eXtreme. tech. : Forefront

Forefront Protection (vs Online) for Exchange – FPE vs FOPE

David Tesar — Tue, 25 Aug 2009 00:52:00 GMT

In this interview with Mike Chan, I help clarify when you might want to utilize Forefront Protection for Exchange versus Forefront Online Protection for Exchange – or use both. Most of the video is spent white boarding out how things work between FPE / FOPE and Exchange 2010’s security.

Forefront Stirling – Public Beta Overview

David Tesar — Thu, 17 Apr 2008 09:59:00 GMT

With the launch of the 1^st public beta for Forefront Stirling on April 8^th, I thought it would be relevant to do a post this week on it. This release proves that the Stirling vision scenario in my previous blog article is becoming a reality. “Stirling” seems to be thrown around quite a bit and can be misunderstood, so let me 1^st clarify. Codename Stirling refers to the next wave of all Forefront products, scheduled to hit RTM in the 1^st half of 2009. This wave includes the “next version” of:

· Forefront Client Security (FCS)
· Forefront Security for Exchange Server (FSES),
· Forefront Security for SharePoint (FSS)
· ISA Server – new name Forefront Threat Management Gateway (TMG).

Additionally, this wave includes a server and single management console to interact with all of the above, commonly referred to as the “Stirling” server and “Stirling” management console. The console and server can be run on the same or separate machines. Down the road, we’ll have an official name to replace “Stirling” and “next version of”.

Ok, so what is some cool stuff to check out with the public beta?

· Dynamic response capabilities – see how the forefront products share information and interact with each other.
· Single management console and reporting for the entire technology suite except FSS - get a security state assessment for all of the connected machines & specify how you want to remediate through forefront policy.
· Integration with NAP – use NAP to remediate your machines
· Integrated malware and anti-virus protection – check out how it downloads & pushes out the updates
· Use powershell to manage it – by default Stirling uses powershell behind the scenes, but you can do it yourself if you feel inclined.

What are some things you can NOT you do yet?

· Install a topology which has more than one Stirling server
· Install the Stirling server, console, or next version of FCS on Windows Server 2008
· Install Terminal Services or a DC on the Stirling server
· Install non-English versions

Get started

Download the Stirling beta here.
The most helpful pre-requisite page to install everything here.
Stirling homepage
TechNet technical documentation for deployment, operations, etc.
Stirling blog
Forefront team blog

Note: this post can also be found on TechNet Edge here.

IT Pro Momentum Program (like a TAP or RDP)

David Tesar — Tue, 27 Nov 2007 02:21:00 GMT

Would you like to learn about or use Windows Server 2008, SQL Server 2008, or the next version of Forefront Edge? If you're based in USA and 'fit the bill', I'll get you an invite to the IT Pro Momentum portal. If you're in Ireland - contact Dave Northey. You can profile a project which uses one of the above mentioned technologies in your company's environment and receive benefits as your project moves along from Evaluate, through Plan and Pilot. Details below:

And as soon as you're ready to share your experiences with the wider community, let me know and I can help you make that happen (include you in our TechNet newsletter, post details about you on my blog, help you find an attentive audience to listen to you, whatever).

Also, if you have a great story about how your company is already using one of the above mentioned technologies - please let me know and I can help you out too. You can see a quick video of what some existing customers have already done here: Stories of IT Pros adopted new technologies through Momentum.

Please email me if you are interested.

Thanks,

Dave.

Forefront Stirling - The possibilities

David Tesar — Fri, 28 Sep 2007 22:54:00 GMT

That's right it's Stirling, not Sterling like silver. I'll cover the background behind the name perhaps in an interview with the product team.

Forefront is categorized into three categories: Client, Server, and Edge. Currently, the client and server forefront products have two separate management consoles and Edge doesn’t have a management console. In June at TechEd 2007 Orlando, we announced Forefront “Stirling” which will be a central management console for all of our forefront line of products. The first CTP is scheduled to be released sometime by the end of this year.

