ISA and IAG

This update causes ISA Server to use random source ports for UDP sessions created by access rules which serve hosts in networks for which ISA Server defines a network address translation (NAT) relationship.

This update resolves the issue described in Microsoft Article 956910, DNS queries that are sent across a firewall do not use random source ports after you install security update 953230 (MS08-037). With this update, ISA Server allocates a large set of random UDP ports and then selects a port from this set for use in new UDP sessions. You can disable it programmatically (there is no user interface).

Grab it from here.

New features and feature improvements:

Configuration Change Tracking - Registers all configuration changes applied to ISA Server to help you assess issues that may occur as a result of these changes.

Test Button - Tests the consistency of a Web publishing rule between the published server and ISA Server.

Traffic Simulator - Simulates network traffic in accordance with specified request parameters, such as an internal user and the Web server, providing information about firewall policy rules evaluated for the request.

Diagnostic Logging Viewer - Now integrated as a tab into the ISA Server Management console, this feature displays detailed events on packet progress and provides information about handling and rule matching.
Improvements for existing features, including:

Support for integrated NLB mode in all three modes, including unicast, multicast, and multicast with Internet Group Management Protocol (IGMP). Previously, ISA Server integrated NLB-supported unicast mode only.

Support for use of server certificates containing multiple Subject Alternative Name (SAN) entries. Previously, ISA Server was able to use either only either the subject name (common name) of a server certificate, or the first entry in the SAN list.

Support for Kerberos Constrained Delegation cross-domain authentication. Credentials from users located in a different domain than the ISA Server, but in the same forest, can now be delegated to an internal published Web site by using KCD.

Support for client certificate authentication in a workgroup deployment. This removes the requirement to map each client certificate to an Active Directory directory user account.

For more information about this service pack, see KB 943462.

It isn't here yet but with the amount of information coming out of Microsoft about it lately, I suspect it will be out soon. I've put the entries important to me in bold.

SP1 - New and improved features:

Configuration Change Tracking — logs all configuration changes applied to ISA Server configuration to help you backtrack through your change history. (aka - the 'Who broke it' tracker)

Web Publishing Rule Test Button — helps you verify that the rule configuration agrees with what is set at the published web server and provides specific suggestions when they disagree.

Traffic Simulator — simulates network traffic as it would be seen by the ISA rules engine and gives you specific information about traffic processing along the way.

Diagnostic Logging Query — an extension to the Diagnostic Logging feature provided in the Supportability Pack, this feature makes it much easier to see only the data that is relevant to the current troubleshooting effort.

Support for Network Load Balancing (NLB) multicast and multicast with IGMP operations (KB 938550)

Support for certificates with multiple Subject Alternative Name (SAN) entries in published web servers (Exchange 2007 and OCS 2007 admins will enjoy this)

Kerberos Constrained Delegation (KCD) authentication supports trusted-domain user accounts (KB 942637)

Read more information about it here.

I really didn't expect this to be a public beta so soon!

An integrated security system that is easier to manage and control
Microsoft® Forefront™ codename "Stirling" is an integrated security system that delivers comprehensive, coordinated protection across endpoints, messaging and collaboration servers and the network edge that is easier to manage and control.

Download the beta here.

Personally, I am really excited over the direction that FCS v.Next and 'Stirling' is going.

This update (KB 939455) brings ISA 2006 inline, featurewise, with ISA 2004 SP3.

It fixes 20+ issues and adds:

1. Improvements to the ISA Server Management console.
2. Improved log viewing functionality.
3. Additional log filter functionality.
4. Diagnostic logging. Over 200 new diagnostic logging events are provided.
5. Integration with Microsoft ISA Server Best Practices Analyzer Tool.

In other words, a very nice update for ISA 2006!

I created this list because I could never remember what city/virtual machine ran what role in the premade MS F+SC Demo.
I thought others might find it handy.

Cairo
Client for IAG - certified endpoint

Cambridge
System Center Configuration Manager 2007

Denver
Domain Controller
Exchange 2007 with Outlook Web Access
Forefront Security for Exchange

Ibiza
Intelligent Application Gateway 2007 (IAG) (formerly Whale SSL)

Jamaica
Forefront Client Security server

Kiosk
Client for IAG - non-certified endpoint

Oxford
System Center Operations Manager 2007

Sydney
Windows Sharepoint Services 3.0
Forefront Security for Sharepoint

Vienna
Forefront Client Security client

I highly recommend trying out the VMs, BTW.

1. Run ISA Server 2004 Enterprise Edition on Windows 2003 RTM/SP1? Make sure to install ADAM SP1 on the ISA Server Configuration Storage Server before installing Windows 2003 SP2.

2. If you run ISA Server on a multi-core / multi-processor 32-bit computer, and the CPU is heavily utilized, you might (will) experience performance degradation, due to a change in interrupt handling in Windows 2003 SP2. Install and configure the Interrupt Affinity Tool as a workaround. Read KB 934809 for more information.

3. Disable receive-side scaling (RSS) support in Windows 2003 SP2, by following the instructions here.

For more details on the issues, go here.

Ahh yes, 64-bit binaries for Microsoft ISA client.

More info here:
http://msmvps.com/blogs/xperts64/archive/2006/09/05/ISA-Firewall-Client-for-x64.aspx

The ISA Server Team will release an update to the ISA Server 2004 Firewall Client. As part of the development process, they are running a short beta program to collect valuable feedback.
Highlights:

* Support for the Microsoft Windows Vistaâ„¢ operating system (builds 5231 and later).
* Support for the the 64-bit versions of the Microsoft Windows operating systems.

If you are interested in joining this beta program, please follow these instructions:

1. Go to http://beta.Microsoft.com
2. Sign in using your Passport account details
3. On the home page, click the link below the welcome message ("If you were issued a Guest ID by Microsoft, you can sign in by clicking here")
4. Enter the Guest ID: ISAFWC_x64
5. Choose "Survey" on the left side of the page
6. Complete and submit the survey.