"Charting the Course... MOC A Planning, Deploying and Managing Microsoft Forefront TMG Course Summary

Transcription

1 Description Course Summary The goal of this three-day instructor-led course is to provide students with the knowledge and skills necessary to effectively plan, deploy and manage Microsoft Forefront Threat Management Gateway. Objectives At the end of this course, students will be able to: Describe the functionality provided by TMG and Explain valid deployment scenarios. Install and maintain TMG and install and configure TMG clients. Configure secure access to Internet resources for internal network clients using TMG. Configure the following TMG roles: Firewall Role Web Proxy/Caching Role Logging Role VPN Role Configure secure access to internal network resources for Internet clients who are using Web and Server publishing rules. Configure Intrusion Detections and Malware inspection. Configure TMG to provide secure access to Exchange and SharePoint Server for servers and clients located on the internet. Configure Application, Web and URL Filters on TMG. Deploy a Virtual Private Network for remote clients and remote networks using TMG using: L2TP over IPsec PPTP NAP Integration SSTP Manage TMG using scripts. Design and Implement a TMG disaster recovery plan Deploy TMG Enterprise in High Availability configurations. Topics Overview of Microsoft Forefront TMG Installing Forefront TMG Configuring TMG as a Firewall Configuring TMG as a Proxy/Caching Server Configuring TMG Client Protection Publishing Client Access to Internal Resources Audience Publishing Exchange and SharePoint Client Access Configuring Remote Access Logging, Reporting and Monitoring Backing Up, Restoring and Troubleshooting TMG Appendix A: Advanced Features Appendix B: Advanced Networking This course is intended for Security Professionals, Systems Engineers, Network Administrators, IT Professionals, Consultants and other people responsible for implementing network and perimeter security measures, including Internet firewalls, application layer filters, and screened networks. They will also implement caching servers and additional mechanisms to protect public-facing servers. These individuals will have a need to simplify ongoing management, reduce support costs and prevent security breaches.

2 Course Summary (cont d) Typical environments in which they work have the following characteristics: Supported users ranging from 50 to 10,000+ Multiple physical locations Typical products and technologies used with a Forefront TMG solution include: Windows Server 2008, Active Directory, Internet Information Services (IIS), Load Balancing, Failover Clustering, Network Access Protection, Microsoft Exchange, Microsoft SharePoint Technologies, and other 3rd party network security products and technologies. Prerequisites Microsoft Windows Server 2003/2008 operating system and network concepts. Basic understanding of common internet protocols, such as HTTP, SMTP, IPsec, PPTP and so on. Experience implementing network resources such as Web, FTP, VPN, Exchange and SharePoint. Duration Three days

