

a. Böôùc 1: choïn configure Address Assignment method



b. Choïn theû Address Assignment, choïn option Static address pool aán nuùt add,

nhaäp vaøo daõy IP cho VPN client (khi user quay VPN veà seõ döôïc caáp ip tring daõy ip naøy). Daõy IP naøy phaûi khaùc vôùi daõy ip cuûa Internal ok

c. Cuõng trong böôùc 1 choïn Enable VPN client access, ñaùnh daáu choïn vaøo

checkbox Enable VPN client access, vaø goõ vaøo toång soá client coù theû quay VPN OK



3. Böôùc 2: Choïn Specify windows users, aán nuùt add choïn group VPN

ok ok



4. Böôùc 3:

a. Choïn Verify VPN Properties, ñaùnh daáu choïn vaøo check box Enable PPTP ok



b. Choïn Remote access configuration, check vaøo check box External ok



5. Böôùc 4: choïn View Firewall policy for the VPN clients network, Böôùc naøy taïo access rule cho vpn client truy caäp taøi nguyeân beân trong internal. Click phaûi vaøo firewall policy choïn new Access rule, nhaäp teân cho rule next, choïn option Allow next

a. Choïn All outbound traffic next

b. Trong cöûa soå Access rule source add Internal, Localhost, VPN client next



c. cöûa soå Access rule destinations add Internal, Localhost, VPN client next

d. Choïn All user next finish Apply



6. Böôùc 5: choïn View network rule, trong network rule ñaõ coù saún network rule laø

route giöõ VPN client vaø Internal. Hoaøn taát caáu hình VPN server treân ISA. 7. Treân maùy VPN client thöïc hieän quay VPN veà ISA, truy caäp taøi nguyeân treân maùy

client Internal. Lab 2: VPN use Radius Authentication Xaây döïng moâ hình nhö hình veõ

Muïc ñích: Duøng radius chöùng thöïc user treân domain.



Treân maùy domain 1. Vaøo start Run goõ DSA.MSC, click phaûi vaøo domain choïn Raise domain functional

level

2. Choïn Windows 2000 native aán Raise yes

3. Taïo group coù teân laø VPN, vaø 2 user u1 vaø u2, laàn löôït click phaûi vaøo 2 user choïn

properties choïn theû Dial-in, ñaùnh daáu choïn vaøo option Control access through remote access policy ok



4. Cho 2 user u1 vaø u2 laø member cuûa group VPN



Treân maùy Radius

1. Vaøo start programs administative tools choïn Internet Authentication service. Click phaûi vaøo RADIUS Client choïn New Radius Client

2. Nhaäp Friendly name laø teân tuøy yù, nhaäp vaøo IP internal cuûa maùy ISA server next



3. Choïn Client-vendor laø RADIUS Standard nhaäp shares secret vaø Confirm shared

secret laø 1234, ñaùnh daáu choïn check box Request must contain the …. Finish



4. Click phaûi vaøo Remote access policy choïn New Remote Access policy

5. Choïn option Use the wizard to set up …, nhaäp teân cho Policy name next

6. Choïn option VPN next



7. Choïn option Group, Aán add choïn Location choïn teân domain, nhaäp vaøo group

VPN aán check Names ok next



Treân maùy ISA

1. Caáu hình VPN server treân ISA gioáng nhö lab 1. Caáu hình qua 5 böôùc



2. Böôùc 1:

a. Choïn Configure Address Assignment method, choïn option Static address pool, nhaäp vaø daõy IP cho VPN client, daõy Ip naøy phaûi khaùc vôùi daõy IP cuûa internal ok



b. Choïn Enable VPN client access, ñaùnh daáu choïn checkbox Enable VPN client

access ok



3. Böôùc 2: Choïn Radius Server, ñaùnh daáu choïn checkbox use RADIUS for

authentication, Aán Raius servers



Aán add nhaäp vaøo IP cuûa maùy Radius server, aán Change nhaäp vaøo shared secret gioáng nhö ñaõ nhaäp treân maùy Radius, ñaùch daáu choïn checkbox Always use message authenticator ok ok Ok



