Web Monitor Logs

A common question I'm asked, is how can I keep my Web Monitor logs for longer. Ensure you have SP2 Update 1 installed for this feature.

Just feed the logs into a Syslog server, sounds easy...

• Start up the IAG Configuration application
• Select 'Admin' at the top and select 'Event logging'
• Select the 'Syslog' tab and enter in the details of your Syslog server

Sometimes, we just want an easy solution.... and here is one!

I've had a play with a freeware Syslog server called Syslog Watcher, which works very well with this integration, but would welcome any recommendations for Syslog software.

Endpoint Protection should no longer be optional!

Most environments will run a firewall and anti virus software on the computers.

We start to take it one step further where we monitor/filter the users web traffic; we scan inbound (and sometimes outbound) emails; we secure inbound traffic to our networks with a combination of anti virus software, firewalls, reverse proxying, NACs, SSL-VPNs with access policies and two factor authentication; we secure our internet facing services with web application firewall, but this level of protection is often to prevent threats from outside of our organisation.

We all hope we can trust our work colleagues and employees, but an often overlooked security option is what our internal staff may either intentionally or unintentionally cause harm to the the internal systems.

I have a seen a few endpoint protection solutions, and they are either lacking in functionality, or have a wealth of features coupled with a price tag.

I was asked to trial a new offering from Cyberoam, who have previously focused on UTM firewalls and SSL-VPN solutions, but looking to expand their security offering have now produced an endpoint solution, which they have called Cyberoam Endpoint Data Protection (aka Cyberoam EDP).

The Cyberoam EDP solution comes with four components, where you can pick and choose which components you require.

• Device Management
• Application Control
• Asset Management
• Data Protection and Encryption

The Device Management component allows you to define which hardware components can be used on your endpoints. So you can limit access to hardware which are either build in or plugged in, such DVD writers, USB memory sticks, external hard disk drives, etc.

The Application Control component allows the access and blocking of applications, such as peer to peer and IM from either a legality or IT policy persepective, or software such as Photoshop and Office, where you can ensure that they software is only used on certain hardware to maintain correct license useage of software (ie not allow the software to run on more machines that you are legally allowed to)

The Asset Management component allows the auditing and tracking on hardware on your network, and what software is installed where. There is also version tracking, so you can see hardware and software changes within your network.

The Data Protection and Encryption component allows you to create policies to prevent data from leaving your company. These policies can be applied to email, IM and removeable devices, so certain file types or file names can not leave via these transport methods. You also shadow message transfers, so you have records of IM conversations and emails!! The encryption fucntion is for removeable media or when files are transferred.

I tested this on my network and all the functions works perfectly in my test environment, but the limitation was that Windows 7 operating systems and 64-bit operating systems were not supported at time of testing. ( I had a number of Windows 7 machines work perfectly and a couple that did not work, as well as some fuctionality from a 64-bit Windows 7 laptop) The Windows 7 element of the software is currently being tested and a fully supported version of the software is due out soon.

I believe this prodcut will give enterprise levels of security to the SME market.

More information as well as a 30 day free trail is available here: http://www.cyberoam.com/endpointdataprotection.html

If you try it, I'd be interested in your feedback. :)

High Availability for IAG

After four hours on the train today, I spent a fair chunk of today configuring a pair of Celestix Load Balancers for an IAG deployment.

The only way to create IAG in a highly available configuration, is to put the IAG solution behind a front end load balancer. A common question I get asked is why do I recommend a pair of load balancers... well why would specify a solution with multiple application servers, only to place them behind a single load balancer and risk moving your single of failure from the application server, to the load balancing solution.

There are some simple instructions on how to configure the Celestix Load Balancers (CLB) and well documented in the manuals, but here are some headline points when configuring the solution for Direct Server Return (DSR), where the load balancer coming into the IAG solution, but outbound (as the name suggests) the IAG solution will go directly back to the client, rather than through the load balancer.

1. Configure the IAG external IP address to the be the virtual server IP address
2. Ensure DSR is selected in the advanced settings
3. Under the Healthcheck option for the target, ensure PING is off, but check TCPOpen ais enabled for 443,2,10
4. Ensure all IP addresses are unique, including gateways, servers, engines, etc.
5. Create an ISA rule to allow access from the CLB range to the Local Host, for port 443.
6. Create loopback adapters for the WSA appliance, ensuring that there is no gateway, and within advanced ssettings, the Interface Metric is set to 254
7. Ensure VRRP is enable, where both appliances have the same VRID, ensure the Master has a priority of 1 and the backup of 254, on a different network
8. Ensure the local host files that the server name points to the VIP

I had a pretty unique situation today, where four portals were configured on two IAG appliances, with virtual IPs and load balancers.

We ended up using 14 external IP addresses, VIP for each portal (4 external IPs), an external IP for each portal on each appliance (8 external IPs), and a unique IP for each load balancer (2 external IPs). It's very rare to have this many real IPs to play with, but the same principle would apply, if these IPs were internal ones behind a NAT'ing device, which would only have required 4 external IPs (one for each portal)

Ensure you understand the customer requirements and follow the manual.

Good luck with maaking your IAG solutions highly available! :)

Congratulations to Richard Hicks - Microsoft MVP

A big congratulations to Richard Hicks of Celestix, who has been awarded the Microsoft MVP (Most Valuable Professional) for 2009.