3 Course Outline I. Overview of Microsoft Forefront TMG This module provides an overview of Forefront TMG. Lessons presented in this module will provide an understanding of firewalls and routers, the logical and physical architecture and the features and licensing of TMG. You will also learn the difference between TMG, UAG and ISA Server 2006 and learn the various deployment scenarios. A. Introduction to Firewalls and Routers B. Firewalls and Routers C. Designing and Placement of Firewalls D. Introducing TMG and the Forefront Family E. What is the Forefront Family of Products F. TMG Principles and Architecture G. TMG Licensing and Scenarios H. Difference between TMG and UAG I. Overview of TMG Features J. Main Features of TMG K. What is new in TMG compared to ISA 2006 L. TMG Enterprise Features M. TMG Management Console N. Deployment Scenarios O. How TMG works as a Firewall P. How TMG works as a Proxy/Cache Q. How TMG provides Access to Internal Resources R. How TMG Protects Web and Mail Clients S. How TMG Provides Secure Remote Access T. How TMG Provides High Availability in the Enterprise U. Understand what Firewalls and Routers are. V. Know what is Forefront TMG and the Forefront family. W. Know the features of Forefront TMG. X. Understand the deployment scenarios for Forefront TMG. II. Installing Forefront TMG This module describes how to install Forefront TMG. Lessons presented in this module will detail the requirements of TMG, applying security templates and customizing the configuration. A. Installing TMG B. System and Hardware Requirements C. Software Requirements D. Network Considerations E. Installing TMG F. Automating the Installation G. Installing the Management Console H. Working with Quick Configurations I. Understanding TMG Default Configuration J. Automating Configure the Getting Started Wizard K. Using Pre-defined Security Templates L. Customizing the Configuration M. Configuring Administrative Roles N. Configuring Networks and their Relationships O. Creating and Configuring Networks P. Modifying Network Rules and Routing Q. Troubleshooting Network Connectivity R. Lab : Installing Forefront TMG S. Review the Requirements to install TMG and configure LAN T. Installing Forefront TMG Server U. Install the Management Console on a Client Machine V. Lab : Working with Quick Configurations W. Configure TMG using the Getting Started Wizard X. Use the Web Access Wizard Y. Configure the Management Console for a Client Machine Z. Create and Access Rules AA. Lab : Working with TMG Networks BB. Configuring Network Configuration of a new Network Card CC. Create a new Network DD. Creating an E-NAT rule EE. Adding Routs to TMG FF. Install Forefront TMG. GG. Work with Quick configurations. HH. Configure additional networks. III. Configuring TMG as a Firewall This module describes how to configure the firewall role on TMG. Lessons presented in this module will provide an overview of the firewall role and how to configure firewall rules and system policy rules. You will also configure and monitor Intrusion Detection and Network Inspection Systems (NIS). A. Overview of TMG as a Firewall B. The Basics OSI vs. TCP/IP C. What is Filtering D. What is Intrusion Detection E. How TMG Filters Network Traffic F. Configuring Firewall Rules G. Understanding Firewall Policy Evaluation H. Adding Access Rules I. Default System Policy Rules J. Troubleshooting Firewall Rules K. Troubleshooting Firewall Rules Tools L. Configuring Intrusion Detection M. Overview of Intrusion Prevention N. Configuring Network Inspection Systems O. Implementing Intrusion Detection

4 P. Monitoring Intrusion Detection Q. Lab : Working with Firewall Rules R. Create and Configure Access Rules S. Modify the System Policy Rules T. Troubleshoot Firewall Rules U. Lab : Working with Intrusion Detection V. Configure NIS Deployment W. Create and Alert for Intrusion Detection X. Configure Intrusion Detection Y. Understand how TMG works as a firewall. Z. Configure Rules on the firewall. AA. Configure intrusion detection. IV. Configuring TMG as a Proxy/Caching Server This module describes how to configure the proxy and caching roles on TMG. Lessons presented in this module will explain the proxy and caching roles and how to configure and troubleshoot these roles. You will also learn about Cache Array Routing Protocol (CARP), Web Proxy Auto Discovery (WPAD) and how to configure and troubleshoot CARP and WPAD. A. Configuring the Proxy Server Role B. What is a Proxy C. Enabling and Configuring a Proxy D. Configuring Applications E. Troubleshooting Proxy Connections F. Configuring Caching Server Role G. What is a Proxy Cache H. Configuring TMG Proxy Cache I. Troubleshooting Cache Performance J. Configuring Cache Routing and Distribution K. Understanding CARP L. Configuring CARP Routing M. Configuring Web Proxy Auto Discovery N. WPAD Configuration O. Configuring Auto Discovery P. Configuring TMG Clients Q. Types of TMG Clients R. Choosing and Designing Clients S. Configuring TMG Client Software Clients T. Configuring SecureNAT Clients U. Lab : Working with Proxy Configurations V. Enable and Configure a Web Access Policy W. Configure Internet Explorer to use TMG Proxy X. Configure Mozilla Firefox to use TMG Proxy Y. Lab : Working with Cache Configurations Z. Create a Cache Drive AA. Create a Cache Rule BB. Create a Content Download Job CC. Lab : Working with Cache Routing and Distribution DD. Inspect Array Communications EE. Inspect and Adjust CARP Load Factor FF. Lab : Working with Web Proxy Auto Discovery GG. Configure DHCP for Automatic Discovery HH. Configure DNS for Automatic Discovery II. Enable Automatic Discovery on TMG JJ. Configure a Client for Automatic Discovery KK. Lab : Working with TMG Clients LL. Inspect and Verify TMG Client Server Settings MM. Install the TMG Client Software NN. Configure Client as a SecureNAT Client OO. Configure the Proxy Server Role. PP. Configure the Caching Server Role. QQ. Configure Cache Routing and Distribution. RR. Configure Web Proxy Auto Discovery. SS. Configure TMG Clients. V. Configuring TMG Client Protection This module describes how to configure client protection using TMG. Lessons presented in this module will provide an overview of Malware Inspection, URL Filtering, Inspection, Application Filter and HTTP/HTTPS Inspection. You will also learn how to implement, configure, monitor and troubleshoot using these tools and techniques. A. Configuring Malware Inspection B. Overview of Malware Inspection C. Implementing Malware Inspection D. Monitoring Malware Inspection E. Configuring URL Filtering F. Overview of URL Filtering G. Understanding Microsoft Reputation Services H. Implementing URL Filtering I. Monitoring URL Filtering J. Configuring Inspection K. Understanding Threats L. Implementing Inspection M. Configuring Exchange for Inspection N. Monitoring Inspection O. Configuring Application Filters P. Overview of Application Filters Q. DNS Filter R. FTP Access Filter S. H.323 Filter T. Session Initiation Protocol Filter U. Streaming Media Filter V. Socks Filter W. Other Filters X. Configuring HTTP/HTTPS Inspection Y. Overview of HTTP/HTTPS Application Filter Z. Configuring HTTP/HTTPS Filters AA. Monitoring HTTP/HTTPS Filters BB. Lab : Working with Malware Inspection CC. Enabling Malware Inspection DD. Configuring Malware Inspection Settings

