For ISA Server 2004 Enterprise Edition, in a scenario involving multi-server ISA Server arrays, you must ensure that client requests for a particular session are handled by the same array member, so that the client’s cookie is recognized. If the request is received by a different member, the cookie will not be recognized and the request will be dropped by that ISA Server member. An effective way to ensure that the requests are handled by the same server member is to enable integrated Network Load Balancing (NLB) on the ISA Server array. The procedure for enabling integrated NLB is described in Appendix A: Configuring NLB on the ISA Server Array in this document.

In this scenario, an SSL connection is preserved from the external client to the ISA Server computer, and from the ISA Server computer to the published Outlook Web Access server. A server certificate is required to authenticate ISA Server to external clients, which is usually a certificate from a certification authority (CA), and a server certificate is required on the Outlook Web Access server to authenticate it to the ISA Server computer. For instructions on configuring server certificates, see Digital Certificates for ISA Server 2004 at the Microsoft TechNet Web site.

Note:

The recommended configuration for Outlook Web Access publishing is to use SSL-encrypted communication (HTTPS) both from the external client to the ISA Server computer and from the ISA Server computer to the Outlook Web Access server. ISA Server does not support Outlook Web Access publishing rules that forward HTTP requests from the external client to the Outlook Web Access server as HTTPS. If you create a publishing rule that forwards HTTPS requests from the external clients to the Outlook Web Access server as HTTP, do not enable link translation.

On the Outlook Web Access server, configure IIS for SSL communications only:

1. Open the Internet Services Manager or your custom Microsoft Management Console (MMC) containing the IIS snap-in, expand the server node, expand the Default Web Site node, select virtual path /Exchange, and then click Properties.
   
2. Click the Directory Security tab, and under Secure Communications, click Edit.
   
3. In the Secure Communications dialog box, select the Require secure channel (SSL) check box, and then click OK twice.
   
4. Repeat these steps for the virtual path /public.
   
5. Repeat these steps for the virtual path /exchweb, but select Enable anonymous access and clear all other authenticated access check boxes.
   

In this scenario, an SSL connection is preserved from the external client to the ISA Server computer, and from the ISA Server computer to the published Outlook Web Access server. In such a scenario, a server certificate is required to authenticate ISA Server to external clients, which is usually a certificate from a certification authority (CA), and a server certificate is required on the Outlook Web Access server to authenticate it to ISA Server computer. For ISA Server 2004 Enterprise Edition, you will need to prepare and install an identical server certificate on each array member. For instructions on configuring server certificates, see Digital Certificates for ISA Server 2004 at the Microsoft TechNet Web site.

Users with valid authentication credentials must be specified on the RSA ACE/Server computer:

1. On the RSA ACE/Server computer, click Start, click Programs, and then click Database Administration - Host Mode.
   
2. On the Agent Host menu, click Add Agent Host.
   
3. Add the ISA Server computer to the list of agents. If you are running ISA Server 2004 Enterprise Edition, repeat this step for each ISA Server computer in the array:
   
   1. In Name, type the name of the ISA Server computer.
      
   2. In Network address, type the IP address of the ISA Server computer, if it did not appear automatically.
      
   3. In Agent Type, select Communication Server.
      
4. Generate the configuration file. To do this, on the Agent Host menu, click Generate Configuration File, click One Agent Host, click OK, double-click the name of the ISA Server computer, and save the Sdconf.rec file in a folder on the computer. If you are running ISA Server 2004 Enterprise Edition, repeat this step for each ISA Server computer in the array.
   
5. Copy the Sdconf.rec file to the %windir%\system32 folder on the ISA Server computer.
   

Note:
If you are running ISA Server 2004 Enterprise Edition, the Sdconf.rec file should have service network permissions.

After you set up RSA ACE/Server on your network, and install the digital certificate, you must set up the ISA Server computer as an RSA ACE/Agent. After the RSA ACE/Agent is configured, you will need to test connectivity between the ISA Server computer and the RSA ACE/Server to verify that ISA Server can authenticate against the RSA ACE/Server.

