installing isa server 2000

8/7/2019 Installing ISA Server 2000

1/21

Installing ISA Server 2000.

If you have not yet installed ISA Server on your network, thisis the article for you. In this article I will walk you through,step-by-step, the installation of ISA Server 2000 onto acomputer in your network. We will cover the different types of installations you can perform (either as a stand-alone server or as part of an array of ISA Servers) and discuss the caveatsassociated with each.

Published: Dec 28, 2001 Updated: Jul 23, 2004 Section: Tutorials :: Installation & Planning Author: Will Schmied Printable Version Adjust font size: Rating: 2.9/5 - 430 Votes

1 2 3 4 5

If you have not yet installed ISA Server on your network, this is the article for you. In thisarticle I will walk you through, step-by-step, the installation of ISA Server 2000 onto acomputer in your network. We will cover the different types of installations you can

perform (either as a stand-alone server or as part of an array of ISA Servers) and discussthe caveats associated with each.

Before we get started on the actual installation of ISA Server, there are some things youshould do beforehand though:

1. Ensure that Windows 2000 Server is installed on your ISA Server machine,including the most recent Service Pack. Service Pack 1 is required to be installed,at a minimum, before installing ISA Server.

2. Configure the server that will be hosting the ISA Server installation. You should
http://www.isaserver.org/tutorials/installation_and_planning/http://www.isaserver.org/tutorials/installation_and_planning/http://www.isaserver.org/tutorials/Installing_ISA_Server_2000.html?printversionhttp://www.addthis.com/bookmark.php?v=120&winname=addthis&pub=TechGenix&source=men-120&lng=en&s=&url=http%3A%2F%2Fwww.isaserver.org%2Ftutorials%2FInstalling_ISA_Server_2000.html&title=Installing%20ISA%20Server%202000.&logo=&logobg=&logocolor=&ate=AT-TechGenix/-/-/4cfdde29be6b0197/1&CXNID=2000001.5215456080540439074NXC&pre=http%3A%2F%2Fwww.google.com.ph%2Furl%3Fsa%3Dt%26source%3Dweb%26cd%3D1%26ved%3D0CBUQFjAA%26url%3Dhttp%253A%252F%252Fwww.isaserver.org%252Ftutorials%252FInstalling_ISA_Server_2000.html%26rct%3Dj%26q%3Disa%2520server%25202000%26ei%3DDt79TIrLIpHWvQOD3qCyBw%26usg%3DAFQjCNE6O8ngu1osmCueD2Yn4All82DjEg%26cad%3Drja&tt=0http://www.isaserver.org/tutorials/Installing_ISA_Server_2000.htmlhttp://www.isaserver.org/tutorials/Installing_ISA_Server_2000.htmlhttp://banman.isoftmarketing.com/a.aspx?ZoneID=60&Task=Click&Mode=HTML&SiteID=1&PageID=63187http://ad1.netshelter.net/jump/ns.isaserver/general;ppos=atf;kw=;tile=2;sz=300x250,336x280;ord=123456789?http://www.isaserver.org/tutorials/installation_and_planning/http://www.isaserver.org/tutorials/Installing_ISA_Server_2000.html?printversion


2/21

start with Jim Harrisons wonderful article Configuring ISA Server InterfaceSettings , which will walk you through the setup of your ISA Server machinesnetwork adapters.

3. Figure out what your internal network will encompass, both presently and in thefuture in regards to IP addresses. Write these down if its a complicated picture

you will need this information again later.4. If your internal network contains more than one range of IP addresses (say192.168.x.y and 10.x.y.z, for example), then you need to create the routing tableon the server that is to be the ISA Server via the command shell route command. If you only have one address range, Windows will do this for you. Be sure to viewthe routing table before installing ISA Server to make sure its correctthis can

prevent problems later.5. Two articles by Tom Shinder, Designing An ISA Server Solution on a Simple

Network and Designing An ISA Server Solution on a Complex Network shouldhelp you get a good idea of where you want to go with you ISA Server setup.

