Although the VPN template screen (see figure below) doesn’t seems to have any news on this area, the new TMG Data Packager introduces new logs that can assist you when troubleshooting VPN site to site issues.  

Just want to drop a quick note about a new hotfix package that we just released for ISA Server 2006, for more information go to http://support.microsoft.com/kb/980067

Consider a scenario where you have a client workstation behind Forefront TMG 2010 and you are trying to download files from a FTP Server. You are successfully able to logon on the FTP but after type the command “dir” you get the error message below:

The message is pretty clear about what is going on, isn’t it? Well, it is but where do I enable this option? I don’t remember having this on ISA!! To address this issue you just need to enable a new option that we have on TMG, this option is located on the FTP Filter properties as shown below:

After enabling this option and apply the changes you should be able to list your files just fine. It is important to mention that this setting has nothing to do with the FTP Read Only option, that you had in ISA 2004/2006 and still have it on TMG. The FTP Filter when running in read only mode (see figure below) will blocks all commands in the control channel except the following ones:

“ABOR, ACCT, CDUP, CWD /0, FEAT, HELP, LANG, LIST, MODE, NLST, NOOP, PASS, PASV, PORT, PWD /0, QUIT, REIN, REST, RETR, SITE, STRU, SYST, TYPE, USER, XDUP, XCWD, XPWD, SMNT”

You can customize this list by using the sample script below (from Configuring Add-ins MSDN article),in this example the script configures FTP Access Filter to allow only the USER and PASS commands:

Note: don’t change the default Read Only commands unless you have a real business need for that.

Many times we hear consultants, firewall administrators and others asking how to use TMG as a Secure Web Gateway, which is a quiet fair question. But sometimes we also hear things like: where do I enable Secure Web Gateway feature on Forefront TMG 2010? Although this is also a valid question, it shows that whoever is asking this question possibly don’t know that Secure Web Gateway is not a feature, it is a combination of many features to be implemented as a single solution. This confusion is critical to really understand TMG value proposition on this area and how to fit TMG on a SWG scenario. In order to better clarify this gap that we have in the market we (MS Press TMG Book Authors) wrote an article for TechNet Magazine (March 2010 issue) that technically explains how to use Forefront TMG as a Secure Web Gateway, read it more at: http://technet.microsoft.com/en-us/magazine/ff472472.aspx

A special thanks to Eric Detoc (Microsoft France) and Thomas Detzner (Microsoft Germany) for reviewing this article.

Just dropping a quick note about some updates at Tales from the Edge:

• Considerations when using antivirus software on ISA Server: this article is fully updated on the recommendations for IAG, TMG and UAG.
• Forefront TMG is SIP-ware: comprehensive guide about SIP Filter on TMG.

Enjoy !!

1. Introduction

TMG Data Packager is part of the new TMG BPA that is already available for download and on this new release the Data Packager has some additions to cover new features of the product. What? You don’t know what the Data Packager does? Ok, so review the articles below before continue to read this post:

Using ISABPA for Proactive and Reactive Work with ISA Server – Part 1 of 2

Using ISABPA for Proactive and Reactive Work with ISA Server – Part 2 of 2

2. New Additions

When you select a template, such as Web Proxy and Web Publishing and click Next, you will notice that the new interface shows a comprehensive checklist of the options that are selected by this template as shown below:

When you click Modify Options you will see the new additions, highlighted below:

I’ve being so busy lately that I couldn’t really stop to write some posts that I have on hold, waiting for me to complete it. Me and Tom Shinder are also very busy working on a tight schedule for a new MSPress book (details will be revealed soon) and writing here is getting very challenging, but I will come back soon. That being said, today I would like to highlight some of my friend’s post in the Edge (ISA/TMG/IAG/UAG) Community, here are some good new posts:

Richard Hicks explains in more details how TMG Enterprise Array works and how to manage it:

http://www.isaserver.org/tutorials/TMG-Enterprise-Arrays-Explained.html

Jason Jones explains how to generate a certificate to be used in TMG HTTPS Inspection. Although this one is not new (since it was published in January) but it’s very good:

http://blog.msedge.org.uk/2010/01/generating-tmg-https-inspection.html

Deb Shinder goes over the EMail Protection configuration on TMG on this series of very good articles:

http://www.isaserver.org/tutorials/Installing-Configuring-Email-Hygiene-Solution-TMG-2010-Firewall-Part1.html

http://www.isaserver.org/tutorials/Installing-Configuring-Email-Hygiene-Solution-TMG-2010-Firewall-Part2.html

http://www.isaserver.org/tutorials/Installing-Configuring-Email-Hygiene-Solution-TMG-2010-Firewall-Part3.html

I don’t know if you notice but TMG Best Practices Analyzer is out there already and Marc Grote goes over the core features of the new TMG BPA:

http://www.isaserver.org/tutorials/Microsoft-Forefront-TMG-Best-Practice-Analyzer.html

Last but not least, did you know that Microsoft released a hotfix update package for Forefront TMG 2010 last January? Yep, it did, review http://support.microsoft.com/kb/979578 for more information and notice that this package contains 3 updates:

• 978092 FIX: You cannot import an XML file that was exported from an enterprise that includes a Forefront TMG 2010 Standard Edition-based server
• 979249 FIX: You cannot enable the malware inspection for an access rule in Forefront TMG 2010 EMS
• 979250 FIX: You cannot add an e-mail address that contains special characters to the list of block senders in Forefront TMG 2010

I would like to say a special thanks to Miha Pihler for discovering and bring to our attention the bug that was fixed on 979250.