How To Provide Internet Access Through a Firewall in Internet Security and Acceleration Server

This step-by-step instruction guide describes how to provide Internet access through a firewall by using Internet Security and Acceleration (ISA) Server. This procedure provides internal clients unrestricted outbound access to the Internet.

Prerequisites

For best results, verify that the computer that is running ISA Server has two network interfaces installed: one with a direct connection to the Internet and another that is connected to the internal network. Make sure that the IP address of the external interface is publicly accessible, and make sure that the internal adapter has a private IP address. This article assumes that the external adapter has full and direct access to the Internet without having to route requests to an upstream server. ISA Server requires Microsoft Windows 2000 Server Service Pack 1 (SP1) or later.

Install ISA Server

To install ISA Server:

1. Insert the Internet Security and Acceleration Server 2000 CD-ROM.
2. On the splash screen, click Install ISA Server.
3. Review the End User License Agreement, and then click Continue.
4. Type the CD key number, which is located on the back of the CD-ROM case.
5. In the Product ID dialog box, click OK.
6. Review the license agreement, and then click I Agree to proceed.
7. Click Typical Installation.
8. Click Integrated Mode, and then click Continue.
9. Click OK to stop W3SVC.
10. Set the cache size to the sum of 100 plus 0.5 per user, and then click OK.
11. Click Construct LAT (Local Address Table). Leave any check boxes that are selected by default selected. Click to select the check box for your internal adapter. Click OK twice.
12. Click OK to accept the LAT settings.
13. Click OK to start the ISA Management tool.
14. Click OK to finish.

Create a Protocol Rule

To create a protocol rule that allows your clients unrestricted access to the Internet:

1. Open the ISA Management console (Click Start, point to Programs, click Microsoft ISA Server, and then click ISA Management.
2. In the tree, click the name of the server to expand the tree for the computer that is running ISA Server.
3. Expand Access Policy, and then click Select Protocol Rules.
4. Click the Create a Protocol Rule icon.
5. Type Full Internet Access Rule on the first page of the wizard, and then click Next.
6. Click Next four more times to accept all of the default settings of a new protocol rule.
7. Click Finish.

Enable IP Routing

To enable IP routing for SNAT (Secure Network Address Translation) clients:

1. In the Access Policy subtree, click IP Packet Filters.
2. Right-click IP Packet Filters, and then click Properties.
3. Click to select the Enable IP Routing check box.
4. Click OK.
5. On the client computers, under TCP/IP Properties, set the client computer's default gateway to be the internal adapter of the computer that is running ISA Server.

NOTE: After you complete these steps, only internal clients have Internet access. Not even the ISA Server itself has Internet access. This is by design, for security reasons. Granting Internet access to the ISA Server console would require the creation of packet filters that allow this access, which might reduce the level of security that ISA Server provides.