4. Böôùc 3 a. Choïn Verify VPN properties, ñaùnh daáu choïn 2 checkbox Enable PPTP vaø

Enable L2TP/IPSEC ok

b. Choïn remote access configuration, ñaùnh daáu choïn checkbox External ok



8. Böôùc 4: Choïn View firewall policy for the VPN clients network, click phaûi vaøo

Firewall policy new Access Rule goõ vaøo teân cuûa Rule next

Choïn Allow next, choïn all outbound traffic next,taïi cöûa soå Access rule source aán Add choïn Internal, Local Host, VPN client next



Taïi cöûa soå Access Rule Destinations aán Add choïn Internal, Local Host, VPN client next, all user next finish

9. Böôùc 5 trôû laïi Virtual Private networks choïn view network rule, kieån tra xem ñaõ

coù rule VPN Clients to Internal laø route.



10. Click phaûi vaøo Firewall policy choïn edit System policy, choïn ICMP (ping) choïn

theû from add Internal, Localhost vaø VPN client Ok Apply. Hoaøn taát caáu hình VPN treân ISA

Treân maùy Client

1. Click phaûi vaøo my netwok places properties, choïn Create a new connection next



2. Choïn option connect to the network at my workplace next

3. Choïn Virtual private network connection next



4. Nhaäp vaøo teân cho keát noái nhaäp vaøp IP external cuûa ISA next finish

5. Nhaäp vaøo user name vaø password cuûa user treân domain aán connect keùt noái

thaønh coâng.



6. Ñeå thöïc hieän VPN baèng L2TP/IPSEC ta click phaûi vaøo keát noái VPN choïn

properties choïn theû security aán Ipsec setting

7. Ñaùnh daáu choïn check box Use pre-shared key for authentication, nhaäp vaøo key ví

duï laø 12345 ok



8. Choïn theû Networking, trong phaàn type of VPN choïn L2TP IPSEC VPN ok

9. Trôû veà maùy ISA , choïn Virtual private network ôû böôûc 2 choïn Radius server, choïn

tab Authentication, ñaùnh daáu choïn Allow custom Ipsec policy for L2TP connection, nhaäp vaøo key 12345 gioáng nhö ñaõ nhaäp treân maùy client--> ok Apply



10. Treân maùy client thöïc hieän keát noái VPN sau khi keát noái thaønh coâng click phaûi vaøo

keát noái choïn status seõ thaáy keát quaû nhö maøn hình sau (maõ hoùa baèng Ipsec)



Lab 3: VPN site to site Xaây döïng moâ hình nhö hình veõ

Muïc ñích: cho caùc client internal cuûa 2 site coù theå truy caäp döõ lieäu cuûa nhau. Treân ISA1



1. Taïo user laø HCM, click phaûi vaøo user choïn properties, choïn theû Dial-in choïn Allow access.

2. Vaøo Isa choïn virtual private network, choïn theû Remote Site, cöûa soå beân tay phaûi choïn theû tasks aán Create site to site connection. Goõ vaøo teân remote site (Chuù yù: teân remote site phaûi gioáng nhö teân user maø isa1 ñaõ taïo ôû böôùc 1, trong lab naøy laø HCM) next

3. Choïn Piont-to-point Tunneling Protocol (PPTP) next



4. Goõ vaøo IP external cuûa ISA2 next

8. Nhaäp vaøo user name vaø password maø ISA2 taïo, trong tröôøng hôïp naøy laø Hanoi( chæ

nhaäp username vaø Password thoâi khoâng caàn nhaäp domain) next 9. Aán Add range nhaäp vaøo daõy IP Internal cuûa ISA2 trong tröôøng hôïp naøy laø

192.168.1.1- 192.168.1.254 ok next

10. Choïn Option Create a network rule specifying a route relationship (ñeå taïo network

rule laø route giöõa Internal cuûa Isa1 vaø remote site)



11. Choïn option Create an allow access rule (ñeå taïo access rule laø all outbound traffic

giöõa Internal vaø remote site) next finish

12. Choïn firewall policy seõ thaáy ñöôïc access rule allow access… töï taïo



13. Vaøo configuration\networks choïn theû Network rule seõ thaáy rule HCM to Internal

network laø route ñaõ töï taïo.