Some basic information before we get our hands dirty

The process of installing ISA Server can be started by inserting ISA Server CD-ROM intoyour CD drive. Under most cases, the installation program should auto-start and displaythe screen shown in Figure 1.
http://www.isaserver.org/pages/tutorials/setting_up_machine_before_isa_installtion.htmhttp://www.isaserver.org/pages/tutorials/setting_up_machine_before_isa_installtion.htmhttp://www.isaserver.org/shinder/tutorials/designing_an_isa_server_solution_on_a%20_simple_network.htmhttp://www.isaserver.org/shinder/tutorials/designing_an_isa_server_solution_on_a%20_simple_network.htmhttp://www.isaserver.org/pages/tutorials/isanetworks.htmhttp://www.isaserver.org/pages/tutorials/setting_up_machine_before_isa_installtion.htmhttp://www.isaserver.org/pages/tutorials/setting_up_machine_before_isa_installtion.htmhttp://www.isaserver.org/shinder/tutorials/designing_an_isa_server_solution_on_a%20_simple_network.htmhttp://www.isaserver.org/shinder/tutorials/designing_an_isa_server_solution_on_a%20_simple_network.htmhttp://www.isaserver.org/pages/tutorials/isanetworks.htm


3/21

Figure 1 The ISA Server 2000 installation screen.

If for some reason the installation program doesnt auto-start, just double click theISAAutorun.exe file in the root of the CD-ROM as shown in Figure 2.


4/21

Figure 2 Starting the ISA Server 2000 installation manually.

The Installation and Deployment Guide , as shown in Figure 3 is very good reading before getting started on your installation if you have any questions. We will try to cover most of the basic situations here in this tutorial. If you are migrating from MicrosoftProxy Server 2.0, there is some outstanding migration information available in the ReadAbout Migrating to ISA Server area, as shown in Image 4.


5/21

Figure 3 The Installation and Deployment Guide.


6/21

Figure 4 Migration instructions.

To initialize or not to initialize

Up to this point, you havent had to make any decisionswell, the time has come for making a decision, and your first one is big one indeed. If you will be using this ISAServer as an array member, then you must install the ISA Server schema into ActiveDirectory. This is a one-way decisionyou cannot undo it later if you change your mind.

However, if you want to add additional ISA Servers to the ISA Server array at a later time, you will not have to reinstall the schema changes. In order to make the changes tothe schema, you must be a member of the Enterprise Admins and Schema Admins groups.To initialize the schema, click Run ISA Server Enterprise Initialization, which will bringup a dialog box as shown in Figure 5. (Note that this is not your last chance to abort this

procedure, as we will see later.)


7/21

Figure 5 Initializing the schema for ISA Server.

Like previously mentioned, you will have one more chance to abort the schemainitialization process, as shown in Figure 6. There are, however, options on this dialog

box that require some discussion, so we will address them before moving any further intothe installation.

Figure 6 Configuring Enterprise initialization options prior to schema initialization.

Your first option is whether to select Use array policy only or Use thisenterprise policy . If you select the Use array policy only option, then noenterprise policy is applied to the array and the array Administrator can create anyrule they desire. If the Use this enterprise policy option is selected, then anAdministrator at the enterprise level dictates that only the selected policy may beappliedno additional rules may be created.

If you place a check mark in the selection box for Allow array-level access policyrules you have created a Combined enterprise and array policy . In this case,an array policy is added to the enterprise policy. The enterprise policy overridesthe array policy. That is, the array policy can impose additional limitations, butcannot be more permissive than the enterprise policy.

Checking Allow publishing rules allows you to create publishing rules (whichmust be created separately on each server), which will listen for publishing


8/21

requests. Web publishing rules essentially map incoming requests to theappropriate Web servers behind the ISA Server computer.

Checking Force packet filtering on the array does just that. Packet filteringallows you to control the flow of IP packets in and out of your network. With

packet filtering enabled, all packets that arrive at the external (Internet) interface

will be dropped unless they have been explicitly allowed. This occurs statically viaIP packet filters or dynamically by access policy and publishing rules. This servesto further protect your internal network from attacks originating outside of your network.

