http___microsoftguru.com.au_hr_tag_reverse-proxy__1.xml
1.1 2.1 2.2 2.3 2.4 3.1 4.1 4.2 4.3 5.1 5.2 5.3 6.1 7.1 7.2 7.3 7.4 8.1 8.2 8.3 8.4 9.1 10.1 10.2 10.3 10.4 10.5 10.6 10.7 11.1 11.2 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 28.2 29.1 29.2 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 37.2 37.3 38.1 38.2 39.1 40.1 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 58.1 59.1 60.1 61.1 62.1 63.1 64.1 65.1 66.1 66.2 66.3 66.4 66.5 67.1 67.2 68.1 68.2 69.1 69.2 69.3 69.4 70.1 70.2 70.3 71.1 72.1 72.2 73.1 74.1 75.1 76.1 77.1 77.2 78.1 79.1 80.1 81.1 81.2 82.1 82.2 83.1 83.2 84.1 84.2 85.1 85.2 85.3 85.4 86.1 87.1 87.2 88.1 89.1 90.1 90.2 91.1 91.2 92.1 93.1 94.1 95.1
FF TMG 2010—Can future be altered? I read the following articles about Microsoft Forefront TMG 2010. I was shocked by the news. TMG 2010 is one of the beautiful product Wintel Engineers and Security Administer can be proud off. I believe I am one of the biggest admirer of Forefront Product lines. The demise of Threat Management Gateway: Is Microsoft backing away from the edge? I would like to voice my own opinion on this matter. I am sure I will find lots of similar minded techie out there who would love to share same opinion as me. I would like to send an open request to Microsoft Corp and MVPs to pursue for an advanced version of TMG that incorporate cloud security and address modern day security challenges. I decided to write on a different perspective of TMG 2010 what I would like to see next service pack of Forefront Threat Management Gateway or in a future version if there is one. This is not an official account of Microsoft Corp. This is just my wish list. I hope and cross my finger that Microsoft will listen to those who are on the field working for a better and even bigger Microsoft community. FF TMG 2010: Here is details of evolution of today’s TMG TMG 2010 can be more advanced in terms Firewall Policy, Publishing Rules and Cloud Security. TMG 2010 may be available in Downloadable virtual Appliance build on Windows Server “Code name 8” and physical appliance through the Microsoft partners program. Microsoft declared TMG 2010 is in sustainable mode and will not invest on TMG for further development so my dream to administer TMG administration console via internet explorer and Silverlight will be just a dream. I would like to see TMG service pack as separate installed and TMG 2010+SP3 integrated together in a installer for those who wants to refresh TMG and adopt as a new customer. Topology and Installation Changes: I would like to see a Hyper-V network incorporated into TMG. As you all know when installing TMG, TMG installer prompt you for subnets of Local area network. The new version will prompt you to add your cloud networks in an installation window. The installer will secure the local area network and private cloud network using default configuration which you will be able to modify and align later on with your desired topology and network layout. Incorporating Cloud Security: clients and partners have serious concern over the years about Service provides who sells cloud solutions. For example, service provider selling Exchange cloud, SharePoint cloud, Anti-Spam and Security Cloud Solution. There are questions to be asked when you buying public cloud solutions. This is not just having a hypervisor and virtual center. what about application security, identity and governance. How would to address your client’s concern of internal threat and external threat. How client will trust a provider when they place their data in somewhere service provider’s cloud. Microsoft can/should/must address these issues by providing Security as a service. Forefront TMG can play a key role if Microsoft is willing take a step ahead to the bottom line. - Application security - Privacy - Legal issues - Availability - Identity management - Compliance - Business Continuity and data recovery - Data Security Firewall Rules: New Publishing Tools in Tasks pan should include - Publish FTP Servers - Publish Lync Server - Publish Streaming Media Server - Secure Cloud Network Configure IM and Social media policy: Web