5 EE. Creating an Access Rule FF. Testing Malware Inspection GG. Lab : Working with URL Filtering HH. Enabling URL Filtering II. Testing Websites JJ. Creating your own Category Set KK. Using URL Filtering LL. Creating an Overriding Rule MM. Lab : Working with Inspection NN. Configuring SMTP Protection OO. Configuring Content Filtering/Spam Filtering PP. Lab : Working with Application Filters QQ. Configuring the DNS Filter RR. Configuring the DNS Filter with Scripts SS. Configuring the FTP Access Filter TT. Lab : Working with HTTP/HTTPS Filters UU. Enabling HTTPS Inspection VV. Creating your own Domain Name Set WW. Configuring Exceptions XX. Exporting HTTP Filter Configuration YY. Importing the HTTP Filter Configuration ZZ. Configure malware inspection. AAA. Configure URL filtering. BBB. Configure inspection. CCC. Work with Application Filters. DDD. Configure HTP/HPPTS inspection. VI. Publishing Client Access to Internal Resources This module describes how to publish client access to internal resources. Lessons presented in this module will provide an overview of publishing, publishing rules. You will also learn how to configure publishing for Web, HTTPS and miscellaneous servers. A. Introduction to Publishing B. What is Publishing? C. Available Publishing Rules D. How are Publishing Rules Evaluated? E. Configuring Web Publishing F. Configuring Path Mappings G. Configuring Web Listeners H. Configuring Link Translations I. Implementing Web Publishing J. How Web Server Publishing Authentication Works K. Using RADIUS for TMG Authentication L. Using 3rd Party Authentications M. Configuring HTTPS Server Publishing N. Preparing TMG for SSL O. Configuring SSL Bridging P. Configuring SSL Tunneling Q. Implementing HTTPS Web Server Publishing R. Configure Server Publishing S. How Server Publishing Works T. Configuring a Server Publishing Rule U. Troubleshooting Server Publishing V. Lab : Working with Web Publishing W. Create a new Listener X. Create a new Web Publishing Rule Y. Testing Access to the Published Web Server Z. Lab : Working with HTTPS Web Server Publishing AA. Request a new Certificate for the Web Server BB. Export Certificate from Web Server CC. Configure Web Site for SSL DD. Import Certificate to TMG Server EE. Create a Web Site Publishing Rule FF. Create an Alias (CNAME) on DNS Services GG. Test Access to the Published Web Server HH. Lab : Working with Server Publishing II. Publishing DNS Services JJ. Testing Published DNS Server KK. Configure Web Publishing. LL. Configure HTTPS Server Publishing. MM. Configure Server Publishing. VII. Publishing Exchange and SharePoint Client Access This module describes how to publish client access to internal Exchange and SharePoint server resources. Lessons presented in this module will describe the configuration requirements and how to configure SMTP access rules. You will also learn how to publish Exchange and SharePoint client access. A. Sending and Receiving Internet Messages B. SMTP Configuration Requirements C. Creating an Outbound SMTP Access Rule D. Publishing SMTP Service E. Publishing exchange Client Access with TMG F. Exchange Configuration Requirements G. TMG Configuration Requirements H. Creating a Web Listener I. Creating Exchange CAS Publishing Rules J. Enabling Additional Features K. Troubleshooting Exchange Publishing L. Publishing SharePoint Client Access with TMG M. SharePoint Configuration Requirements N. TMG Configuration Requirements O. Creating a Web Listener P. Creating a SharePoint Publishing Rule Q. Lab : Working with SMTP Publishing Rules R. Create Mail Server Publishing Rule S. Test Access to Published SMTP Service T. Lab : Publishing Exchange Client Access U. Export Certificate from Exchange Server V. Configure Exchange Server Authentication

