Welcome to TechNet Blogs Sign in | Join | Help

TMG Client introduces automatic detection using Active Directory

1. Introduction

 

The new TMG Client that is available on TMG 2010 is now capable of performing automatic discovery using a record that resides on Active Directory. TMG Client still able to use the traditional methods (DHCP / DNS) for automatic discovery, the difference now is that if both options are enabled on UI (see Figure 1) the auto detection will take effect using the following flow:

 

1.       TMG Client will first try to retrieve information from Active Directory using LDAP query.

2.       If TMG Client is unable to retrieve that information due to an error with the connection, it won’t failover to DHCP / DNS automatic detection methods for security reasons. This reduces the risk that an attacker might try to force fallback to a less secure method by affecting Active Directory marker availability. Active Directory discovery is considered more secure than DHCP/DNS methods.

3.       In case that the connection succeeded to Active Directory but no information was found the TMG Client will failover to DHCP and then to DNS.

 

 

Figure 1 – TMG Client

 

In order to configure Active Directory to support that you should use the TMG Auto-Discovery Configuration Tool (TmgAdConfig.exe). This tool configures an Active Directory with a marker key that points to your Forefront TMG server. This key is going to be used by the TMG Client to locate the Forefront TMG server and connect to it.

 

Note: Active Directory-based auto detection works only for computers that are members of a domain. Use of AD Marker in workgroups is not supported.

 

2. Using TMGADConfig Tool

 

You can download the TMG AD Config Tool from Microsoft Download Center (look for the AdConfigPack.EXE). After download and install on TMG you can execute the following command line in order to register the AD marker key:

 

tmgadconfig add -default -type winsock -url http://ftmgfw.contoso.com:8080/wspad.dat

Forefront TMG Auto-Discovery Configuration Tool

New Winsock default marker successfully registered.

 

Note: to see more switches for this command used TMGAdConfig /?

 

The highlighted part is the one that will change according to the TMG’s FQDN and also the port used by TMG. When you run this command line TMG will send an LDAP request to the Domain Controller asking for the registration of this marker key. Here it is a sample of the LDAP traffic caused by this execution of this command line:

 

 

Figure 2 – Typical LDAP Traffic (click here to enlarge this picture).

 

Note: on this example TMG is 10.10.10.69 and the DC is 10.10.10.10

 

The LDAP search that is marked in the above traffic sample is exactly the location where this marker will be registered. If you use LDP.EXE you can browse through the location shown below:

 

Figure 3 – LDP Tool result.

 

When accessing this location, the right panel should show the value that has the TMG AD Marker that was registered as shown below:

 

Expanding base 'CN=Winsock Proxy,CN=Internet Gateway,CN=Services,CN=Configuration,DC=contoso,DC=com'...

Getting 1 entries:

Dn: CN=Winsock Proxy,CN=Internet Gateway,CN=Services,CN=Configuration,DC=contoso,DC=com

cn: Winsock Proxy;

distinguishedName: CN=Winsock Proxy,CN=Internet Gateway,CN=Services,CN=Configuration,DC=contoso,DC=com;

dSCorePropagationData: 0x0 = (  );

instanceType: 0x4 = ( WRITE );

keywords (2): Winsock Proxy; ISAServer;

name: Winsock Proxy;

objectCategory: CN=Service-Connection-Point,CN=Schema,CN=Configuration,DC=contoso,DC=com;

objectClass (4): top; leaf; connectionPoint; serviceConnectionPoint;

objectGUID: a87cf902-1b5a-4532-a9cb-bef8dd663fed;

serviceBindingInformation: http://ftmgfw.contoso.com:8080/wspad.dat;

serviceClassName: Winsock Proxy Service;

showInAdvancedViewOnly: TRUE;

uSNChanged: 496989;

uSNCreated: 496988;

whenChanged: 10/22/2009 9:08:54 AM Pacific Daylight Time;

whenCreated: 10/22/2009 9:08:53 AM Pacific Daylight Time;

 

3. Testing Client Configuration

 

To test the configuration on the client side you can use the FWCTool that comes with TMG Client, which is installed by default in %programfiles%\Forefront TMG Client folder.  Follow the steps below to perform this test:

 

1. On the client workstation, open command.

2. Navigate to the location where TMG Client is installed.

3. Run the command fwctool TestAutoDetect

 

Here it is an output sample of this command when perform all tests successfully:

 

FwcTool version 7.0.7733.100

Forefront TMG Client support tool

Copyright (c) Microsoft Corporation. All rights reserved.

 

Action:         Test the auto detection mechanism

Type:           Default

 

Detection details:

 

    Timeout is set to 60 seconds

    Locating WSPAD URL on the Active Directory server

    WSPAD object was found in the global Active Directory container

    WSPAD URL found on the Active Directory server:

    http://ftmgfw.contoso.com:8080/wspad.dat

    Initializing Web server connection

    Resolving IP addresses for ftmgfw.contoso.com

    Resolved 1 address(es):

    10.10.10.69

    Connecting to address #1: 10.10.10.69:8080

    Waiting for address #1 to connect

    Address #1 successfully connected

    Requesting wspad.dat file

    Web server is connected and ready to send WSPAD file

    Downloading WSPAD file

    WSPAD file was downloaded successfully

    Detected Forefront TMG: FTMGFW:1745

 

Result:         The command completed successfully.

 

The highlighted text above is your confirmation that the AD registration was correctly found by the TMG Client.

 

Author

Yuri Diogenes

Sr Security Support Escalation Engineer

Microsoft CSS Forefront Edge Team

 

Technical Reviewers

Bala Natarajan

Sr Security Support Escalation Engineer

Microsoft CSS Forefront TMG Beta Team

 

Eric Detoc

Escalation Engineer

Microsoft CSS Forefront TMG Beta Team

Published Friday, October 23, 2009 12:04 AM by isablog

Comments

No Comments
Anonymous comments are disabled
 
Page view tracker