Isa 2006 lab p3

ISA Server Tài liệu thực hành dành cho học viên

Module 8: Configuring Virtual Private Network Access for
Remote Clients and Networks
Lab 1: Cho user external quay VPN veà ISA, chöùng thöïc user treân ISA vaø truy caäp taøi
nguyeân trong internal. Xaây döïng moâ hình nhö hình veõ

1. Taïo user u1 treân Isa server, click phaûi vaøo user u1 choïn properties, choïn theû dial-
in, choïn option Allow Access ok ( cho user u1 ñöôïc pheùp quay VPN). Taïo group
VPN add user u1 vaøo group naøy.
2. Vaøo Isa choïn Virtual Private Network , choïn theû VPN Clients trong theû naøy goàm coù
5 böôùc thöïc hieän VPN.
a. Böôùc 1: choïn configure Address Assignment method

VSIC Education Corporation Trang 103


b. Choïn theû Address Assignment, choïn option Static address pool aán nuùt add,
nhaäp vaøo daõy IP cho VPN client (khi user quay VPN veà seõ döôïc caáp ip tring
daõy ip naøy). Daõy IP naøy phaûi khaùc vôùi daõy ip cuûa Internal ok

c. Cuõng trong böôùc 1 choïn Enable VPN client access, ñaùnh daáu choïn vaøo
checkbox Enable VPN client access, vaø goõ vaøo toång soá client coù theû quay
VPN OK



3. Böôùc 2: Choïn Specify windows users, aán nuùt add choïn group VPN

ok ok



4. Böôùc 3:
a. Choïn Verify VPN Properties, ñaùnh daáu choïn vaøo check box Enable PPTP ok



b. Choïn Remote access configuration, check vaøo check box External ok



5. Böôùc 4: choïn View Firewall policy for the VPN clients network, Böôùc naøy taïo
access rule cho vpn client truy caäp taøi nguyeân beân trong internal. Click phaûi vaøo
firewall policy choïn new Access rule, nhaäp teân cho rule next, choïn option
Allow next

a. Choïn All outbound traffic next

b. Trong cöûa soå Access rule source add Internal, Localhost, VPN client next



c. cöûa soå Access rule destinations add Internal, Localhost, VPN client next

d. Choïn All user next finish Apply



6. Böôùc 5: choïn View network rule, trong network rule ñaõ coù saún network rule laø
route giöõ VPN client vaø Internal. Hoaøn taát caáu hình VPN server treân ISA.
7. Treân maùy VPN client thöïc hieän quay VPN veà ISA, truy caäp taøi nguyeân treân maùy
client Internal.
Lab 2: VPN use Radius Authentication
Xaây döïng moâ hình nhö hình veõ

Muïc ñích: Duøng radius chöùng thöïc user treân domain.



Treân maùy domain
1. Vaøo start Run goõ DSA.MSC, click phaûi vaøo domain choïn Raise domain functional
level

2. Choïn Windows 2000 native aán Raise yes

3. Taïo group coù teân laø VPN, vaø 2 user u1 vaø u2, laàn löôït click phaûi vaøo 2 user choïn
properties choïn theû Dial-in, ñaùnh daáu choïn vaøo option Control access through
remote access policy ok



4. Cho 2 user u1 vaø u2 laø member cuûa group VPN



Treân maùy Radius
1. Vaøo start programs administative tools choïn Internet Authentication service.
Click phaûi vaøo RADIUS Client choïn New Radius Client

2. Nhaäp Friendly name laø teân tuøy yù, nhaäp vaøo IP internal cuûa maùy ISA server next



3. Choïn Client-vendor laø RADIUS Standard nhaäp shares secret vaø Confirm shared
secret laø 1234, ñaùnh daáu choïn check box Request must contain the …. Finish



4. Click phaûi vaøo Remote access policy choïn New Remote Access policy

5. Choïn option Use the wizard to set up …, nhaäp teân cho Policy name next

6. Choïn option VPN next



7. Choïn option Group, Aán add choïn Location choïn teân domain, nhaäp vaøo group
VPN aán check Names ok next



Treân maùy ISA
1. Caáu hình VPN server treân ISA gioáng nhö lab 1. Caáu hình qua 5 böôùc



2. Böôùc 1:
a. Choïn Configure Address Assignment method, choïn option Static address pool,
nhaäp vaø daõy IP cho VPN client, daõy Ip naøy phaûi khaùc vôùi daõy IP cuûa internal
ok



b. Choïn Enable VPN client access, ñaùnh daáu choïn checkbox Enable VPN client
access ok