To set up the ISA Server computer as an RSA ACE/Agent:

• Copy the Sdconf.rec file, located in the ACE\Data folder on the RSA ACE/Server computer, to the %windir%\system32 folder on the ISA Server computer.
  

If you are using a version of RSA ACE/Server earlier than version 5.0, perform the following steps:

1. On the RSA ACE/Server computer, click Start, click Programs, and then click Database Administration - Host Mode.
   
2. On the Agent Host menu, click Add Agent Host.
   
3. In Name, type the name of the ISA Server computer.
   
4. In Network address, type the IP address of the ISA Server computer, if it did not appear.
   
5. In Agent Host, click Generate Configuration File, click One Agent Host, click OK, double-click the name of the ISA Server computer, and save the Sdconf.rec file in a folder on the computer.
   
6. Copy the Sdconf.rec file to the %windir%\system32 folder on the ISA Server computer.
   

For the ISA Server computer to verify the authentication credentials for RSA SecurID, the system policy rule allowing communication with RSA SecurID must be enabled. The RSA ACE/Server must be specified in the system policy as the destination. To enable system policy, do the following:

1. In the console tree of ISA Server Management, right-click the Firewall Policy node, as follows:
   
   • For Standard Edition, expand Microsoft Internet Security and Acceleration Server 2004, expand Server_Name, and then right-click Firewall Policy.
     
   • For Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2004, expand Arrays, expand Array_Name, and then right-click Firewall Policy.
     
2. Click Edit System Policy.
   
3. In the Authentication Services section of the Configuration Groups list, click RSA SecurID.
   
4. On the General tab, select the Enable check box.
   
5. Click the To tab, and then click Add.
   
6. In the Add Network Entities page, on the New menu, click Computer.
   
7. In the new Computer Rule Element page, specify the name and IP address for the RSA ACE/Server. Click OK. Select the new computer rule element from the list of computers, and then click Add. Click OK.
   
8. In the Firewall Policy details pane, click Apply to update the configuration.
   When the System Policy Editor closes, you can view the system policy rule "Allow SecurID Authentication from ISA Server to Trusted Servers" properties in the Firewall Policy details pane.
   

To verify that ISA Server 2004 can authenticate against the RSA ACE/Server, do the following:

1. Copy Sdtest.exe from the \Tools folder CD or from the shared folder on your network that contains the ISA Server files to the ISA Install folder.
   
2. Run Sdtest.exe.
   
3. In RSA SecurID Authentication Information, click RSA ACE/Server Test Directly.
   
4. In RSA SecurID Authentication, type the user name in Enter User Name and the passcode in Enter PASSCODE.
   
5. Click OK when the Authentication successful message displays.
   

We recommend that you back up your ISA Server configuration before making any changes. If the changes you make result in behavior that you did not expect, you can revert to the previous backup configuration. To back up the complete configuration of your ISA Server computer to an .xml document, perform one of the following procedures.

For ISA Server 2004 Standard Edition, do the following:

1. In the console tree of ISA Server Management, click the ISA Server computer name:
   
   • Expand Microsoft Internet Security and Acceleration Server 2004, and then click Server_Name.
     
2. On the Tasks tab, click Backup this ISA Server Configuration.
   
3. In Save in, specify the folder in which the export file will be saved.
   
4. In File name, type a name for the exported file, and then click Backup.
   
5. In Password and Confirm password, type a password that will be required to open and decrypt confidential information.
   

For ISA Server 2004 Enterprise Edition, do the following:

1. Open Microsoft ISA Server Management.
   
2. Click to expand Microsoft Internet Security and Acceleration Server 2004:
   
3. For Enterprise Edition, expand Arrays, right-click the array through which you are going to publish Outlook Web Access, and then click Export (Back Up) to start the Export Wizard.
   
4. On the Welcome page, click Next.
   
5. On the Export Preferences page, you can select the following options:
   
   • You can choose to export confidential information. If you do, it will be encrypted during export. If you want to export confidential information, select Export confidential information and provide a password.
     
