Because you will publish the Configuration Storage server over LDAPS, you will have to install a certificate on the server, and associate that certificate with the Configuration Storage server service.

If you are using a server certificate issued by a private certification authority, you must install the root certificate on the ISA Server array members. This document does not provide the details of certification authority installation or issuing of certificates, which is described in "Digital Certificates for ISA Server 2004" at the ISA Server TechCenter.

After you have installed the certificate on the Configuration Storage server computer, you have to associate it with the Configuration Storage server, by using the ISA Server Repair functionality.

Use one of the following two procedures (using IsaCertTool, or the ISA Server Repair functionality) to associate the certificate with the Configuration Storage server. These procedures require that the Configuration Storage server has already been installed.

To install a certificate on the Configuration Storage server using ISACertTool

1. Download ISACertTool, available at the ISA Server Downloads page.

2. Copy the ISACertTool program to the directory \Program Files\Microsoft ISA Server on the Configuration Storage server.

3. From a command prompt in the \Program Files\Microsoft ISA Server directory, type ISACertTool, using this syntax:

   ISACertTool /st file_name [/pswd password] [/keepcerts]

Where:

• /st file_name installs the exported certificate on the Configuration Storage server. File_name specifies the path and name of the exported .pfx certificate file.
  
• /pswd password specifies the password that may be required when installing the server certificate. It is only required if a password was specified during export of the certificate file.
  
• /keepcerts specifies that existing certificates should not be deleted. By default when you run ISACertTool.exe, all certificates in the Active Directory® Application Mode (ADAM) ISSTGCTRL local store are erased. To specify that existing certificates should not be deleted, specify the /keepcerts parameter.
  

To install a certificate on the Configuration Storage server using Repair

1. On the server that you are going to publish, insert the ISA Server CD into the CD drive, or run ISAAutorun.exe from the shared network drive.

2. In Microsoft ISA Server Setup, click Install ISA Server 2006 to start the installation wizard.

3. On the Program Maintenance page, select Repair, and then click Next.

   

4. On the Enterprise Deployment Environment page, select I am deploying in a workgroup or a domain without trust relationships. Provide or browse to the certificate name, provide the certificate password, and then click Next.

   

5. On the Locate Configuration Storage Server page, provide the fully qualified domain name of the Configuration Storage server that you are going to publish, and then click Next.

6. On the Configuration Storage Server Authentication Options page, select Authentication SSL encrypted channel. Select Install a trusted root certificate, and provide or browse to the name of the root certificate.

7. Review the Services Warning page, and then click Next.

8. Click Install to install the changes.

9. When the changes have been made, click Finish to close the wizard.

ISA Server must be configured as the default gateway on the Configuration Storage server. Set the default gateway to be the IP address of the ISA Server computer network adapter through which the Configuration Storage server connects to the ISA Server computer, for example, the internal network adapter. If you are using Network Load Balancing (NLB) on the internal adapters on an ISA Server array, specify the virtual IP address.

We recommend that you limit the new rule to apply only to the ISA Server computers in the branches that require access to the securely published Configuration Storage server. This improves the security configuration of your publishing rule. To do this, you will require a computer set.

To create a new computer set

1. In ISA Server Management, click the Firewall Policy node.

2. On the Toolbox tab, under Network Objects, click New, and select Computer Set.

3. In the New Computer Set Rule Element dialog box, provide a name for the computer set, and then click Add as necessary to add the computers, IP address ranges, or subnets that will include only the ISA Server computers in the branches that require access to the published Configuration Storage server.

   

4. Click OK to close the New Computer Set Rule Element dialog box.

To publish the Configuration Storage server, create a server publishing rule.

To create a server publishing rule

1. In ISA Server Management, select Firewall Policy.

2. In the task pane, on the Tasks tab, click Publish Non-Web Server Protocols to open the New Server Publishing Rule Wizard.

3. On the Welcome page, provide a name for the rule, such as Secure Configuration Storage Server Publishing, and then click Next.

4. On the Select Server page, in Server IP address, type the IP address of the Configuration Storage server, and then click Next.

5. On the Select Protocol page, from the drop-down menu, select MS Firewall Secure Storage Server. Click Ports, and under Firewall Ports, select Publish on this port instead of the default port, and provide the port number 2174.

   

6. Click OK, and then click Next.

7. On the Network Listener IP Addresses page, under Listen for requests from these networks, select the networks on which you want to listen for connection requests. For a branch office that will be connecting over the Internet, select External. Click Next.

   Note:
   You can select specific IP addresses that ISA Server will listen on. To do this, click the Address button, and then for the selected network, specify the IP addresses that ISA Server will listen on. The address that the name of the Configuration Storage server resolves to must be one of the listening addresses of ISA Server.

8. Click Finish to close the New Server Publishing Rule Wizard.

9. In the details pane, on the Firewall Policy tab, under the Name column, double-click the new rule to open its properties.

10. On the From tab, under This rule applies to traffic from these sources, select Anywhere, and then click Remove.

11. Click Add. From the Add Network Entities dialog box, add the computer set that you created containing the ISA Server array members. Click OK to close the rule properties.

    Note:
    On the To tab of the publishing rule, under Requests for the published server, there is an option Requests appear to come from the ISA Server computer. This option can be used when you have not configured ISA Server as the default gateway on the published server.

12. In the details pane, right-click the rule and select Disable. Leave the rule disabled until it is needed. When the rule is needed, it can be enabled from a location other than the branch array (which will not have connectivity when the rule is needed).

13. In the details pane, click the Apply button to apply your changes.

Follow this procedure to configure ISA Server to use the alternate Configuration Storage server.

To configure the ISA Server array to use the alternate server

1. In the console tree of ISA Server Management, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, and then click the name of the applicable array.

2. On the Tasks tab, click Configure Array Properties.

3. On the Published Configuration Storage tab, select Over a VPN site-to-site connection.

4. In Alternate securely published Configuration Storage server, provide the name or IP address of the published server. Click OK to close the property page.

   

5. In the details pane, click the Apply button to apply your changes.

You will connect to the published Configuration Storage server by requesting a name that resolves to the external IP address of the ISA Server array that is publishing the server. For this reason, you must ensure that the name can be resolved, for example by a public Domain Name System (DNS) server, a local DNS server, or a Hosts file entry. That name must match the name on the Configuration Storage server certificate.

This procedure is required only if you use IPsec tunnel mode to establish the VPN tunnel between the branch and the primary Configuration Storage server. When you access the published Configuration Storage server, ISA Server will accept the connection from an external IP address. For a branch that connects using VPN tunnel mode, ISA Server will assess that the packet is from a VPN network, and will try to establish a VPN tunnel. Because the tunnel cannot be established, the packet will be dropped.

Perform this procedure only when you require connectivity to the alternate published Configuration Storage server.

To configure IPsec tunnel mode IP addresses

1. In the console tree of ISA Server Management, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, and expand the applicable array (the headquarters array).

2. In the console tree, select the Virtual Private Networks (VPN) node. On the Remote Sites tab, in the details pane, double-click the IPsec VPN network to open its properties.

3. On the Addresses tab, select the branch ISA Server external IP address and click Remove.

4. Click OK to close the VPN network properties.

5. In the details pane, click the Apply button to apply your changes.