Ok, so other than a central console, why should I care about it? Thinking about the scenario below will help you realize why it’s much bigger than this…

1) A client downloads a virus which is new and has an unknown signature by browsing the web through their ISA server (scan 1 - missed).

2) The client executes the virus (scan 2 – missed) and then the virus proceeds to attempt to send individual emails to all of their contacts and also tries to replicate itself to other client machines in the network over a specific port.

3) Forefront Exchange notices this behavior (scan 3 – detected), immediately sends alerts to the IT staff via a pager/email/etc, automatically prohibits this client from sending those pieces of mail, and also takes action to stop this behavior by talking to the forefront client software.

4) Forefront client security detects (scan 4 – successful) the rapid attempt to spread to other machines, sends notifications to IT staff, notifies ISA to not allow this file to be downloaded, and stops the behavior from spreading by stopping it locally and telling the FCS console the file is a virus (if it hasn’t already been stopped by the assistance from Forefront Exchange).

5) Finally, at any point the IT staff can quickly identify where the virus entered the network on the ISA server, see the behavior of the virus, see what machines in the network have been affected, and if necessary quickly tell all clients to block the specific port it is trying to replicate on for all machines in the environment.

Ok... I know it was long, but it gets you to think about the power Stirling could have.

Other cool tidbits about it:

· Integration with SCCM 2007. So not only is it a central security console, it also is a central console for your entire enterprise’s computer management.

· Integration with AD. This might allow you to do cool stuff like roll out custom security policies to machines or users in specific OUs.

· The entire suite of products will be updatable via WSUS.

· Integration with NAP.

· Covers more than just viruses. Anti-malware, Anti-spyware, Anti-spam all included.

Get started:

Unfortunately, there's not much out there publicly yet - but check here for some more info: http://www.microsoft.com/forefront/prodinfo/roadmap/stirling.mspx

Forefront Server Security Management Console Beta 2 Released!

David Tesar — Thu, 07 Jun 2007 20:00:00 GMT

In addition to centrally managing Forefront Security for Exchange Server, Forefront Security for SharePoint and Microsoft Antigen e-mail security products, the Beta 2 release will include new features that enable customers to:

· Use SQL Server 2005 for quarantine and reporting

· Provide redundancy of FSSMC in case of server failure

· Auto-discover new Exchange servers on the network

· Navigate to Exchange servers easier with new filter options

· Manage Forefront security for Exchange CCR clusters

· Deploy Forefront and Antigen hotfixes

· Redistribute virus signatures to select servers

IAG runs ISA?

David Tesar — Fri, 01 Jun 2007 02:59:00 GMT

What is not obvious is the fact that the IAG appliance has the full edition of 2006 ISA standard edition running on it. I figured that I should do this as a follow up to my ISA vs IAG post - as I failed to mention it there. So why should I even buy ISA 2006 instead of IAG you might ask?

If you want any of the enhanced features for the enterprise version of ISA (NLB, Web farm publishing, shared configuration between multiple machines, etc)
As far as what I'm told, the cost for IAG is more than for a copy of ISA standard edition.
If you want to put the software on your own hardware instead of an appliance. IAG only can be purchased as an appliance currently.

I hope this helps. If there are other reasons, please feel free to comment.

Also, if this is the first post you're reading, please check out my post ISA 2006 versus IAG - Which one to use? which has more information and links to other sources.