3. Böôùc 2: Choïn Radius Server, ñaùnh daáu choïn checkbox use RADIUS for
authentication, Aán Raius servers



Aán add nhaäp vaøo IP cuûa maùy Radius server, aán Change nhaäp vaøo shared
secret gioáng nhö ñaõ nhaäp treân maùy Radius, ñaùch daáu choïn checkbox Always use
message authenticator ok ok Ok



4. Böôùc 3
a. Choïn Verify VPN properties, ñaùnh daáu choïn 2 checkbox Enable PPTP vaø
Enable L2TP/IPSEC ok

b. Choïn remote access configuration, ñaùnh daáu choïn checkbox External ok



8. Böôùc 4: Choïn View firewall policy for the VPN clients network, click phaûi vaøo
Firewall policy new Access Rule goõ vaøo teân cuûa Rule next

Choïn Allow next, choïn all outbound traffic next,taïi cöûa soå Access rule source
aán Add choïn Internal, Local Host, VPN client next



Taïi cöûa soå Access Rule Destinations aán Add choïn Internal, Local Host, VPN
client next, all user next finish

9. Böôùc 5 trôû laïi Virtual Private networks choïn view network rule, kieån tra xem ñaõ
coù rule VPN Clients to Internal laø route.



10. Click phaûi vaøo Firewall policy choïn edit System policy, choïn ICMP (ping) choïn
theû from add Internal, Localhost vaø VPN client Ok Apply. Hoaøn taát caáu hình
VPN treân ISA

Treân maùy Client
1. Click phaûi vaøo my netwok places properties, choïn Create a new connection
next



2. Choïn option connect to the network at my workplace next

3. Choïn Virtual private network connection next



4. Nhaäp vaøo teân cho keát noái nhaäp vaøp IP external cuûa ISA next finish

5. Nhaäp vaøo user name vaø password cuûa user treân domain aán connect keùt noái
thaønh coâng.



6. Ñeå thöïc hieän VPN baèng L2TP/IPSEC ta click phaûi vaøo keát noái VPN choïn
properties choïn theû security aán Ipsec setting

7. Ñaùnh daáu choïn check box Use pre-shared key for authentication, nhaäp vaøo key ví
duï laø 12345 ok



8. Choïn theû Networking, trong phaàn type of VPN choïn L2TP IPSEC VPN ok

9. Trôû veà maùy ISA , choïn Virtual private network ôû böôûc 2 choïn Radius server, choïn
tab Authentication, ñaùnh daáu choïn Allow custom Ipsec policy for L2TP connection,
nhaäp vaøo key 12345 gioáng nhö ñaõ nhaäp treân maùy client--> ok Apply



10. Treân maùy client thöïc hieän keát noái VPN sau khi keát noái thaønh coâng click phaûi vaøo
keát noái choïn status seõ thaáy keát quaû nhö maøn hình sau (maõ hoùa baèng Ipsec)



Lab 3: VPN site to site
Xaây döïng moâ hình nhö hình veõ

Muïc ñích: cho caùc client internal cuûa 2 site coù theå truy caäp döõ lieäu cuûa nhau.
Treân ISA1



1. Taïo user laø HCM, click phaûi vaøo user choïn properties, choïn theû Dial-in choïn Allow
access.
2. Vaøo Isa choïn virtual private network, choïn theû Remote Site, cöûa soå beân tay phaûi
choïn theû tasks aán Create site to site connection. Goõ vaøo teân remote site (Chuù yù:
teân remote site phaûi gioáng nhö teân user maø isa1 ñaõ taïo ôû böôùc 1, trong lab naøy laø
HCM) next

3. Choïn Piont-to-point Tunneling Protocol (PPTP) next



4. Goõ vaøo IP external cuûa ISA2 next

8. Nhaäp vaøo user name vaø password maø ISA2 taïo, trong tröôøng hôïp naøy laø Hanoi( chæ
nhaäp username vaø Password thoâi khoâng caàn nhaäp domain) next
9. Aán Add range nhaäp vaøo daõy IP Internal cuûa ISA2 trong tröôøng hôïp naøy laø
192.168.1.1- 192.168.1.254 ok next

10. Choïn Option Create a network rule specifying a route relationship (ñeå taïo network
rule laø route giöõa Internal cuûa Isa1 vaø remote site)


11. Choïn option Create an allow access rule (ñeå taïo access rule laø all outbound traffic
giöõa Internal vaø remote site) next finish