6 W. Add IP Address to the External Interface on TMG Server X. Import Certificate to TMG Server Y. Create and Exchange Outlook Web Access Publishing Rule Z. Create and Exchange ActiveSync Publishing Rule AA. Create an Exchange Outlook Anywhere Publishing Rule BB. Test Publishing Rules Settings CC. Test Access to Outlook Web App DD. Lab : Publishing SharePoint Client Access EE. Request a new Certificate for SharePoint Server FF. Export Certificate from SharePoint Server GG. Configure SharePoint Alternative Access Mapping HH. Configure SharePoint IIS for SSL II. Create an Alias (CNAME) on DNS Services JJ. Add an IP Address to an External Interface on TMG Server KK. Import Certificate to TMG Server LL. Create a SharePoint Site Publishing Rule MM. Test Access to SharePoint Server NN. Configure TMG for Sending and Receiving Internet Messages. OO. Publish Exchange Client Access with TMG. PP. Publish SharePoint Client Access with TMG. VIII. Configuring Remote Access This module describes how to configure different remote access scenarios using TMG. Lessons presented in this module will provide an overview of Virtual Private Networks and how to enable /configure VPN for Secure Remote Access, Site-to-Site VPNs and Quarantines. A. Overview of Virtual Private Networks B. What is a Virtual Private Network (VPN)? C. Available Options for VPN D. What is a VPN Quarantine? E. Configuring VPN for Secure Remote Access F. Enabling a VPN G. Configuring Authentication H. Configure VPN Clients I. Troubleshooting a VPN J. Configuring a Quarantine K. Radius-Based vs. TMG Quarantine Control L. Implementing Radius-Based Quarantine Control M. Implementing TMG Based Quarantine Control N. Troubleshooting Quarantine Control O. Configuring a Site-to-Site VPN P. Selecting Tunneling Protocols Q. Enabling Site-to-Site VPN R. Configuring the VPN Gateway Servers S. Troubleshooting Site-to-Site VPN T. Lab : Working with VPN Secure Remote Access U. Configuring VPN Client Access on TMG Server PPTP V. Create a VPN Client Connection to use PPTP W. Request a new Certificate for TMG Server X. Configuring VPN Client Access on TMG Server SSTP Y. Edit VPN Client Connection to use SSTP Z. Lab : Working with a Quarantine AA. Configuring RADIUS Authentication BB. Configuring Authentication Method CC. Configuring Quarantine Control DD. Configuring Network Policy Server to use TMG as a RADIUS Client EE. Testing Connection FF. Describe how VPNs work. GG. Configure VPN for Secure Remote Access. HH. Configure a Quarantine. II. Configure a Site-to-Site VPN. IX. Logging, Reporting and Monitoring This module describes the logging, reporting and monitoring tools available in TMG. Lessons presented in this module will provide an overview of the monitoring options available, how to configure alerts, session monitoring filters and log storage options. A. Overview of Monitoring B. Why Monitor TMG C. Available Monitoring Options D. Configuring Alerts E. What is an Alert? F. Viewing Alerts G. Managing Alerts H. Configuring Alerts I. Configuring Alerts Actions and Tasks J. Creating Custom Alerts and Definitions K. Configuring Session Monitoring L. What is Session Monitoring? M. Managing Sessions N. Configuring Session Filtering O. Configuring Logging P. What is Logging? Q. Configuring Log Storage Options R. Working with SQL Reporting S. Advanced Log Reporting T. Lab : Working with Alerts U. Managing Alerts V. Adding an Action to a Predefined Alert W. Create a Custom Alert Definition X. Lab : Working with Session Monitoring Y. Managing Session Z. Configure a Session Filter AA. Lab : Working with Logging