Access Policy Tasks Pan should include - Configure IM Access (Allow/Deny Skype/Lync/MSN/Yahoo Messenger) - Configure Social Media Access (Allow/Deny Social Media such as Twitter/FaceBook/Google+/Youtube) Networks: Network rules incorporate a build-in cloud network and network rules establishing communication from LAN to Cloud network and External to Cloud network. During installation of TMG; allow rules to be configured automatically when selecting Hyper-V Server in DMZ. Multicast NLB Configuration: NLB Properties should be added another check box to create firewall rule for Multicast NLB in a virtualized environment. That means Multicast NLB mac address can communicate within array members in a virtualized environment if there is strict security policy deployed through out the infrastructure. List of New Protocol available: New Protocols includes following protocols and many more: - Cloud Protocols - Lync Protocol - Hyper-v Protocols Generate offline Certificate request: There should be an option to generate offline certificate request in Systems>Tasks pan. Integrating Bing Search with TMG 2014 Cache: Search result cached in TMG from Bing Search Engine and presented to client. Bandwidth Management: TMG should be able to manage bandwidth by single user, multiple users, AD Security groups, IP address, Computer Name, Department, Site, Branch. Configure Branch or Site TMG Server: Option can be selected during installation of TMG 2010+SP3 (integrated installer) whether TMG is a primary site or branch site. Selecting Branch Site will auto configure site server with site to site VPN (if selected) and even replicate with primary sites firewall rules and policies (depending on topology). when installing a branch TMG branch TMG will automatically create branch cache depending on selection of topology . Reporting: Following are the examples of the reports will be available in TMG 2010 SP3. there will be many more. - User based report - AD Security Group Based report - Web Site Visited - IP Address visited - Web/Content Uses report - Download reports by users/Group/Department - Bandwidth Uses report - Caching report - Search Engine Visitor by Search Engine report - Real Time/Custom Traffic report - Traffic Trending report - Top 20 Net users - Top 20 Site Visited - Default Monthly report - Default Yearly report - TMG Health report Audit and Change Management: TMG will include complete change manage and recording of Tasks/Events generated by role based user and systems itself. Role based TMG management: TMG Workgroup Deployment and Domain Member deployment should include RBAC management. - Administrator - Organization Administrator (member of this group manages cluster of Arrays ) - Backup operator (Commvault/Symantec Client/SCDPM client integrated) - Auditor/User (view permission) - Firewall Rules and Web Access Policy Operator - Single or Multiple array administrator Tool Box: Pre-installed BPA, Troubleshooting, Monitoring & Capturing Real Time Traffic. Learn more about TMG here . Configure FF TMG 2010 as SOCKS Proxy In this article I am going write about SOCKS proxy and applications of SOCKS proxy in enterprise. lets begin with SOCKS proxy. Socket Secure (SOCKS) is an Internet protocol that routes network packets between a client and server through a proxy server. SOCKS servers will proxy TCP connections to an arbitrary IP address as well as providing a means for UDP packets to be forwarded. SOCKS performs at Layer 5 of the OSI model—the session layer. In simple terms, SOCKS is an IETF approved standard for TCP/IP based networking applications. The SOCKS proxy provides the capability to allow traffic to be handled by a proxy for those applications (IM, ICQ) that do not have the native ability to set proxy parameters. Let me explain forward proxy or proxy server. A proxy server’s function is to receive a request from a web browser or client, to perform that request (possibly after authorization checks), and return the results to the browser or client. Advantages of proxy is the IP addresses or names of the internal systems never appear on the Internet, internet see the address of the proxy server. So