Note that you can change all of these options from the Getting Started Wizardafter installation of ISA Server has completed.

If you choose to continue the process, you will see two new windows on your machine,shown in Figure 7 and Figure 8 as well as a lot of disk activity for about 2 5 minutes(depending on the machine configuration and loading). After the initialization is done,

both windows will close out, the dialog box shown in Figure 9 will be displayed, and you

are ready to continue the process of installing ISA Server.

Figure 7 Now we sit on our hands and wait


9/21

Figure 8 There are over 300 changes made to the schema during the initialization process.

Figure 9 Schema initialization has been completed.

Installation time


10/21

Now that we have done all of our preparatory work, we can now move on to the actual process of installing ISA Server on our machine as follows:

1. Clicking Install ISA Server from the ISA Server Setup window (shown in Figure

1) will start the process.2. A informational window will appear shortly letting you know that the process isunderway then you will be presented with the standard Wizard first pageyou candismiss it by clicking Continue .

3. Doing so brings up the next window, in which we must input our CD-KEY.Unlike most other high-end Microsoft products, ISA Server does not requireWindows Product Activation (WPA). Enter your CD-KEY and click OK tocontinue on. The next window will display your Product ID, but its availableunder the Help > About option within the program, so you dont have to write itdown. Click OK to continue past this screen.

4. After Setup quickly scans your hard drive you will be presented with the EULA

window, on which you must click I Agree (as always) to continue the installation process.5. As shown in Figure 10, you are now faced with three different installation options,

which are fairly simple. You can choose which one suits your needs; most oftenthis will be Typical Installation . (In our example, I am going to perform a FullInstallation .)

Figure 10 Choosing the type of installation to perform.

6. If you havent already installed Windows 2000 SP1, you will get the error window


11/21

as shown in Figure 11.

Figure 11 Looks like someone forgot to install SP1 on the Server!

7. Continuing on with the installation, we are next presented with the window shownin Figure 12 if we have initialized the schema or the window shown in Figure 13 if we have not. Note that if you install as a stand-alone server for either reason, youcan upgrade to an array server later (we will talk about this later).

Figure 12 What kind of ISA Server will this be?

Figure 13 Installing as a stand-alone server.

8. In this instance, I am going to install as a stand-alone server (we can alwaysupgrade later as previously mentioned), so I will click NO to continue on (this is


12/21

assuming that I have initialized the schemaotherwise you would click YES asshown Figure 13).

9. The next window presents, as shown in Figure 14, asks to choose what mode thisserver will be operating in. The most robust option is Integrated mode and is the

recommended modethus we will continue the installation by selectingIntegrated mode as shown and clicking Continue .

Figure 14 Selecting the mode of the server.

10. The setup process will not stop the IIS publishing service and present you a dialog box instructing you to reconfigure Web site as required; this is shown in Figure 15.Click OK to continue the installation.


13/21

Figure 15 Instructions for IIS Web sites

11. On the next window, you must configure the cache size. This option, like most otherscan be changed after installation is complete. The default setting is for a 100 MB sizedcache, and for now we will leave it be. Click OK to continue.12. The next step, one of great importance if you want this whole thing to work properly,is to construct the LAT table. The easiest way to do this is to click the Construct Table

button and select the range for the internal network adapter as shown in Figure 16. Theresults of this are shown in Figure 17. Click OK to continue past this step.

Figure 16 Selecting local addresses.


14/21

Figure 17 The results, showing the Internal IP address range ISA Server will recognize.

13. The setup program works for a while, installing ISA Server, and you are in business. That was pretty easy, wasnt it? The only decision we have left to makeis whether or not to start the Getting Started Wizard after the setup program closesout. I recommend doing so, as your ISA Server must still be configured. TomShinder has written a great article in this: Getting Started with ISA Server.

Thats all for now folks

Thats all there is to this process. Installing ISA Server is actually one of the simplest product installations you will performprovided you have done your research ahead of time.