   • You can choose to export user permission settings, by selecting Export user permission settings. User permission settings contain the security roles of ISA Server users, for example, indicating who has administrative rights.
     
6. Click Next.
   
7. On the Export File Location page, provide the location and name of the file to which you want to save the configuration. Choose a meaningful name, and consider including the date in the name of the file. Click Next.
   
8. On the Completing the Export Wizard page, click Finish.
   
9. When the export has completed, click OK.
   

   Note:
   Because the .xml document is being used as a backup, a copy of it should be saved on another computer in case of catastrophic failure.

Create a Web listener to listen for Outlook Web Access requests on the specified network. In this scenario, the specified network is the External network. The Web listener will listen for secure HTTPS requests only, and will use RSA SecurID authentication. To create a Web listener, do the following:

1. In ISA Server Management, click the Firewall Policy node, as follows:
   
   • For Standard Edition, expand Microsoft Internet Security and Acceleration Server 2004, expand Server_Name, and then click Firewall Policy.
     
   • For Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2004, expand Arrays, expand Array_Name, and then click Firewall Policy.
     
2. On the Toolbox tab, click Network Objects. On the toolbar beneath Network Objects, click New, and then click Web Listener.
   
3. On the Welcome page of the New Web Listener Wizard, type the name of the new listener, such as Listener on External network for internal Web publishing, and then click Next.
   
4. On the IP Addresses page, select the network that will listen for Web requests. Because you want ISA Server to receive requests from the External network (the Internet), the listener should be one or more IP addresses on the external network adapters of ISA Server. Therefore, select External. Do not click Next.
   
5. Before you click Next on the IP Addresses page, select specific addresses on which the ISA Server computer will listen. Click the Address button. The default selection is to listen on all IP addresses on the network.
   For ISA Server 2004 Enterprise Edition, this will include both dedicated IP addresses and virtual IP addresses on the External network, where NLB is enabled. We recommend that you select The default IP address(es) for network adapters on this network. This will select the default virtual IP address if NLB is enabled, and will select the default IP addresses on the network adapters of the ISA Server array if NLB is not enabled. If you have enabled NLB, and have created more than one virtual IP address, you should select Specified IP addresses on the ISA Server computer in the selected network, and then select the specific virtual IP address in the Available IP Addresses list.
   
   
6. Click OK, and on the IP Addresses page, click Next.
   
7. On the Port Specification page, clear the Enable HTTP check box.
   
   
8. Select Enable SSL, and verify that the SSL port is set to 443 (default setting).
   
9. Provide the certificate name in the Certificate field. To do this, click Select, select the certificate you installed, click OK, and then click Next. For information about certificates, see Digital Certificates for ISA Server 2004 at the Microsoft TechNet Web site.
   

   Important:
   For secure Outlook Web Access publication, we recommend that you listen only for SSL requests. Use only the standard port numbers, which are the default settings for Outlook Web Access publishing.

10. On the Completing the New Web Listener Wizard page, review the settings, and click Finish.
    

After you create a new Web listener using the New Web Listener Wizard, use the following steps to configure the listener to use RSA SecurID:

1. In ISA Server Management, click the Firewall Policy node, as follows:
   
   • For Standard Edition, expand Microsoft Internet Security and Acceleration Server 2004, expand Server_Name, and then click Firewall Policy.
     
   • For Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2004, expand Arrays, expand Array_Name, and then click Firewall Policy.
     
2. On the Toolbox tab, click Network Objects. Expand Web Listeners. Double-click to open the properties for the Web listener you created in the previous procedure.
   
3. On the Preferences tab, under Configure allowed authentication methods, click Authentication.
   
4. In the list of authentication methods, clear any authentication method that is selected (the default is Integrated), and then select SecurID. This establishes RSA SecurID authentication for the Outlook Web Access Web listener, and for the mail server publishing rule that uses this listener.
   