attackers cannot use the addresses to gain information about your internal system names and network structure. Requests for certain sites can be restricted or banned. Web proxy servers usually support many protocols, including HTTP, FTP, Gopher, HTTPS. How does SOCKS server works? Proxy servers can themselves use the SOCKS protocol to provide additional security. SOCKS proxy add a layer of encapsulation into the request from the client and forward the encapsulated request to the destination. Advantages: - Encapsulating any TCP protocol within the SOCKS protocol. On the client system, within the corporate network, the data packets to be sent to or from an external system will be put inside a SOCKS packet and sent to a SOCKS server. - Returning packets will be sent to the SOCKS server, which will encapsulate them similarly and pass on to the original client, which remove the SOCKS encapsulation, giving the required data. Disadvantages: - The advantage of all this is that the firewall can be very simply configured, to allow any TCP/IP connection on any port, from the SOCKS server to the non-secure Internet, trusting it to disallow any connections which are initiated from the Internet. - The disadvantages are that browser configuration is more complex, the added data transfers can add an extra delay to page access, and sometimes proxies impose additional restrictions such as a time-out on the length of a connection, preventing very large downloads. Microsoft FF TMG 2010 can perform itself as a SOCKS server or SOCKS Gateway or SOCKS Proxy. To configure Microsoft FF TMG 2010 as SOCKS gateway. Log on to FF TMG 2010>Open TMG management console>Click on System>Click on Application Filter>Right Click SOCKS4 Filter>Click Enable Apply Changes>Click OK. Right Click SOCKS4 Filter>Click Enable>Click Property. Keep Default Port number>Select the network where SOCKS request will originate. For example Internal Network. Click Ok. Apply Changes>Click Ok. Now create a firewall policy to allow SOCKS communication between a source and destination. For example here I created policy opening SOCKS port between internal network and SOCKS gateway that is my proxy server. Apply changes. Click Ok. The following are the screenshot shows ICQ protocol available in TMG 2010 Protocols. If you don’t see your desired protocol on the list. you can add user defined protocol by simply adding new protocol. for ICQ communication, you have to create a rule specifying source and destination and the protocol you are allowing. To Configure FTP SOCKS connection configure global settings of cute FTP or individual connection settings in each connections shown as below. To configure proxy settings in IE. Open IE>Click Tools>Click Internet options>Click Connections>Click LAN Settings>Click proxy Settings and add SOCKS gateway or SOCKS proxy server details. You can configure SOCKS proxy via GPO. Create and Link a GPO with an OU> Right Click on GPO>Click Edit>navigate to User configuration\windows settings\internet explorer maintenance Expand internet explorer maintenance node, and in the connection section, double-click Proxy settings. You can define Proxy setting for users. To configure ICQ, Click on the Main button>Select Preferences>Click Connections. Click on the Firewall tab and select Socks4 - Type Proxy IP address in the Host - Type in the proxy Port 1080 - Type username and password in the Authentication - Apply and Click Ok
1.1 2.1 2.2 2.3 2.4 2.5 3.1 3.2 4.1 4.2 5.1 5.2 5.3 5.4 6.1 6.2 6.3 7.1 8.1 8.2 9.1 10.1 11.1 12.1 13.1 13.2 14.1 15.1 16.1 17.1 17.2 18.1 18.2 19.1 19.2 20.1 20.2 21.1 21.2 22.1 23.1 23.2 24.1 25.1 26.1 26.2 27.1 27.2 28.1 29.1 30.1 31.1
