Working with the ISA Firewall Client

The ISA Firewall client, after it is installed, shows in the client's System Tray (near the clock). If it is right-clicked, as shown in Figure 11.11, it can be configured or disabled, if the proper local administrative rights are configured for the logged-in user.

Figure 11.11. Viewing the ISA Firewall client tray icon.

Getting Familiar with the Firewall Client Functionality

Right-clicking on the Firewall Client icon and choosing Configure produces two sets of options, as illustrated in Figure 11.12.

Figure 11.12. Configuring ISA Firewall client settings.

This is the only level of configuration that can be done from the client itself, and is mainly limited to enabling or disabling the client, changing how the ISA server is detected, and setting whether web browser settings are automatically detected and changed.

Modifying Rules for Firewall Clients

After the Firewall client is deployed, the real desired functionality becomes available on the ISA Server itself: the capability to create per-user rules and configurations. From the ISA Server console itself, individual rule elements can be locked down to be accessible from only particular users, via the Users tab under Access Rules.

NOTE

Per-user firewall rule configuration is limited to Access rules, and is not available for server-based publishing rules.

To illustrate this concept, the following procedure modifies an existing rule that allows web browsing access to the Internet only to members of the AD Group called Management:

1.	From the ISA Server Management Console, choose Firewall Policy from the console tree.
2.	In the Details pane, double-click on the rule to be modified. (For information on how to create firewall policy rules, reference Chapter 5, "Deploying ISA Server 2004 as a Firewall.")
3.	Select the Users tab, click on All Users, and click Remove.
4.	Click the Add button on the top field.
5.	Under User Sets, click New.
6.	At the Welcome dialog box, enter a name for the User Setsuch as Managementand click Next.
7.	Under the Users dialog box, click Add, Windows Users and Groups. NOTE The same concept applies if the ISA Server is not a domain member and uses RADIUS groups for authentication.
8.	Click the Locations button and select Entire Directory, then click OK.
9.	Enter Management into the Object Names field and click Check Names to Resolve, then click OK.
10.	At the dialog box shown in Figure 11.13, click Next to continue. Figure 11.13. Modifying Firewall Policy Rules using User Authentication.
11.	Click Finish.
12.	Click Close, OK, Apply, and OK to save the changes.

Using the Firewall Client Tool Pack (FWCToolPack)

Microsoft has released a powerful and useful tool for the Firewall client called the Firewall Client for ISA Server 2004 Support Tool (FWCToolPack). It is available from the Microsoft ISA Downloads page (http://www.microsoft.com/isaserver/downloads/2004.asp) and can be use to troubleshoot ISA Client and Server issues via the command-line interface, such as what is shown in Figure 11.14.

Figure 11.14. Viewing FWCToolPack Options.

As illustrated, there are several key options that can be used as part of this tool, such as displaying the server configuration, which ports are being used, what the browser configuration settings are, whether the server can be pinged, and several others. This tool can be a useful troubleshooting tool for Firewall client connectivity issues.