   
5. Select Require all users to authenticate, and then click OK.
   
6. Click the RSA SecurID tab.
   
7. Under Cookie expiration control, configure the maximum time that cookies can remain active before they expire.
   
   
8. Because you are specifying dual-authentication methods (the user will use forms-based authentication to authenticate to the Outlook Web Access server), select the Send SecurID cookie to upstream server check box.
   
9. Click OK to close the Web listener properties. In the Firewall Policy details pane, click Apply to apply the changes that you made.
   

To create a new mail server publishing rule using the New Mail Server Publishing Rule Wizard, follow these steps:

1. Do one of the following:
   
   • For ISA Server 2004 Standard Edition, expand Microsoft ISA Server Management, expand Server_Name, and then click Firewall Policy.
     
   • For ISA Server 2004 Enterprise Edition, on one of the ISA Server array members, expand Microsoft ISA Server Management, expand Arrays, and expand the array that will publish Outlook Web Access. Click Firewall Policy.
     
2. In the Firewall Policy task pane, on the Tasks tab, select Publish a Mail Server to start the New Mail Server Publishing Rule Wizard.
   
3. On the Welcome page, provide a name for the rule, and then click Next.
   
4. On the Select Access Type page, select Web client access: Outlook Web Access (OWA), Outlook Mobile Access, Exchange Server ActiveSync, and then click Next.
   
   
5. On the Select Services page, select Outlook Web Access. You may also select Outlook Mobile Access and Exchange ActiveSync. Click Next.
   
   

   Note:
   Enable high bit characters used by non-English character sets is enabled by default. This allows double-byte character sets (DBCS) or Latin 1 characters, used in some non-English languages. If you clear this selection, requests using those characters will be blocked.

6. On the Bridging Mode page, select which parts of the communication path will be secured by digital certificates and therefore take place using the HTTPS protocol. This can be the communication from the client to the ISA Server computer, the communication from the ISA Server computer to the Outlook Web Access server, both types of communications, or neither. We recommend that you select the default Secure connection to clients and mail server, so that both portions of the communications pathway are secured by digital certificates. This will require that a digital certificate be installed on the Outlook Web Access server and on the ISA Server computer, as described in the document Digital Certificates for ISA Server 2004 at the Microsoft TechNet Web site. Click Next.
   
   
7. On the Specify the Web Mail Server page, enter the name or IP address of the Outlook Web Access server. This name must match the name on the Outlook Web Access server digital certificate. Click Next.
   
8. On the Public Name Details page, provide information regarding what requests will be received by the ISA Server computer and forwarded to the Outlook Web Access server. In Accepts requests for, if you select Any domain name, any request that is resolved to the IP address of the external Web listener of the ISA Server computer will be forwarded to your Outlook Web Access server. If you select This domain name and provide a specific domain name, such as mail.fabrikam.com, assuming that domain is resolved to the IP address of the external Web listener of the ISA Server computer, only requests for https://mail.fabrikam.com will be forwarded to the Outlook Web Access server. Click Next.
   

   Note:
   For ISA Server 2004 Enterprise Edition, the public name must match the name of the digital certificate on the ISA Server array.

9. On the Select Web Listener page, specify the Web listener that you created previously, and then click Next.
   
10. On the User Sets page, the default, All Users, is displayed. This will allow any authenticated user in the External network to access the Outlook Web Access server. To restrict the access to specific users, use the Remove button to remove All Users, and the Add button to access the Add Users dialog box, from which you can add the user set to which the rule applies. The Add Users dialog box also provides access to the New User Sets Wizard through the New menu item. When you have completed the user set selection, click Next.
    
11. On the Completing the New Mail Server Publishing Rule Wizard page, scroll through the rule configuration to make sure that you have configured the rule correctly, and then click Finish.
    
12. In the ISA Server details pane, click Apply to apply the changes you have made. It will take a few moments for the changes to be applied.
    