Forefront IAG 2007 SP1

David Tesar — Thu, 31 May 2007 01:16:00 GMT

On May 21st, we announced IAG's SP1 - RTM expected around this August. I'll give a summary of the new features coming out with SP1:

Vista Client support

Details:

· Both online and offline installation / updates / removal of Download Manager

· Detection of multiple legacy client-security components

· SSL tunnel and session security with basic and socket forwarding

· Keyboard and mouse monitoring

· Network Connector functionality

· Added support for Forefront Client Security in endpoint security checks

Benefits:

· Attachment Wiper clears out IE images, cookies, history and auto-complete forms, plus private app-specific caches

ADFS enhancements

Details:

· SAML pre-authentication for all access

· Protected SAML-based access for users with federated trust relationships using granular, per-user policy

· DMZ-ready deployment (hardened appliance)

· Kerberos Constrained Delegation (KCD) support for SmartCard-only authentication

Benefits:

· Maintains SSO experience for users without needing direct server connections

· Web applications are not exposed

· Reduces TCO and increases security by eliminating need for a dedicated Federation Server Proxy

Performance

Detail:

· Enhanced regular expression handling

· Reduced buffer allocation / sizes

· Enhanced HTTP text string handling

Benefits:

· Reduced CPU consumption results in higher throughput

· Improved memory consumption

Internet Application Gateway (IAG) - Overview

David Tesar — Thu, 03 May 2007 02:59:00 GMT

Microsoft's Intelligent Application Gateway 2007 just released this February. It is a secure remote access gateway that provides SSL-based application access and protection.

So what are some of the cool things that IAG allows you to do?

NOTE: All of the items below you can do securely from an un-trusted network (such as the internet) while only requiring SSL (port 443) to be open to the IAG server and none require you to connect with a VPN connection. This means that you don’t have to worry about your internet connection allowing IPSec VPN traffic through. Many internet connections at coffee shops and hotels don't allow IPSec VPN traffic through...

1. Connect to internal websites and switch between them without having to re-input credentials
Microsoft has ~45: Any team sharepoint site, tar, hotfix, msexpense, itweb, autogroup, paystub, hrweb

2. Access non-web internal applications (such as file shares, Remote desktop)

3. Connect into an internal network with a full VPN connection

4. Execute various security checks for the client before allowing access to the application portal. These checks are highly-customizable via the GUI right out of the box. For instance, you can choose to only allow certain operating systems, check for the presence of anti-virus, etc.

Get started

General IAG learning:
Start an IAG virtual Lab (VS images w/ full functionality all done online)
Second IAG virtual Lab
Read some IAG White papers
Get a Product tour (Flash-based point-and-click)

ISA 2006 versus IAG - Which one to use?

David Tesar — Tue, 24 Apr 2007 05:02:00 GMT

If you read the only two places where ISA is compared to IAG, it doesn't really give a simple and clear comparison. I hope to do so now in this post. Please post comments if you find other comparison information out there.

The two comparisons I found are:
Secure Remote Access
IAG Frequently Asked Questions

(now updated) other comparison links from http://www.isaserver.org

Should You Get an ISA Firewall or the IAG 2007?
What's the ISA Firewall-based Microsoft IAG About?

To compare the two products, I am going to break it down into 3 major functionality categories: Forward Proxy, Reverse Proxy / Publishing, and VPN. Please keep in mind that you can run ISA and IAG independently or together in the same environment AND when you purchase IAG (you can only buy IAG via appliance vendors), it includes the standard edition of ISA.

Forward Proxy
This section is very simple to explain; IAG isn't a forward proxy at all. so if you need clients to get out to the internet through a proxy server you'll need to use ISA 2006. Along those lines, it also doesn't do web content caching for forward proxy or reverse. To learn more about ISA 2006's forward proxy and caching features, check out:
About ISA Server Clients
Caching and CARP in ISA Server 2006

Reverse Proxy / Publishing
This is where it gets tricky. Both ISA and IAG can securely publish resources, but the capabilities and ways it is done varies greatly between the two products. To compare the two it is easiest to break this down via a table. Of course, this isn't a comprehensive comparison - just some of the advantages that I see each product have over each other.