Determining RAM and CPU Specifications

Updated: March 28, 2003

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003with SP1, Windows Server 2003 with SP2

As hardware continues to improve, hardware vendors frequently change the RAM andCPU configurations in the servers they offer. Use the information about performanceimprovements and scaling factors in the sections that follow to choose the hardware that

best meets your organizations needs.


15/21

When designing RAM and CPU specifications for server clusters, also consider thefailover policy that you plan to use and the maximum number of File Share resources andshare subdirectories that will be hosted on any one node after a failure. Each node musthave the RAM and CPU resources required to host the resources of one or more failednodes, depending on your failover policy. For more information about failover policies

and server cluster capacity planning, see " Designing and Deploying Server Clusters " inthis book.

Note

Many of the figures presented in this section are derived from NetBench statisticsfor file server throughput. NetBench is a portable Ziff Davis Media benchmark

program that measures how well a file server handles file I/O requests from 32-bitWindows clients. NetBench provides an overall I/O throughput score and averageresponse time for servers, along with individual scores for clients. You can usethese scores to measure, analyze, and predict how well your server can handle file

requests from clients.

Reviewing Windows Server 2003 CPU Specifications

Table 2.11 describes the recommended CPU speed and number of processors supported by Windows Server 2003.

Table 2.11 CPU Requirements for Windows Server 2003

SpecificationWindows

Server 2003,Standard Edition

WindowsServer 2003,

Enterprise Edition

WindowsServer 2003,

Datacenter EditionMinimumrecommended CPUspeed

550 MHz 550 MHz 550 MHz

Number of CPUssupported 14 18 832

Reviewing Operating System Performance Improvements

Even if you plan to use existing hardware to run Windows Server 2003, you can benefitfrom performance enhancements available in Windows Server 2003, as well as client andserver protocol improvements available when using clients running Windows XPProfessional.

Table 2.12 describes performance improvements that can be gained by migrating to newoperating systems on identical hardware.
http://technet.microsoft.com/en-us/library/cc783278(WS.10).aspxhttp://technet.microsoft.com/en-us/library/cc783278(WS.10).aspx


16/21

Table 2.12 Operating System Performance Improvements on the Same Hardware

Current Server and Client OperatingSystems

New Server and ClientOperating Systems

ImprovementFactor

Windows NT Server 4.0 withMicrosoft Windows NTWorkstation 4.0 clients

Windows 2000 Server withWindows 2000 Professionalclients

Up to 1.25X

Windows 2000 Server withWindows 2000 Professional clients

Windows Server 2003 withWindows XP Professionalclients

Up to 2.2X

Windows NT Server 4.0 withWindows NT Workstation 4.0 clients

Windows Server 2003 withWindows XP Professionalclients

Up to 2.75X

These figures are based on the following assumptions:

The server is uniprocessor (UP), 2P, 4P, or 8P.

For each comparison, the server hardware is the same.

No memory, disk, or network bottlenecks prevent the processor from performingat full capacity.

Reviewing Performance Improvements Gained by Upgrading Processors

Table 2.13 describes performance improvements that can be gained by upgrading server processors. Upgrading processors improves processing power, memory bandwidth, I/O bandwidth, and the system bus. These figures are based on actual processor improvements, not operating system improvements. If you plan to use processors that arefaster than those listed here, performance will be greater than the following figures show.

Table 2.13 Performance Improvements Gained by Upgrading Processors

Old Processor New Processor (Server Class) Improvement Factor

200 MHz Intel Pentium Pro 400 MHz Intel Pentium II Xeon 2X400 MHz Intel Pentium II Xeon 900 MHz Intel Pentium III Xeon 2X200 MHz Intel Pentium Pro 900 MHz Intel Pentium III Xeon 4X


17/21

Reviewing Performance Improvements Gained by Adding Processors

To increase performance, consider using more than one processor in your file servers.One advantage of using multiple processors is the ability to handle more concurrent

clients, resulting in higher scaling factors at high client loads. Table 2.14 describes the NetBench throughput improvements gained by adding processors on file servers runningWindows Server 2003.