Konfiguracija FF TMG 2010 kao SOCKS proxy U ovom članku ću pisati o SOCKS proxy i primjenu SOCKS proxy u poduzeću. omogućuje početi s SOCKS proxy. Socket Secure (čarape) je Internet protokol koji usmjerava pakete između klijenta i poslužitelja kroz proxy poslužitelja. SOCKS proxy poslužitelji će TCP veze s proizvoljnim IP adrese, kao i pružanje sredstva za UDP paketa biti proslijeđen. SOCKS nastupa na Layer 5. OSI modela -session sloja. U jednostavnim uvjetima, čarape je IETF odobreni standard za TCP / IP based umrežavanje aplikacije. SOCKS proxy pruža mogućnost da dopusti promet biti obrađene od strane punomoćnika za one aplikacije (IM, ICQ) koji nemaju prirodna sposobnost za postavljanje proxy parametre. Dopustite mi objasniti naprijed proxy ili proxy poslužitelj. Proxy poslužitelj je funkcija primiti zahtjev od web pregledniku ili klijentu, obavljati taj zahtjev (eventualno nakon autorizacije provjere), i vratiti rezultate u pregledniku ili klijentu. Prednosti proxy je IP adrese ili imena internih sustava nikada se ne pojavljuju na internetu, internet vidjeti adresu proxy poslužitelja. Dakle, napadači ne mogu koristiti adrese dobiti informacije o vašim internim sustava imenima i strukturi mreže. Zahtjevi za određene web stranice može biti ograničen ili zabranjen. Web proxy poslužitelji obično podržavaju mnoge protokole, uključujući HTTP, FTP, Gopher, HTTPS. Kako SOCKS poslužitelj radi? Proxy poslužitelji mogu sami koristiti SOCKS protokol pružiti dodatnu sigurnost. SOCKS proxy dodati sloj kućištima u zahtjeva od klijenta i proslijediti upakiranog zahtjev do odredišta. Prednosti: - Encapsulating bilo TCP protokol unutar SOCKS protokol. Na klijentskom sustavu, unutar korporativne mreže, paketi podataka biti poslana na ili iz vanjskog sustava će se staviti unutar SOCKS paketa i poslan u SOCKS poslužitelj. - Vraćanje paketi će biti poslan na SOCKS poslužitelj, koji će ih zatvoriti u kućište slično i proći na izvornom klijenta, koji se otkloni SOCKS enkapsulaciju, dajući potrebne podatke. Nedostaci: - Prednost od svega je to da firewall može biti vrlo jednostavno konfigurirati, kako bi se omogućilo bilo TCP / IP vezu na bilo kojoj luci, od SOCKS poslužitelj non-Secure Internet, vjerujući da opovrgavati nikakve veze koje su pokrenute s Interneta. - Nedostaci su da preglednik konfiguracija je složeniji, dodao transferi podataka može dodati dodatni kašnjenja stranice pristupa, a ponekad i opunomoćenike nametnuti dodatna ograničenja kao što je time-out na duljinu veze, sprečavanje vrlo velike preuzimanja. Microsoft FF TMG 2010 može se obavljati kao SOCKS poslužitelj ili SOCKS Gateway ili SOCKS proxy. Za konfiguriranje Microsoft FF TMG 2010 kao SOCKS pristupnika. Prijavite se na FF TMG 2010> Otvoreno TMG upravljanje konzole> Kliknite na System> Kliknite na Application Filter> desni klik SOCKS4 Filter> kliknite Omogući Primijeni izmjene> Kliknite OK. Pravo Kliknite SOCKS4 Filter> Kliknite Omogući> Kliknite nekretnine. Držite broj porta> Odaberite mrežu gdje čarape će zahtjev potječe. Na primjer internoj mreži. Kliknite U redu. Primijeni izmjene> Kliknite OK. Sada stvoriti politiku firewall kako bi se omogućilo SOCKS komunikaciju između izvora i odredišta. Na primjer ovdje sam stvorio politike otvaranja SOCKS port između internoj mreži i SOCKS pristupnika koji je moj proxy poslužitelj. Primijeni promjene. Kliknite U redu. Evo screenshot pokazuje ICQ protokol dostupan u TMG 2010 protokolima. Ako ne vidite željeni protokol na popisu. možete dodati korisnički definirane protokol jednostavnim dodavanjem novog protokola. za ICQ komunikacije, morate stvoriti pravilo navodeći izvor i odredište i protokol koji omogućuje. Da Konfiguracija FTP čarape veza podesiti općenite postavke Cute FTP ili pojedinih postavki veze u svakom veza prikazanih u nastavku. Za konfiguriranje proxy postavke u IE. Otvorite IE> Kliknite Alati> Internet opcije Kliknite> Kliknite Veze> Kliknite LAN Postavke> Kliknite proxy postavke i dodati SOCKS pristupnika ili SOCKS proxy poslužitelja pojedinosti. Možete konfigurirati SOCKS proxy preko GPO. Stvaranje i Veza GPO s OU> Desni klik na GPO> Kliknite Edit> navigaciju za User konfiguraciji \ windows postavke \ Internet Explorer održavanje Proširi Internet Explorer čvor održavanja, au priključnom dijelu, dvokliknite Proxy postavke. Možete definirati postavke proxy za korisnike. Za konfiguriranje ICQ, Kliknite na gumb Main> odaberite Preferences> Kliknite Connections. Kliknite na Firewall kartici i odaberite SOCKS4 - Tip proxy IP Adresa u hostiji - Tip u punomoćnika Luka 1080 - Tip korisničko ime i lozinku u Authentication - Nanesite i kliknite OK