Book Image

Microsoft Forefront UAG 2010 Administrator's Handbook

By : Erez Ben-Ari, Ran Dolev, Erez Y Ben
Book Image

Microsoft Forefront UAG 2010 Administrator's Handbook

By: Erez Ben-Ari, Ran Dolev, Erez Y Ben

Overview of this book

Microsoft Forefront Unified Access Gateway (UAG) is the latest in a line of Application Publishing (Reverse Proxy) and Remote Access (VPN) Server products. The broad set of features and technologies integrated into UAG makes for a steep learning curve. Understanding all the features and abilities of UAG is a complex task that can be daunting even to experienced networking and security engineers. This book is the first to be dedicated solely to Microsoft Forefront UAG. It guides you step-by-step throughout all the stages of deployment, from design to troubleshooting. Written by the absolute experts who have taken part of the product’s development, official training and support, this book covers all the primary features of UAG in a friendly style and a manner that is easy to follow. It takes you from the initial planning and design stage, through deployment and configuration, up to maintenance and troubleshooting. The book starts by introducing UAG's features and and abilities, and how your organization can benefit from them. It then goes on to guide you through planning and designing the integration of the product into your own unique environment. Further, the book guides you through the process of publishing the various applications, servers and resources - from simple web applications to complex client/server based applications. It also details the various VPN technologies that UAG provides and how to take full advantage of them. The later chapters of the book educate you with common routine “upkeep” tasks like monitoring, backup and troubleshooting of common issues. Finally, the book includes an introduction to ASP, which some of the product's features are based on, and can help the advanced administrator with enhancing and customizing the product.
Table of Contents (21 chapters)
Microsoft Forefront UAG 2010 Administrator's Handbook
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Preface
Index

Planning the networking infrastructure


From a networking perspective, one must carefully plan the IP addresses assigned to the server, especially when NAT needs to be used on either the external or internal side. During the installation of UAG, the TMG firewall is also installed, and it includes a set of access rules that define the internal and external networks. An administrator should avoid assigning temporary or invalid IP addresses to the server, if possible. If the plan is to have the server hosted in a temporary test environment before deploying it to the production environment, do your best to simulate the real environment as closely as possible. A common bad practice that often leads to problems is configuring the external side of the UAG server so that it's facing into the internal corporate network. This sounds attractive as it would let you do testing with internal corporate computers, but it could lead to impossible routing scenarios, and is strongly discouraged. A good practice would be to dedicate a computer or a virtual machine to be used as a test client, and physically connecting it to the same subnet as the external interface.

As stated before, UAG is, fundamentally, a router, so the Subnet Mask and default gateway are also very important. A default gateway should be assigned to the external interface of UAG only, and the subnet masks and IP addresses need to be carefully planned so that there is no overlap. If the internal network contains additional IP ranges that are outside the IP range assigned to the internal Network Card, these may need to be added to the Server's routing table in the form of static routing rules. All this should be done before the product is installed, so that the TMG server does not end up being inoperational due to network configuration conflicts or blocking traffic it should not be blocking.