12. Choïn firewall policy seõ thaáy ñöôïc access rule allow access… töï taïo



13. Vaøo configurationnetworks choïn theû Network rule seõ thaáy rule HCM to Internal
network laø route ñaõ töï taïo.

14. Vaøo system policy choïn ICMP(ping) choïn theû from add HCM, Internal, local host
ñeå cho pheùp ping.--> ok Apply



Treân ISA2
1. Taïo user laø Hanoi, click phaûi vaøo user hanoi properties choïn theû dial-in choïn option
Allow access
2. Vaøo Isa choïn virtual private network, choïn theû Remote Site, cöûa soå beân tay phaûi
choïn theû tasks aán Create site to site connection. Goõ vaøo teân remote site (Chuù yù:
teân remote site phaûi gioáng nhö teân user maø isa2 ñaõ taïo ôû böôùc 1, trong lab naøy laø
Hanoi) next



3. Choïn Piont-to-point Tunneling Protocol (PPTP) next

4. Goõ vaøo IP external cuûa ISA1 next



15. Nhaäp vaøo user name vaø password maø ISA1 taïo, trong tröôøng hôïp naøy laø HCM( chæ
nhaäp username vaø Password thoâi khoâng caàn nhaäp domain) next

16. Aán Add range nhaäp vaøo daõy IP Internal cuûa ISA2 trong tröôøng hôïp naøy laø
200.200.200.1—200.200.200.254 ok next



17. Choïn Option Create a network rule specifying a route relationship (ñeå taïo network
rule laø route giöõa Internal cuûa Isa2 vaø remote site)

18. Choïn option Create an allow access rule (ñeå taïo access rule laø all outbound traffic
giöõa Internal vaø remote site) next finish



19. Vaøo system policy choïn ICMP(ping) choïn theû from add Hanoi, Internal, local host
ñeå cho pheùp ping.--> ok Apply
20. Hoaøn taát baøi lab VPN site to site. Ñöùng taïi maùy client internal cuûa ISA2 ping thaønh
coâng ñeán client internal cuûa ISA1 hay ngöôïc laïi.



Module 9: Implementing Caching
Lab1 : Configuring Cache
Xaây döïng laïi moâ hình nhö hình veõ, taïo rule cho Client vaø Isa ra internet

1. Vaøo Isa, choïn Configuration cache, ôû cöûa soå giöõa choïn theû cache Drives, ôû cöûa
soå beân phaûi choïn theû tasks, choïn Define cache Drives.

2. Choïn oå ñóa löu cache vaø nhaäp vaøo dung löôïng cache aán set ok



3. Aán Apply choïn option save the changes and restart the services-- >ok

4. Treân oå c: seõ coù folder Urlcache, trong folder coù file Dir1.cdat



5. Taïi maùy ISA vaø maùy client vaøo IE truy caäp moät soá trang web khaùc nhau caøng nhieàu
caøng toát
6. Treân maùy Isa caøi cache dir tool

7. Extract caùc file cache dir tool vaøo folder caøi Isa (coù theå phaûi reboot laïi Isa)

8. Chaïy cache dir tool seõ thaáy ñöôïc Isa cache ñöôïc caùc trang web maø ISA vaø client ñaõ
truy caäp ôû böôùc 5



Lab 2: Content Download Jobs
Muïc ñích: Laäp lòch download web site veà cache treân ISA
1. Vaøo Isa choïn configurationcache, ôû cöûa soå chính giöõa choïn theû Content
Download Jobs choïn Schedule a content download job

2. Nhaäp teân cho Schedule next



3. Choïn option Weekly next

4. Choïn ngaøy vaø giôø cho schedule download



5. Nhaäp vaøo trang web caàn download next

6. Choïn option cache all content vaø Override Object’s TTL nhaäp vaøo new TTL laø
120 phuùt next



7. Click phaûi vaøo schedule vöøa taïo choïn start

8. Ñeå thaáy ñöôïc trang tuoitre.com.vn ñang ñöôïc cache ta vaøo monitoring choïn theû
loggin click vaøo start query, click phaûi vaøo thanh tieâu ñeà choïn add/remove
colunms



9. Cho caùc colunm URL, Destination IP, Client Ip leân ñaàu ok

10. Maëc duø ISA vaø client khoâng truy caäp vaøo trang http://www.tuoitre.com.vn nhöng
Isa vaãn cache. Schedule download ñang chaïy töø maùy ISA (local host)


Isa 2006 lab p3

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (8)

Similar to Isa 2006 lab p3

Similar to Isa 2006 lab p3 (12)

Isa 2006 lab p3