There are less than 30 MVPs in the Microsoft Forefront arena worldwide, so you can understand the prestige of this award.

http://tmgblog.richardhicks.com/2009/10/01/microsoft-most-valuable-professional-mvp-2009/

Well done Richard, it's a honour working with you and keep up the good work! :)

ActiveSync on IAG - Certificate Issues

I realised the other day that I hadn't updated the issue that was encountered within this blog post about ActiveSync on IAG.

Well the issue turned out to be certificate related. The Exchange server was using a self signed certificate, so the trusted root certificate had to be added to the mobile devices.

There is some well documented information with regards to configuring Exchange 2003 ActiveSync using a self-signed SSL certificate.

Export the root certificate

1. On the Certificate Authority that issued the certificate to the Exchange server, open the Control Panel and double click Internet Options. NOTE - this guide assumes that you are using a Microsoft CA.
2. Click on the Content tab and then on the Certificates button.
3. Click on the Trusted Root Certification Authorities tab.
4. Locate the trusted root certificate for your domain. It is vital that the certificate be trusted rather than be listed under any other tab. Select the certificate and click on the Export button.
5. The Export Certificate Wizard will be displayed, click Next.
6. Select the option to export the certificate in DER encoded binary X.509 (.CER) format and click Next.
7. Enter a name for the certificate and specify where you would like the file saved. Click Next,
8. Finish and then OK.

Install the root certificate onto the client device

1. Now locate the .cer file created and copy it to your PDA via Microsoft ActiveSync to any folder on the device (for a Windows Mobile device), or using the appropriate synchronisation software for your device. Alternatively the file could also be saved to a memory card or transferred via Bluetooth.
2. On the PDA, open File Explorer and browse to the folder where you saved the certificate.
3. Tap on the icon for the certificate and tap Yes to install it when prompted.
4. On a Windows Mobile device, tap on Start → Settings → System → Certificates → Root and verify that the certificate is listed.
5. You are now ready to use Server ActiveSync securely, using your own SSL certificate.

There is also some useful troubleshooting information here: http://blogs.technet.com/edgeaccessblog/archive/2008/07/29/publishing-microsoft-activesync-through-iag-2007-part-2-of-2.aspx

Barracuda EMEA Partner Conference & Barracuda Backup Service

I returned from Prague inspired with the Barracuda philosophy, as well as getting a better insight into the existing product range, and new products and features.

It was great to meet the senior management team of Barracuda, and meet people so driven and inspired by them.

It was also a good opportunity to meet existing e92plus resellers and our Dutch work colleagues from e92plus NL, as well as meet other resellers from around EMEA. It was good to meet Keith, who recognised me from this blog!

The product the caused the most buzz at the conference was the new Barracuda Backup Service.

Using a Barracuda appliance and software agents, you will be able to back up the servers within your organisation. This will obviously give a great alternative to existing tape back ups, but easy restoration and aaccessibility to your data as the appliance is onsite.

Obviously, you will say, what if something were to happen to the building, datacentre, appliance, etc, well the other component of the service is an offsite back solution. Previously this service was only available in the States, but due to some data laws within Europe, the data should not be store outsite of certain countries or Europe. The new datacentres for this European wide launch of this solution will be based in the UK, with new datacentres opening around Europe as and when.

This will allow data to be backed up onsite and allow quick restoration. In a DR situation, the data can be restore from the datacentres. You are able to select which data is sent offsite, so you are able to stop certain data from leaving your organisation.

More detailed information on the Barracuda website regarding the Barracuda Backup Service

The product is officially being launched on the 14th October at Storage Expo 2009 , and e92plus are holding sales training on 23rd October

How much is the service, well aside from the appliance and subscription cost, the offsite data storage is purchased in 100GB chunks, at only....... €69 per month per 100GB!!!

Work out the cost of your existing tape solution, and the savings will become obvious.

Virtualisation on Windows 7 64 Bit?

As you may have guessed, I'm currently running Windows 7 Enterprise 64-bit on my new laptop. All is going well, but I have encountered an issue!!

I have a number of Virtual PC guests which use the old version of Virtual PC. I have obviously install Virtual PC RC, in order to achieve the XP Mode, which allows me to use IAG within the 64 bit environment.

My older Virtual PC files don't work in Virtual PC RC!!

So sensing a time for change and to purge the elements I don't use, I recreated the Virtual PC sessions on VPC RC. It's at this point, I think I should try out UAG in a demo environment, but as I have to use Windows 2008 R2 Beta, I discover that Virtual PC doesn't support a 64 bit environment and I seem to get jerky guest sessions unless I allocate a lot of memory and install the integration software, so what are my alternatives:

I have used VMWare Server in the past, and although the software supports 64 bit clients, but the amount of services the software uses up, makes me investigate how to stop these services when I don't use VMWare. I end up switching all the VMWare services to Manual, and then create a batch file to initiate them.

After much snooping and Googling, I discover Sun VirtualBox

I find that it is very easy to use, it will support 64 bit clients (which seems to be better tab) and it is effiecient with its resources (unlike VMWare)

Sun VirtualBox is now my main client for any virtualised environment!! (and best of all, it's free!!)