To take advantage of the ISA Server caching feature, you can create a cache rule to enable caching of the images served by Outlook Web Access. When the ISA Server caching feature is enabled, all Outlook Web Access objects will be cached. This can lead to unexpected logging off of users. To avoid this, you must create a cache rule to prevent the caching of Outlook Web Access objects except for images. The cache rule must have the following properties:

• Cache Rule Destination. Specify a URL set containing http://NameOfOutlookWebAccessServer//exchweb/*. After you create the rule using the New Cache Rule Wizard, open the rule properties, and on the To tab, add http://NameOfOutlookWebAccessServer//exchweb/img/* to the Exceptions. This will allow caching of the img (images) path.
  
• Content Retrieval. Select the option Only if a valid version of the object exists in the cache.
  
• Cache Content. Select the option Never, no content will ever be cached.
  

Create a cache rule as follows:

1. In the console tree of ISA Server Management, click Cache:
   
   • For Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2004, expand Arrays, expand Array_Name, expand Configuration, and then click Cache.
     
   • For Standard Edition, expand Microsoft Internet Security and Acceleration Server 2004, expand Server_Name, expand Configuration, and then click Cache.
     
2. In the details pane, click the Cache Rules tab.
   
3. In the task pane, on the Tasks tab, select Create a Cache Rule to start the New Cache Rule Wizard.
   
4. On the Welcome page of the wizard, provide a name for the rule, and then click Next.
   
5. On the Cache Rule Destination page, click Add to open the Add Network Entities dialog box, select the appropriate network entity, click Add, and then click Close. On the Cache Rule Destination page, click Next.
   
6. On the Content Retrieval page, leave the default selection Only if a valid version of the object exists in the cache, and then click Next.
   
7. On the Cache Content page, select options as described earlier in this procedure.
   
8. You can use the default selections on the remaining wizard pages. Information about cache rule properties is provided in the product Help. Review the information on the wizard summary page, and then click Finish.
   

To configure the Exchange server to use forms-based client authentication, do the following:

1. On the Exchange server, click Start, point to Programs, click Internet Authentication Service, and then click System Manager.
   
2. Select the relevant server, click Protocols, click HTTP, right-click Exchange virtual server, and then select Properties.
   
3. On the Settings tab, click Enable Forms Based Authentication, and then click OK.
   
4. Close System Manager.
   

You can completely block attachments received through Outlook Web Access, so that the user cannot open or save any attachments.

If you do not block attachments, note that some attachments, such as Windows Media® files and Microsoft Excel spreadsheets, cannot be opened directly by a client connected remotely to an Outlook Web Access server. An attempt to open such a file will result in a failure of the application associated with the file. Those files must be saved locally and can then be opened. You can avoid this problem by configuring Exchange Server 2003 and Exchange 2000 Server to force users to save attachments. This feature is not available in Exchange Server 5.5.

To force users to save attachments, configure the following registry key on the Exchange Server computer:

HKLM\SYSTEM\CurrentControlSet\Services\MSExchangeWEB\OWA\Level2FileTypes

This registry value specifies a set of file extensions that are potentially dangerous as attachments. Attachments matching these types will not be opened automatically. Instead, users will be prompted to save the attachments locally on their computers.

Note:
You cannot configure Exchange Server 5.5 to require the saving of attachments.

An external client can access the Outlook Web Access server provided that it can resolve a fully qualified domain name to the external IP address of the ISA Server computer. This would usually be achieved by registering a public Internet domain name with a public Domain Name System (DNS) server that maps the Web site name to the external IP address of ISA Server. To test the deployment in a lab environment, you can specify the Web site host name resolution information using Microsoft Notepad, in the client Hosts file located in \system32\drivers\etc\hosts in the Windows installation directory.

To connect to the Outlook Web Access site from the external client, type the Web address, such as https://mail.fabrikam.com/exchange. Be certain to specify https in the URL, as shown.

When you connect, you should see a logon page requesting credentials and the session type (public or private). You must provide this information before you can access your mailbox.

If you have set time-outs or blocked attachments, you can test those features by leaving the browser inactive for a period of time and then trying to access mail, and by trying to open or save attachments.