7 BB. Configure Log Queue CC. Create and Generate Reports DD. Monitor Connections in Real Time EE. Understand why you need to monitor TMG. FF. Configure Alerts. GG. Configure Session Monitoring. HH. Configure Logging and Reports. X. Backing Up, Restoring and Troubleshooting TMG This module describes how to backup, restore and troubleshoot TMG. Lessons presented in this module will provide instructions how to backup and restore the TMG server and specific configurations. You will also learn how troubleshoot TMG in various scenarios using built-in tools and the TMG SDK. A. Backing Up and Restoring TMG B. Backing Up TMG C. Restoring TMG D. Exporting/Importing Configurations E. Cloning TMG F. Working with TMG Tools and the SDK G. Auto-Discovery Configuration Tool H. Certification Tool I. Cache Tool J. Network Monitor K. DNS Tools L. Miscellaneous Tools and the SDK M. Troubleshooting TMG N. Routine Server Management O. Managing Attacks P. Server Maintenance Q. Troubleshooting Tips from the Console R. Troubleshooting tips from the Command Line S. Lab : Backing Up and Restoring TMG T. Backing Up an Array ConfigurationRestoring an Array ConfigurationExporting Firewall Policy SettingsImporting Firewall Policy Settings U. Lab : Working with TMG Tools V. Install Best Practices Analyzer W. Perform Analysis with Best Practices Analyzer X. Install and Work with Network Monitor Y. Lab : Troubleshooting TMG Z. Enable Change Tracking AA. Simulate Network Traffic BB. CC. Back Up and Restore TMG. DD. Work with TMG tools land SDK. EE. Troubleshoot TMG. XI. Appendix A: Advanced Features This module describes the advanced features of TMG. Lessons presented in this module will provide an overview of security considerations with TMG; it will also explain how to migrate from ISA Server 2006 to TMG, how to use scripts to manage TMG and how to implement Network Load Balancing (NLB). You will also learn how to implement TMG in a virtual environment using Hyper-V. A. Security Considerations for TMG B. Installing Security Updates C. Guidelines for Enabling only Required Services D. Securing the Network Interfaces E. Additional Best Practices F. Migrating from ISA Server to TMG G. Migration vs. New Install H. Exporting the Configuration I. Importing the Configuration J. Using the Single Server Conversion tool for TMG K. Verifying the Results L. Using Scripts to Manage TMG M. Managing TMG with Scripts N. Managing TMG with PowerShell O. Running TMG Scripts Remotely P. Implementing Network Load Balancing for TMG Q. Implementing NLB and a Server Farm R. Using an External Load Balancer S. Planning for Internet Service Provider Redundancy T. Implementing TMG in a Virtual Environment U. Hardware/Software Requirements V. Deploying TMG with Hyper-V W. Creating Highly Available Virtual Machines X. Troubleshooting TMG in a Virtual Environment Y. Understand the security considerations for TMG. Z. Migrate from ISA to TMG. AA. Use scripts to manage TMG. BB. Implement Network Load Balancing in TMG. CC. Implement TMG in a virtual environment

8 XII. Appendix B: Advanced Networking This module describes the advanced networking of TMG. Lessons presented in this module will explain how to implement Network Load Balancing (NLB) for TMG, how extend networking security with UAG. You will also learn how to install and configure Network Access Protection (NAP) in a TMG environment. A. Implementing Network Load Balancing (NLB) for TMG B. Implementing NLB and a Server Farm C. Using an External Load Balancer D. Planning for Internet Service Provider Redundancy E. Extending Security Solution with Forefront UAG F. Comparing UAG vs. TMG G. Understanding Reverse Proxy and Application Publishing H. Overview of VPN Technologies I. Combining UAG with Direct Access J. Designing Endpoint Management and Security K. Configuring Network Access Protection (NAP) L. Installing the NPS Role M. Setting TMG as a RADIUS Client N. Creating System Health Validators and Policies O. Creating Network Policies P. Creating Connection Request Policies Q. Troubleshooting NAP R. Implement Network Load Balancing for TMG. S. Understand how to extend security solutions with UAG. T. Configure Network Access Protection.