Table 2.14 Performance Improvements Gained by Adding Processors

Original Number of Processors After Upgrade Scaling Factor*1 2 1.4X to 1.6X2 4 1.3X to 1.4X

1 4 1.8X to 2.3X4 8 1.3X to 1.4X1 8 2.4X to 3.2X

* The scaling factors are based on a range of client loads.

Determining the Client Load Based on Processor Utilization

NetBench stresses the system by applying a heavy load on the file server. Microsoft usedthe most intensive CPU operations file opens and file creates (subsequently describedas opens/creates ) to translate a NetBench client load to a more realistic client load.

To determine the client load, Microsoft observed approximately 820 opens/creates per second at peak NetBench throughput (100-percent CPU utilization) on a Xeon 900-MHzserver with a single processor (UP). Table 2.15 describes active client loads for light,medium, and heavy user loads at 70-percent CPU utilization. The client loads are definedas follows:

Light: one open/create every 10 seconds

Medium: two opens/creates every 10 seconds

Heavy: three opens/creates every 10 seconds

Assuming that a light user load causes one open/create every 10 seconds, a UP Xeon 900-MHz server can handle 5,700 users at 70-percent CPU utilization and 8,200 users at 100-

percent CPU utilization. (These figures are derived by dividing the opens/creates per second at peak NetBench throughput by the opens/creates per second for light users.)


18/21

The figures in Table 2.15 for the UP Xeon 900-MHz server are based on the followingassumptions:

No memory, disk, or network bottlenecks prevent the processor from performingat 100-percent capacity.

The clients are running Windows XP.

The figures for 2P, 4P, and 8P Xeon 900-MHz servers were calculated by using thescaling factors described in Table 2.14. For example, on a 4P Xeon 900-MHz server,under a heavy client load of three opens/creates every 10 seconds, the server can handle3,400 to 4,400 active users. This figure is derived by taking the 1,900 heavy-load userssupported on a UP Xeon 900-MHz server and multiplying that figure by the UP-to-4Pscaling factors of 1.8X to 2.3X provided in Table 2.14.

Table 2.15 Number of Active Users Supported Based on a NetBench-TypeWorkload

Processor Heavy Load Medium Load Light LoadUP Xeon, 900 MHz 1,900 2,800 5,7002P Xeon, 900 MHz 2,600 to 3,000 3,900 to 4,500 8,000 to 9,1004P Xeon, 900 MHz 3,400 to 4,400 5,000 to 6,400 10,300 to 13,1008P Xeon, 900 MHz 4,600 to 6,100 6,700 to 9,000 13,700 to 18,200

Determining RAM Specifications

Using adequate RAM in file servers ensures that Windows Server 2003 can temporarilycache (store) files in memory, reducing the need to retrieve files from disk. Table 2.16describes the minimum recommended RAM and maximum RAM for WindowsServer 2003.

Table 2.16 Minimum and Maximum RAM for Windows Server 2003

RAMSpecification

WindowsServer 2003,

Standard Edition

WindowsServer 2003,

Enterprise Edition

WindowsServer 2003,

Datacenter EditionMinimumrecommendedRAM

256 MB 256 MB 512 MB minimum

Maximum RAM 4 GB 32 GB 64 GB

To determine the amount of RAM required to support the file server workload, reviewthe number of remote file handles that can be efficiently supported by a file server


19/21

running Windows Server 2003. Next, review how additional RAM affects the total sizeof files, or file set size , that can be held in memory at any time.

Remote concurrent file handles

A file server running Windows Server 2003 with 1 GB of RAM can efficiently supportapproximately 100,000 remote concurrent file handles, regardless of the size of the files.If your users are likely to have more than 100,000 files open at a time, plan to split thisload across two or more servers.

