You cannot install a Forefront Threat Management Gateway 2010 service pack on branch office servers

Upgrade process

On the headquarters EMS server:

• Upgrade the computer to TMG 2010 SP1.

On the headquarters TMG server:

1. On the Remote Access Policy node, click the VPN Clients tab.
2. Enable VPN client access.
3. Configure VPN Client Access. To do this, on the Protocols tab, click to select the Enable L2TP/IPsec check box, and then click Apply.
4. Click Authentication Methods. In the Allow custom IPsec policy for L2TP connection field, click Use preshared key value, and then click Apply.
5. Apply the configuration changes.
6. Under Local Users and Groups, click Users, right-click New User, and then click Properties.
7. Type the user credential details (including the user password), and then click to clear the User must change passwords at next logon check box.
8. Click Create, and then click Close.
9. Right-click the new user, click Properties, point to Dial-in, and then click Network Access Permission.
10. Click Allow Access, click Apply, and then click OK.
11. Connect remotely to branch office TMG server’s external IP address from the headquarters TMG network.

On the branch office TMG server when it is connected:

1. Run the following from a command line with administrative permissions: 
   netsh tmg add allowedrange a.b.c.d a.b.c.d persistent
   In this command, the placeholder a.b.c.d is the external address of the headquarters TMG server. This adds a Firewall Engine exception to enable the headquarters TMG server to connect to the branch office TMG network even when it is in lockdown mode (that is, when the TMG service is down).
2. Create a new dial-up connection:
   1. Open Network and Sharing Center.
   2. Click A new connection or network.
   3. Connect to a workplace.
   4. Click Use my Internet connection (VPN).
   5. Click I’ll set up an Internet connection later.
   6. Type the external address of the headquarters TMG network.
   7. Type the user credentials. Use the headquarters TMG computer name as the domain.
   8. Click Close.
3. Right-click the new connection, click Properties, and then click the Security tab:
   1. For Type of VPN Connection, select L2TP/IPSec.
   2. Under Advanced settings, click Use preshared key for authentication.
4. Make sure that the configuration on the headquarters TMG server is synced by using the Monitoring tab. Connect to the headquarters TMG network by using the newly created connection.  

On the headquarters TMG after a VPN client connection is established:

1. In the headquarters TMG 2010 user interface, under Monitoring, click Sessions, and then confirm that a new VPN Client session was established. 
2. Add a rule that enables all traffic from VPN Clients to Internal and Local Host networks for all users. Create the opposite rule enabling Internal plus Local Host to VPN Clients for all users.
3. Make sure that there is a respective network routing rule. The default VPN Clients to Internal Network would be sufficient for the routing rule.

On the branch office TMG server by using your existing remote connection:

1. Stop the Firewall service. To do this, at a command prompt with Administrative permissions, type the following: 
   net stop /y fwsrv
   This also stops the Routing and Remote Access service and disconnects the existing Site to Site connection. 
2. Install TMG 2010 SP1 by typing the following command:
   Msiexec /p <full msp path> /L*v <full log path>
3. On the Locate Configuration Storage Server wizard page, provide explicit credentials. Do not use the Current user option.
4. After you successfully install TMG 2010 SP1, restart the computer if you have to. Then, if you have to, manually start the Firewall service and verify that the Site to Site tunnel is restored.
5. Disconnect the VPN client connection.

On the headquarters TMG server after you successfully upgrade the branch office TMG server:

Clean up after upgrade

On the headquarters TMG server: 

1. Restore the VPN Client access configuration that you set in the "Upgrade process: On the headquarters TMG server" procedure. If the Routing and Remote Access service restarts, you may have to wait for several minutes until all the services are started.
2. Delete the user that was created in step 6 of the "Upgrade process: On the headquarters TMG server" procedure.

On the branch office TMG server:

1. Delete Firewall Engine exceptions created in step 1 of the "On the branch office TMG server when it is connected" procedure. To do this, follow these steps:
   1. Open a command prompt with Administrative permissions.
   2. Run the following command:
      netsh tmg show all
   3. In the command output, locate any dynamic and persistent IDs that corresponds to the IP range that you added in the "Upgrade process: On the headquarters TMG server" procedure. 
   4. Run the following commands. Use values for x that correspond to the dynamic IDs and use values for y that correspond to the persistent IDs that you found in step 1.c.:
      netsh tmg delete allowedrange id=x
      
      netsh tmg delete allowedrange id=y persistent
2. Delete the dial-up connection that you created in step 2 of the "Upgrade process: On the branch office TMG server when it is connected" procedure.