From a computer with Internet access, use Internet Explorer to connect to your Outlook Mobile Access DNS address and make sure that Outlook Mobile Access is working properly.

Note:
Although Internet Explorer is not a supported client for Outlook Mobile Access, it is useful to test whether you can communicate with your Exchange front-end server.

After you successfully connect to your Exchange server using Outlook Mobile Access, verify that you can connect to your Exchange server using a supported mobile device with Internet connectivity.

Configure a mobile device to connect to your Exchange server using Microsoft Exchange ActiveSync®, and make sure that ISA Server and Exchange ActiveSync are working properly.

Note:

You can also test Exchange ActiveSync using Internet Explorer. Open Internet Explorer, and in Address, type the URL https://published_server_name/Microsoft-Server-Activesync, where published_server_name is the published name of the Outlook Web Access server (the name a user would use to access Outlook Web Access). After you authenticate yourself, if you receive an Error 501/505 – Not implemented or not supported, ISA Server and Exchange ActiveSync are working together properly.

ISA Server will log the requests that match the mail server publishing rule, if Log requests matching this rule is selected on the Action tab of the rule properties. (This is the default condition.)

To check the logging property of the rule, follow these steps:

1. Do one of the following:
   
   • For ISA Server 2004 Standard Edition, expand Server_Name, and then click Firewall Policy.
     
   • For ISA Server 2004 Enterprise Edition, in the Microsoft ISA Server Management console tree, under Arrays, expand the array that publishes Outlook Web Access, and then click Firewall Policy.
     
2. In the details pane, double-click the mail server publishing rule to open its properties dialog box.
   
3. Select the Action tab and confirm that Log requests matching this rule is selected.
   
   
4. Click OK to close the properties dialog box.
   

To view the information in the log, follow these steps:

1. In the Microsoft ISA Server Management console tree, select Monitoring.
   
2. In the Monitoring details pane, select Logging.
   
3. Create a filter so that you receive only the log information regarding Outlook Web Access access attempts. In the task pane, on the Tasks tab, click Edit Filter to open the Edit Filter dialog box. The filter has three default conditions, specifying that the log time is live, that log information from both the firewall and the Web Proxy should be provided, and that connection status should not be provided. You can edit these conditions, and add additional conditions to limit the information retrieved during the query.
   
4. Select Log Time. From the Condition drop-down menu, select Last 24 Hours, and then click Update.
   
5. You can add another expression by selecting an item from the Filter by drop-down menu, and then providing a Condition and Value. For example, to limit the log to display access to your published Web servers, you can have these expressions: Filter by: Log Record Type, Condition: Equals, Value: Web Proxy Filter, and Filter by: Service, Condition: Equals, Value: Reverse Proxy. This will limit the log to items that match Web publishing rules, including the Outlook Web Access publishing rule.
   
6. After you have created an expression, click Add To List to add it to the query list, and then click Start Query to start the query. The Start Query command is also available in the task pane on the Tasks tab.
   

To monitor the RSA ACE/Server, follow these steps:

1. Do one of the following:
   
   • For Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2004, expand Arrays, expand Array_Name, and then click Monitoring.
     
   • For Standard Edition, expand Microsoft Internet Security and Acceleration Server 2004, expand Server_Name, and then click Monitoring.
     
2. In the details pane, click the Connectivity tab.
   
3. In the task pane, on the Tasks tab, click Create New Connectivity Verifier.
   
4. On the Welcome page of the wizard, type a name for the connectivity verifier, and then click Next.
   
5. On the Connectivity Verification Details page, do the following:
   
6. In Monitor connectivity to this server or URL, type the name of the RSA ACE/Server.
   
7. In Verification method, select Send a Ping request, and then click Next.
   
8. Click Finish.
   
9. In the details pane, select the rule you just created.
   
10. On the Tasks tab, click Edit Selected Verifier.
    
11. On the Properties tab, verify that Trigger an alert if the server response is not within the specified timeout is selected.