Configuring application settings for Forefront TMG Clients

1. In the Forefront TMG Management console, in the tree, click Networking, and then click the Networks tab.
2. In the task pane, on the Tasks tab, under Related Tasks, select Configure Firewall Client Settings.
3. To configure a new application setting, do the following:
   1. On the Application Settings tab, click New.
      
   2. On the Application Entry Setting dialog box, enter the application name, key, and value, and then click OK.
      
4. To modify an existing application setting, in the Settings list, click the application, and then click Edit. Apply the change and click OK.
5. To delete an existing application setting, in the Settings list, click the application, and then click Remove.

ISA Blocking only the POP3 Server all Sites working

Outlook requires the Firewall Client Software to be installed on the Client in order to work dependably. 

Problem: Outlook is exempted from using the FWC by default.  So it must be enabled. 

Enabled it in the ISA MMC under the Firewall Client Settings,...Applications,...look for outlook, disabled=1 and change it to outlook, disabled=0.  Note, it may take up to 30 minutes for the changes to take effect. 

CISCO ASA IOS 9.1 NAT Configurations

Static nat cofiguration on Cisco ASA 5512 with IOS 9.1
========================================================
ASA5512(Config)# object network emailserver
ASA5512(Config-network-object)# host 10.42.1.10
ASA5512(Config-network-object)# nat (inside,outside) static 68.15.89.20
ASA5512(Config)# access-list inbount extended permit tcp any host 10.2.1.10 eq smtp
ASA5512(Config)# access-group inbound in interface outside


configure a dynamic nat
=========================

object network inside-subnet
 subnet 192.168.0.0 255.255.255.0
 nat (inside,outside) dynamic interface

When hosts matching the 192.168.0.0/24 subnet traverse from the inside interface to the outside interface, we want to dynamically translate them to the outside interface
             
Configure NAT to Access Webserver from Internet
=================================================

object network webserver-external-ip
 host 198.51.100.101
!
object network webserver
 host 192.168.1.100
 nat (dmz,outside) static webserver-external-ip service tcp www www

access-list outside_acl extended permit tcp any object webserver eq www
!
access-group outside_acl in interface outside



When hosts on the outside establish a connection to 198.51.100.101 on destination TCP port 80 (www), we will translate the destination IP address to be 192.168.1.100 and the destination port will be TCP port 80 (www) and send it out the dmz

Dynamic NAT with dynamic PAT backup
====================================

The following example configures dynamic NAT with dynamic PAT backup to translate IPv6 hosts to IPv4. Hosts on inside network 192.168.1.0/24 are mapped first to the IPv4_NAT_RANGE pool (209.165.201.1 to 209.165.201.30). After all addresses in the IPv4_NAT_RANGE pool are allocated, dynamic PAT is performed using the IPv4_PAT address (209.165.201.31). In the event that the PAT translations are also used up, dynamic PAT is performed using the outside interface address.

ciscoasa(config)# object network IPv4_NAT_RANGE
ciscoasa(config-network-object)# range 209.165.201.1 209.165.201.30

ciscoasa(config-network-object)# object network IPv4_PAT
ciscoasa(config-network-object)# host 209.165.201.31

ciscoasa(config-network-object)# object-group network IPv4_GROUP
ciscoasa(config-network-object)# network-object object IPv4_NAT_RANGE
ciscoasa(config-network-object)# network-object object IPv4_PAT

ciscoasa(config-network-object)# object network my_net_obj5
ciscoasa(config-network-object)# subnet 192.168.1.0 255.255.255.0
ciscoasa(config-network-object)# nat (inside,outside) dynamic IPv4_GROUP interface

Easy VPN Configuration -

ASA5510 Configuration (Easy VPN Server)

! Assumes local subnet = 10.223.0.0/24
! Assumes remote subnet = 10.0.0.0/24

! isakmp policies
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption aes-256
 hash sha
 group 5
 lifetime 86400

! NAT exemptions
access-list NONAT extended permit ip 10.223.0.0 255.255.255.0 10.0.0.0 255.255.255.0
nat (inside) 0 access-list SD_NONAT

! Defines the remote subnet
access-list US1998 remark ACL for EZ VPN Remote
access-list US1998 extended permit ip 10.223.0.0 255.255.255.0 10.0.0.0 255.255.255.0

