Microsoft IAG SP2 Update 3

Information from Microsoft regarding: IAG SP2 Update 3

Once this has been tested by Celestix, it will be available for download from the webiste.

It will also give me a chance to test it in my lab as well.

Microsoft Forefront TMG (Threat Management Gateway) - Introduction

Microsoft TMG is the successor to ISA Server 2006, which still has the features from ISA, such as an application layer enterprise class firewall, with proxy, cache and VPN services. So all the good things from ISA 2006 that we know and love are still there.

 

There are many new features within TMG, including:

• Gateway anti-virus scanning, which uses the Microsoft scanning engine
• URL filtering, which can web traffic using Microsoft Reputation Services
• HTTPS inspection, using dynamically, self signed or trusted CA certificates
• Network Inspection System, which is vulnerability based intrusion dection & prevention
• Email Protection, as TMG can be the Exchange Edge Transport for Exchange 2007 SP2 or 2010, as well Forefront protection for Exchange
• Remote Access, using SSTP, Direct Access and NAP integration
• Forefront Protection Manager integration
• SCOM 2007 & 2007 R2 integration
• ISP redundancy for two links
• VoIP (SIP) support
• Enhanced NAT, to allow one-to-one NAT

Thanks to Celestix, and Richard Hicks for providing the above information.

 

At e92plus, we have a webinar to give a more comprehensive introduction to Microsoft TMG and the Celestix MSA appliance range.  Book your place here

e92plus are awarded Microsoft Gold Certified Partner status

More information here: Microsoft Gold Certified Partner status for e92plus


- Posted using BlogPress from my iPhone

Routing issues on IAG

I was asked this evening by a friend and customer why he was unable to remotely access a Celestix WSA appliance via a VPN, but able to access via an RDP session from one of the servers on the LAN.

There is a site to site IPSEC VPN between the two sites and the remote site subnet had been added into the Remote Management trusted subnets.

The issue lies with the Microsoft ISA 2006 component within the Celestix WSA appliance, that is used to protect Microsoft IAG.

First of all I would create a static route on the appliance. This can be done either by using the command line and adding a persistent route, using the jog dial on the front of the Celestix WSA appliance or using the Celestix Web UI (:10000) select "Network", then "Routing" and then "Static Routes", where you can create a new static route.

Once this is done, I would start up Microsoft ISA Server on the appliance, expand "Configuration", select "Networks", go to the "Networks" tab, right click for "Properties" of the internal network, select the "Addresses" tab, click the "Add Adapter" button, and select the "LAN" tickbox.
This will apply the all the routes that the LAN card can see, including the new static route(s). Once trusted, you will be able to access resources within the defined subnets, and ISA will be able to allow the traffic defined from the site to site VPN.


- Posted using BlogPress from my iPhone

Moving my blog & Celestix

Well looks like Google no longer want to support users who want to upload their blogs via FTP after March.

So I'm changing the URL to http://blog.andytang.com and pointing that cname to Google, rather than host it.

When I get a chance, I'll create either a redirection or a link on the www site.

It now also always me to blog via my iPhone which a bonus!

I'm currently on my way to Reading to see Richard Hicks and Doc Miller again. I had the pleasure of their company yesterday at our office and today is a reseller techical briefing day at the Celestix office in Reading.

- Posted using BlogPress from my iPhone

Sport Relief - I'm running six miles!!

I'm doing my bit for Sport Relief by running six miles, but you don't have to run... you only have to sponser me!

Whatever you can afford would be gratefully recieved: http://www.mysportrelief.com/andytang

IAG Logs - Extending?

A common issue raised by customers have been regarding how far back the IAG logs can go back.

I have posted in the past about how to use Syslog server with IAG, which will allow the logs to be stored elsewhere for longer, but you may still have issues with what or how much is being reported.

Extending your historical logs:

• In the IAG Configuration console, select the "Admin" menu and select "Event Logging"
• Select the "General" tab
• Change the "Queue Size" to 100
• Change the "Max Report Results" to 10000
• Click on "OK"
• Activate the IAG Configuration

Change the settings for report clean up:

• In the IAG Configuration console, select the "Admin" menu and select "Advanced Configuration"
• Change "Start Cleanup at:" to 10000
• Change "Stop Cleanup at" to 100
• Change "Number of Undeleted Files" to 100
• Click on "OK"
• Activate the IAG Configuration

You may need to wait up to 48 hours to see if these changes have helped, but these settings can be tweaked further to fine tune the logs for your reporting needs.