14. Vaøo system policy choïn ICMP(ping) choïn theû from add HCM, Internal, local host

ñeå cho pheùp ping.--> ok Apply



Treân ISA2

1. Taïo user laø Hanoi, click phaûi vaøo user hanoi properties choïn theû dial-in choïn option Allow access

2. Vaøo Isa choïn virtual private network, choïn theû Remote Site, cöûa soå beân tay phaûi choïn theû tasks aán Create site to site connection. Goõ vaøo teân remote site (Chuù yù: teân remote site phaûi gioáng nhö teân user maø isa2 ñaõ taïo ôû böôùc 1, trong lab naøy laø Hanoi) next



3. Choïn Piont-to-point Tunneling Protocol (PPTP) next

4. Goõ vaøo IP external cuûa ISA1 next



15. Nhaäp vaøo user name vaø password maø ISA1 taïo, trong tröôøng hôïp naøy laø HCM( chæ

nhaäp username vaø Password thoâi khoâng caàn nhaäp domain) next

16. Aán Add range nhaäp vaøo daõy IP Internal cuûa ISA2 trong tröôøng hôïp naøy laø

200.200.200.1—200.200.200.254 ok next



17. Choïn Option Create a network rule specifying a route relationship (ñeå taïo network

rule laø route giöõa Internal cuûa Isa2 vaø remote site)

18. Choïn option Create an allow access rule (ñeå taïo access rule laø all outbound traffic

giöõa Internal vaø remote site) next finish



19. Vaøo system policy choïn ICMP(ping) choïn theû from add Hanoi, Internal, local host

ñeå cho pheùp ping.--> ok Apply 20. Hoaøn taát baøi lab VPN site to site. Ñöùng taïi maùy client internal cuûa ISA2 ping thaønh

coâng ñeán client internal cuûa ISA1 hay ngöôïc laïi.



Module 9: Implementing Caching Lab1 : Configuring Cache Xaây döïng laïi moâ hình nhö hình veõ, taïo rule cho Client vaø Isa ra internet

1. Vaøo Isa, choïn Configuration\ cache, ôû cöûa soå giöõa choïn theû cache Drives, ôû cöûa

soå beân phaûi choïn theû tasks, choïn Define cache Drives.

2. Choïn oå ñóa löu cache vaø nhaäp vaøo dung löôïng cache aán set ok



3. Aán Apply choïn option save the changes and restart the services-- >ok

4. Treân oå c: seõ coù folder Urlcache, trong folder coù file Dir1.cdat



5. Taïi maùy ISA vaø maùy client vaøo IE truy caäp moät soá trang web khaùc nhau caøng nhieàu

caøng toát 6. Treân maùy Isa caøi cache dir tool

7. Extract caùc file cache dir tool vaøo folder caøi Isa (coù theå phaûi reboot laïi Isa)

8. Chaïy cache dir tool seõ thaáy ñöôïc Isa cache ñöôïc caùc trang web maø ISA vaø client ñaõ

truy caäp ôû böôùc 5



Lab 2: Content Download Jobs Muïc ñích: Laäp lòch download web site veà cache treân ISA

1. Vaøo Isa choïn configuration\cache, ôû cöûa soå chính giöõa choïn theû Content Download Jobs choïn Schedule a content download job

2. Nhaäp teân cho Schedule next



3. Choïn option Weekly next

4. Choïn ngaøy vaø giôø cho schedule download



5. Nhaäp vaøo trang web caàn download next

6. Choïn option cache all content vaø Override Object’s TTL nhaäp vaøo new TTL laø

120 phuùt next



7. Click phaûi vaøo schedule vöøa taïo choïn start

8. Ñeå thaáy ñöôïc trang tuoitre.com.vn ñang ñöôïc cache ta vaøo monitoring choïn theû

loggin click vaøo start query, click phaûi vaøo thanh tieâu ñeà choïn add/remove colunms



9. Cho caùc colunm URL, Destination IP, Client Ip leân ñaàu ok

10. Maëc duø ISA vaø client khoâng truy caäp vaøo trang http://www.tuoitre.com.vn nhöng

Isa vaãn cache. Schedule download ñang chaïy töø maùy ISA (local host)



Technology

Isa 2006 lab p3