! Group policy defines the configuration applied to the EZ VPN Remote client
group-policy EZVPN_GP internal
group-policy EZVPN_GP attributes
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value US1998
 nem enable
 webvpn

! Tunnel group is used for initial authentication and to apply group policy
tunnel-group EZVPN_TG type ipsec-ra
tunnel-group EZVPN_TG general-attributes
 default-group-policy EZVPN_GP
tunnel-group EZVPN_TG ipsec-attributes
 pre-shared-key <group password here>

! EZ VPN remote user account password
username US1998 password <user password here>

crypto dynamic-map DYNAMIC-MAP 5 set transform-set ESP-AES-128-SHA
crypto map OUTSIDE_MAP 65530 ipsec-isakmp dynamic DYNAMIC-MAP

ASA5505 Configuration (Easy VPN Client)

vpnclient server 5.5.5.5 !(public IP of ASA5510)
vpnclient mode network-extension-mode
vpnclient vpngroup EZVPN_TG password <group password>
vpnclient username  US1998 password <user password>
vpnclient enable

How to Configure DNS on ASA

Step 1:
Enable dns service on the inside interface
ciscoasa(config)# dns domain-lookup inside

Step 2:
Define dns servers:
ciscoasa(config)# dns name-server 4.2.2.2 4.2.2.3

vpnsetup ipsec-remote-access steps

ASA5510(config)# vpnsetup ipsec-remote-access steps

Steps to configure a remote access IKE/IPSec connection with examples:

1. Configure Interfaces

        interface GigabitEthernet0/0
         ip address 10.10.4.200 255.255.255.0
         nameif outside
         no shutdown

        interface GigabitEthernet0/1
         ip address 192.168.0.20 255.255.255.0
         nameif inside
         no shutdown

2. Configure ISAKMP policy

        crypto isakmp policy 65535
         authentication pre-share
         encryption aes
         hash sha

3. Setup an address pool

        ip local pool client-pool 192.168.1.1-192.168.1.254

4. Configure authentication method

        aaa-server MyRadius protocol radius
        aaa-server MyRadius host 192.168.0.254
         key $ecretK3y

5. Define tunnel group

        tunnel-group client type remote-access
        tunnel-group client general-attributes
         address-pool client-pool
         authentication-server-group MyRadius
        tunnel-group client ipsec-attributes
         pre-shared-key VpnUs3rsP@ss

6. Setup ipsec parameters

        crypto ipsec transform-set myset esp-aes esp-sha-hmac

7. Setup dynamic crypto map

        crypto dynamic-map dynmap 1 set transform-set myset
        crypto dynamic-map dynmap 1 set reverse-route

8. Create crypto map entry and associate dynamic map with it

        crypto map mymap 65535 ipsec-isakmp dynamic dynmap

9. Attach crypto map to interface

        crypto map mymap interface outside

10. Enable isakmp on interface

        crypto isakmp enable outside

vpnsetup site-to-site steps

ASA5510(config)# vpnsetup site-to-site steps

Steps to configure a site-to-site IKE/IPSec connection with examples:

1. Configure Interfaces

        interface GigabitEthernet0/0
         ip address 10.10.4.200 255.255.255.0
         nameif outside
         no shutdown

        interface GigabitEthernet0/1
         ip address 192.168.0.20 255.255.255.0
         nameif inside
         no shutdown

2. Configure ISAKMP policy

        crypto isakmp policy 10
         authentication pre-share
         encryption aes
         hash sha

3. Configure transform-set

        crypto ipsec transform-set myset esp-aes esp-sha-hmac

4. Configure ACL

        access-list L2LAccessList extended permit ip 192.168.0.0 255.255.255.0 192.168.50.0 255.255.255.0

5. Configure Tunnel group

        tunnel-group 10.20.20.1 type ipsec-l2l
        tunnel-group 10.20.20.1 ipsec-attributes
         pre-shared-key P@rtn3rNetw0rk

6. Configure crypto map and attach to interface

        crypto map mymap 10 match address L2LAccessList
        crypto map mymap 10 set peer 10.10.4.108
        crypto map mymap 10 set transform-set myset
        crypto map mymap 10 set reverse-route
        crypto map mymap interface outside

7. Enable isakmp on interface

        crypto isakmp enable outside