Publishing type:	ISA Advantages	IAG Advantages
Web Sharepoint OWA	· Can check service state of website (WPLB) · Can cache published content · Compression capabilities	· Can set granular access policies (User profiles, client validation – i.e. browser type, if running software, etc) · Client side cache clean-up and Attachment Wiper · Document upload/download policy controls · Portal makes it easier to switch between sites and applications
Exchange	· Supports RPC / RPC over HTTP for exchange server only · Supports secure publishing for SMTP traffic (port 25)	· Supports RPC / RPC over HTTP for any application or website. · Supports mobile device webpage support for portal and websites.
Non-HTTP(S) Apps	· Have to server publish the ports directly back to the server. More limited with amount of security granularity/control available compared to IAG. Exchange publishing does have more configuration/security than other non-HTTP(S) protocols. · Protocol inspection for some non-HTTP(S) protocols · Allows anonymous connections if desired	• Access to user's home directory and shared file folders using the built-in File Access application as a Web Part • Session management and security • Integrated Password Management • Supports almost any client-side application or server-side proxy • Policy based on endpoint profile • Application-specific session control • Seamless support of MS Office on the client, plus Web Services through host address translation and SharePoint-specific reroute actions • Can compute the MD5-hash of a client executable; only applications that match this hash are allowed push traffic through the SSL VPN tunnel

So what is my summary here? If you want real granular control over securely publishing your internal client applications - especially non-HTTP(s) ones, then IAG is definitely the way to go. It's great because even if the internal app your company uses is on a non-HTTP(s) port, a client can gain access through the stanadard 80 (HTTP) or 443 (HTTPS) ports that are open pretty much anywhere you're at that has internet access. The area where ISA wins with publishing is with Exchange (not OWA) and other applications that you would like to have open anonymous to the public (such as FTP and HTTP).

VPN
IAG is strictly a SSL VPN solution whereas ISA is only an IPSec VPN solution. The SSL VPN is nice because you can access anything on the internal network by only using the standard HTTPS port which will get around many internet connection issues. On the flip side, the IPSec VPN offers many more options with security.

Also, IAG does not have any site-to-site capabilites (SSL VPN tunnelling) and ISA does (IPSec VPN tunnelling). It's also worth noting that if you want to do any form of client-side checking with ISA this must all be done via custom scripting utilizing CMAK. IAG has a ton of pre-configured and customizable options for validating if the client is compliant (i.e. has AV that is installed and up to date, only certain OS or browser, etc).

Forefront IAG ISA Client Antigen Exchange Edge Security

David Tesar — Wed, 11 Apr 2007 03:04:00 GMT

Confused yet? I know that I was when I first started hearing this term Forefront... Is "Forefront" just a client/server security product or something else?

Forefront simply is a name that MS is branding onto our security related products. Forefront is divided into three categories of client, server, and edge security. Within those categories there are currently a total of 5 products.

Client:
1) Forefront Client Security - Comprehensive realtime protection against viruses, malware, and spyware

Server:
2) Forefront Security for Exchange Server - helps protect your mail server against Viruses, Worms, Spam, and Inappropriate Content. This is basically the "Antigen" for exchange product lines all combind into one for Exchange.
3) Forefront Security for Sharepoint - helps protect your sharepoint server against the latest threats, inappropriate content, and disclosure of confidential information.

Edge (a.k.a. "Edge Security and Access"):
4) Internet Security & Acceleration Server (ISA) 2006 - Application layer firewall and web proxy server.
5) Internet Application Gateway (IAG) - SSL remote access gateway. This can work with or independently from ISA to provide much more granular levels of access to published resources (file shares, applications, websites, etc). The easiest way to think about IAG is if you want to give people on an unprotected network granular and secure access to an internal resource without doing a IPSec/PPTP VPN, this will do the trick.

One thing that I think deserves a better and more simple explanation is the difference between ISA 2006 and IAG. I hope to publish another blog about this in the future. Please add a comment to this blog if you'd like me to write this up to spur me on...

The forefront overview which is linked on the forefront homepage does a decent job at explaining more about the differences, so I won't get into it in any more detail. I just wanted to clear that up for anyone who wanted to quickly understand this "forefront" area that we are throwing out there.