File set size

On a file server with 1 GB of RAM, Windows Server 2003 can hold approximately500 MB of file content and NTFS metadata in memory. (The amount of memory used for

NTFS metadata depends on the depth of the directory hierarchy and query distribution,among other factors.) Windows Server 2003 uses the rest of the RAM for providing

nonpaged pool and other operating system functions. For each additional gigabyte of RAM that you add, Windows Server 2003 can use the entire RAM capacity for storingfile content in memory. For example, a file server with 3 GB of RAM can supportapproximately 2.5 GB of file content in memory. When the file set size exceeds theamount of memory, files are paged to disk. This paging can result in disk bottlenecks,though using a fast disk subsystem can alleviate this problem.

When determining how much RAM you plan to install in file servers, consider thefollowing guidelines:

When users typically access the same files, the file set is known as "hot," because

the files are frequently stored in memory. For hot file sets, invest in more RAM toaccommodate the entire hot file set. Typically, hot file sets are less than 1 percentof the file set, although this figure can vary.

When users access random files, the file set is known as "cold." For cold file sets,invest in faster disks, because users typically open files that are not already inmemory, and the response time is limited by disk latency. For example, if you cancut disk latency in half by using a faster disk subsystem (including number of disks, mechanical speed, and disk cache), compare the cost of doing so to theamount of RAM it would take to achieve similar performance. Using a faster disk subsystem might be less expensive.

Security Configuration Wizard Quick Start Guide

Updated: March 2, 2005

Applies To: Windows Server 2003


20/21

This guide is designed to get you up and running quickly with Security ConfigurationWizard (SCW), a tool for reducing the attack surface of computers running WindowsServer 2003 with Service Pack 1 (SP1). It provides system requirements, installationinstructions, steps for getting started with SCW, and instructions for troubleshootingsimple problems.

SCW determines the minimum functionality required for a server's role or roles, anddisables functionality that is not required. Specifically, SCW:

Disables unneeded services.

Blocks unused ports.

Allows further address or security restrictions for ports that are left open.

Prohibits unnecessary Internet Information Services (IIS) Web extensions, if applicable.

Reduces protocol exposure to server message block (SMB), LanMan, andLightweight Directory Access Protocol (LDAP).

Defines a high signal-to-noise audit policy.

SCW guides you through the process of creating, editing, applying, or rolling back asecurity policy based on the selected roles of the server. The security policies that arecreated with SCW are XML files that, when applied, configure services, network security, specific registry values, audit policy, and if applicable, Internet InformationServices (IIS).

Requirements for Installing and Running SCW

SCW is an optional component included with Windows Server 2003 SP1. You can installand run SCW only on computers running Windows Server 2003 with SP1. Thecomputers you target with SCW (for prototyping to create security policy or for application of SCW-created security policy) must also run Windows Server 2003 withSP1.

Several security-related IIS settings can be configured by using SCW. You need a server running IIS if you want to do this.

SCW is not used with Windows XP or other client operating systems or MicrosoftWindows Small Business Server 2003.

Securing Windows Small Business Server 2003

Instead of SCW, Windows Small Business Server 2003 uses the default settings in Setupand in the Configure E-mail and Internet Connection Wizard to help secure your server.


21/21

If you have not already run the Configure E-mail and Internet Connection Wizard, youshould run it to help secure your server.

To start the Configure E-mail and Internet Connection Wizard on the computerrunning Windows Small Business Server 2003

1. Click Start , and then click Server Management .2. In the console tree, click Internet and E-mail .3. In the details pane, click Connect to the Internet .

Getting Help

SCW Help is installed with Windows Server 2003 SP1, and it contains information beyond what is in this Quick Start Guide, including help for every page of SCW. After you install Windows Server 2003 SP1, you can access SCW Help through Help andSupport Center, or at the command line.

Viewing SCW Help topics

The SCW Help is available even though SCW itself is not installed by default.

To access SCW help through Help and Support Center

1. Click Start , and then click Help and Support .2. In Search , type SCW or type Security Configuration Wizard , and then press

ENTER.3. Click one of the listed SCW Help topics.

To access SCW help at the command line

1. Click Start , and then click Run .2. Type hh scwhelp.chm , and then press ENTER.

installing isa server 2000

Documents