Windows Forefront

Client: Forefront Client Security / Forefront Endpoint Protection

Server: Forefront for Exchange Server / Forefront for SharePoint Server / Forefront for Lync Server

Edge: Forefront TMG 2010 / Forefront UAG 2010

ISA 2006 vs TMG 2010

1. ISA 2006 only support Windows Server 2003

TMG 2010 only support Windows Server 2008 or 2008R2 or 2012

2. ISA 2006 only have 32 bit; TMG 2010 only have 64 bit

Hardware firewall vs Software firewall

1. Hardware firewall ISO is based on linux which makes it more stable

2. Hardware firewall: Transfer package is more efficient

3. Software firewall: TMG price is not cheap, similar with Hardware firewall

TMG Standard vs Enterprise

Standard: all in one

Enterprise: array

TMG Server has two network adaptor(one for internal, one for internet)

TMG Installation: http://isacn.org/info/list.php?sessid=&sortid=32

TMG Config

1. Network config

A. Choose "edge firewall"

B. Choose the network adaptor for internal as LAN

C. Choose the network adaptor for internet as Internet

D. Choose to use Workgroup(recommendation): separate the firewall from domain

Choose to use domain: control internet visit by domain account

E. Choose the apply windows update

Test Network Diagram 

client     --> TMG                            --> Internet

10.0.0.100   10.0.0.1 / 192.168.1.1        

TMG Rule needs 20 second after apply.

1. By default, TMG deny all the connection visit. Therefore the client pc can not ping to TMG server

TMG Server create "visiting rule" for client to ping TMG server

2. Close the firewall on client, TMG Server can ping client

By default, TMG server has access to local computer

3. Create rule in TMG server to allow client to visit web and email

Add DNS, HTTP, HTTPS, POP3, SMTP, PING protocol

4. Block the executable file transfer from internet to internal

I. Right click the rule create in step3 and click the last item.

II. choose "block response to file which contain executable one"

III. set the file extension to block

5. Block one comput visit internet

I. Create one comput information on the right TMG Setting

II. Set the internal exception by adding the computer

6. Config the internet visiting time

7. Block specific URL

I. Create one URL information on the right TMG Setting

II. Set the internet exception by adding the URL

8. Control download

cancel the step 4 setting, and define the security policy for download.

Depending on it, TMG will download on TMG server and scan. Only it find it security, download from it. 

9. Three network (Add one network for DMZ zone)

I. Add network adaptor for TMG server, set IP as 20.0.0.1

II. Start one server work in DMZ zone, set IP as 20.0.0.100

III. Add network in TMG config

1). Add "网络连接"

2). Add “网络规则”

3). Add “访问规则”