Publish Http/Https server Using ISA 2006 Firewall Server

Table of Contents

• Exposing Websites.

• Assumptions:

• Configure http website.

• Enable Http compression.

• Creating rule to expose Website on HTTP.

• Configure HTTPS Websites.

• Expose Https server by using Apache self signed Certificate.

• Expose Https server by using. Cert & .Pfx file (These you need to install on your ISA server).

Exposing Websites.

Assumptions:

• Application is running on JBoss server using port 80.
• Apache configured on port 8080 pointing JBoss for added security & http compression.
• Local users access the URL http://localhost:8080/digite
• Users on Internet will access the same on port: 9090 using ISA2006 supporting http compression. Note: Http compression – this feature is available only on ISA2006 & ISA2004 with SP2.

Configure http website.

• Log on to ISA server as ISA Administrator.
• Open ISA Server Management Console. Refer the screen shot below.

Enable Http compression.

• Click on Arrays - Tulips (Arrays server name) - ConfigurationàGeneral
• From General Menu Click Define HTTP Compression Preferences. Refer the screen shot below

• Check Enable Http Compression – Apply - Ok

Creating rule to expose Website on HTTP.

• Click Arrays server – Firewall Policy - From Right Site Menu Click on Task - Publish Web Sites. (See the screen shots)

• Give the web publishing rule name.

• Select Allow and Click Next. Refer the screen shot below

• Select Publish a single web site or load balancer. Refer the screen shot below

• Select Use non-secured connections to connect the published web server or server farm. Refer the screen shot below

• Give internal site name (i.e. user server name), enter your server’s IP address. Refer the screen shot below.

• Path (optional) – This field should be left empty; Select Forward the original host header instead of the actual one specified in the internal site name field on the previous page. Checkbox. Refer the screen shot below.

• Select any domain name. Click Next. Refer the screen shot below.

• Web Listener windows will appear then click on New.

• Click on New tab for creating new web listener for External Port mapping. Refer the screen shot below.

• Select Do not require SSL secured connection with clients, then click Next. Refer the screen shot below.

• Select External Network and check ISA Server will compress content…..; Click Select IP Addresses. Refer the screen shot below.

• Select Specified IP address on the ISA Server…. And click on Add - Ok. You can add multiple IP address on External card. For example - Refer the screen shot below. We have selected 61.12.28.75 IP which means we are exposing Server over the Internet with This IP and particular port.

• Select No Authentication. (Or you can use any credentials as per your network setup)

• Click on Next - Finish.

• Next windows you will see by default http port on 80. Refer the screen shot below.

• Change the same from 80 to 9090, to do this; click Edit – Connections - Check Enable Http connection on port: 9090 – Apply - Ok
  Note: Port number is the one which you want your website to be published on the internet. Refer the screen shot below.

• Click - Next

• Select No Delegation and client cannot authenticate directly from the drop down menu and click next. Refer the screen shot below.

• Select All users  - Next - Finish.
  Note: This setting is require to allow anonymous access.

• By default internal server port is also set on 80; in this case we need to change the same as the internal apache server running on port 8080. Right click on that rule we just created – Properties – Bridging - Check on Redirect request to Http port: 8080. Refer the screen shot below.

• Click on Traffic – Filtering - Configure HTTP. Refer the screen shot below.

• From General Tab - Uncheck - Verify normalization & Block high bit characters. Refer the screen shot below.

Now Your Internal http server is available to access from Internet.

Try accessing the same using your exposed URL.

For example http://Internet_IP:9090/digite

 

Configure HTTPS Websites.

To Expose Https server, we have two methods.

1. Expose Https server by using Apache self signed Certificate.
2. Expose Https server by using. Cert & .Pfx file (These you need to install on your ISA server).

Expose Https server by using Apache self signed Certificate.

To use Apace with Https, you need to configure your Jboss (application server) with apache first on Https port with Self-signed certificate.

Example: Internal application Https access- https://localhost/deployment

• Open ISA Server Management Console.

• Now we are going to Create Exposed rule for application on Https.
• Click on Arrays server - Firewall Policy - From Right Site Menu Click on Task - Publish Non-Web Server Sites.
• Enter Server publish rule name.

• Enter your server IP Address - Next.

• Select HTTPS Server Protocol - Next.

• Select External - Address.

• Select Specified IP address on the ISA Server External LAN card Internet IP then click on Add - Ok

• Click on Next - Finish.

Now Your Internal https server is available to access from Internet.

Ex: https://Internet_IP/digite

 

Expose Https server by using. Cert & .Pfx file (These you need to install on your ISA server).

This Method use for to Expose Http (application server) over the Internet on Https port.

First we need to install Certificate on ISA server.

To Install Certificate on ISA Server do following steps.

• Start – Run - mmc - Enter (below screen will be appear)

• Click on File - Add/Remove Snap-in – Add - Select Certificates - Add

• Select Computer account – Next - Select Local computer – Finish - then close that Window.

• Below Windows will be appears.

• Right click on – Personal - All Task - Import.

• Certificate import wizard will start, click on Next Tab.

• Browse for Certificate file, give the path where you store cert file. (See screen shots).

• Select the Personal folder – Next - Finish. (Certificate import is completed prompt will be display) your certificate installation is done.

• Do the above steps for importing (.pfx) file.

Certificate and pfx installation completed, now we are going to Create rule for Expose Https Server.

• Open ISA Server Management Console.

• Now we are going to Create Exposed rule for application on Https.
• Click on Arrays server - Firewall Policy - From Right Site Menu Click on Task - Publish Web Server Sites.
• Enter Server publish rule name.

• Click on Next - Select Allow – Next - Select Publish a Single web site or load balancer – Next - Select Use SSL to connect published web server - Next

• Enter Internal site name- (Server Name), Enter Server IP Address - Next.

• In Path- leave it Empty; Select Forward the original host header instead of the actual one specified in the Internal site name field on the previous page. (See screen shots)

• Select any domain name - Next (See screen shots)

• Web Listener windows will appears then click on New.
• Enter External Listener name - Next
• Select Require SSL Secured connection with clients - Next.

• Select ISA Server will compress content option, Select External network - click on Select IP Address

• Select Specified IP address on the ISA Server External LAN card Internet IP then click on Add - Ok

• Select Use a single certificate for this Web Listener - click on Select Certificate.

• Select your server certificate. (Which one that you create for Https server).

• Select No Authentication – Next - on Next window – Next - Finish.

• Above window will appears then click on Next - Select No Delegation and client cannot authenticate directly – Next - Select All Users - Finish.

Now Your Internal http server is available to access from Internet on Https port.

Ex: https://Internet_IP/digite