How to publish a Web site on a computer that is running ISA Server 2006 or ISA Server 2004 (885186)


The information in this article applies to:

  • Microsoft Internet Security and Acceleration Server 2004, Standard Edition
  • Microsoft Internet Security and Acceleration Server 2004, Enterprise Edition
  • Microsoft Internet Security and Acceleration Server 2006 Enterprise Edition
  • Microsoft Internet Security and Acceleration Server 2006 Standard Edition

INTRODUCTION

This article discusses how to configure a Web publishing rule to publish a Web site that resides directly on your Microsoft Internet Security and Acceleration (ISA) Server 2006 or ISA Server 2004 computer.

MORE INFORMATION

Before you configure a Web publishing rule

Before you configure a Web publishing rule, you must disable socket pooling in Microsoft Internet Information Services (IIS).

For additional information about how to disable socket pooling if ISA Server 2004 is installed on a Microsoft Windows 2000 Server-based computer, click the following article numbers to view the articles in the Microsoft Knowledge Base:

238131 How to disable socket pooling

259349 IIS binds to all available IP addresses when it starts

For more information about how to disable socket pooling if ISA Server is installed on a Microsoft Windows Server 2003-based computer, click the following article number to view the article in the Microsoft Knowledge Base:

813368 IIS 6.0: Setting metabase property DisableSocketPooling has no effect

If you want to use automatic discovery, we recommend that you configure IIS to use another port instead of port 80. ISA Server uses TCP port 80 to publish automatic discovery information. If you do configure IIS to use another port, users must specify a port to connect to the published Web site.

How to configure a Web publishing rule in ISA Server 2006

  1. Start the ISA Server Management snap-in.
  2. Expand the ISA Server computer node, and then click Firewall Policy.
  3. On the Tasks tab, click Publish Web Sites to start the New Web Publishing Rule Wizard.
  4. Type a name for the rule in the Web publishing rule name box. For example, type Publish internal Web server, and then click Next.
  5. On the Select Rule Action page, make sure that the default Allow action is selected. This setting enables requests to reach the Web server according to the conditions that are set by the rule.
  6. Click Next.
  7. On the Publishing Type page, leave the default Publish a single Web site or load balancer option selected, and then click Next.
  8. Click Use non-secured connections to connect the published Web server or server farm, and then click Next.

    Note If you want to publish a Web server that receives HTTPS requests, click Use SSL to connect to the published Web server or server farm. In this situation, you must have a digital certificate installed on the server. For more information about the requirements for Secure Sockets Layer (SSL) support, click the server connection security link on the Server Connection Security page of the New Web Publishing Rule Wizard. For more information about digital certificates for ISA Server, visit the following Microsoft Web site:

    http://go.microsoft.com/fwlink/?LinkId=20794

  9. On the Internal Publishing Details page, do the following:
    1. Type the internal Web address of the Web site in the Internal site name box. For example, type ISA_Server_Name in the Internal site name box. Do not include http:// in this Web address.
    2. Click to select the Use a computer name or IP address to connect to the published server check box.
    3. Type the fully qualified domain name (FQDN) of the ISA Server computer in the Computer name or IP address box, or type the IP address of the internal network adapter of the ISA Server computer in the Computer name or IP address box.
    4. Click Next.
  10. On the Internal Publishing Details page, do the following:
    1. If you want to publish a particular folder on the Web site, type that folder name in the Path (optional) box. If you leave this box blank, you will publish the whole site.
    2. Click to select the Forward the original host header instead of the actual one specified in the Internal site name field on the previous page check box.
    3. Click Next.
  11. On the Public Name Details page, provide information about what requests will be received by the ISA Server computer and forwarded to the Web server component.
    1. In the Accept requests for list, click either Any domain name or This domain name (type below).

      Note If you click Any domain name, any request that is resolved to the IP address of the external Web listener of the ISA Server computer will be forwarded to the Web site. If you click This domain name (type below) and provide a specific domain name, such as www.fabrikam.com, only requests for http://www.fabrikam.com will be forwarded to the Web server component. This configuration assumes that the domain name resolves to the IP address of the external Web listener of the ISA Server computer.

      Note If you want to publish Web sites under more than one domain name, such as www.fabrikam.com and www.adatum.com, you must click This domain name (type below) and specify the domain name in this step. You must specify the domain name so that separate Web publishing rules for the two domains will route requests to the correct sites.
    2. If you click This domain name (type below), type the domain name in the Public name box. For example, type www.fabrikam.com.
    3. If you specify a folder in the Path box, such as News, the path will be required in the request. For example, if you specify News as the path, you must visit the http://www.fabrikam.com/news address to access the Web site. The required request format is shown in the Site box.
  12. Click Next.
  13. On the Select Web Listener page, click the Web listener that you want to use in the Web listener list. The Web listener will listen for Web page requests that should be redirected to the Web server component on the ISA Server computer. If you have not defined a Web listener, click New, and then follow these steps to create a new listener:
    1. On the Welcome to the New Web Listener Wizard page, type the name of the new listener. For example, type Listener on external network for internal Web publishing, and then click Next.
    2. If you want to receive HTTPS requests, click Require SSL secured connections with clients.

      Note To use SSL, you must have a digital certificate installed on the ISA Server computer. For more information about digital certificates for ISA Server, visit the following Microsoft Web site:

      http://go.microsoft.com/fwlink/?LinkId=20794

    3. If you do not want to receive HTTPS requests, click Do not require SSL secured connections with clients.
    4. Click Next.
    5. On the Web Listener IP Addresses page, click to select the check box that corresponds to the network that will listen for Web requests. Because you want ISA Server to receive requests from the external network, the listener should be one or more IP addresses on the external network adapters of ISA Server. Therefore, click to select the External check box.
    6. Click Next.
    7. On the Authentication Settings page, configure the authentication type that you want to use for the published Web site. For a typical Web site, click No Authentication in the Select how clients will provide credentials to ISA Server list.

      Note For more information about these authentication options, click the authentication settings link. Also, see the "Authentication Concepts in ISA Server 2006" topic in ISA Server 2006 Help and Support.
    8. Click Next.
    9. On the Single Sign On Settings page, click Next.
    10. Click Finish.
  14. Click Next.
  15. On the Authentication Delegation page, click the kind of delegation that you want to use in the Select the method used by ISA Server to authenticate to the published Web server list. For a typical Web publishing scenario, click No delegation, and client cannot authenticate directly.

    Note For more information about the kinds of authentication delegation that are available in ISA Server 2006, click the authentication delegation link.
  16. Click Next.
  17. On the User Sets page, make sure that the default All users user set is displayed. This setting enables any computer in the external network to access the published Web pages.

    Note To restrict access to specific users, click All Users, click Remove, and then click Add to add a specific user set.
  18. Click Next.
  19. On the Completing the New Web Publishing Rule Wizard page, scroll through the rule configuration to make sure that you have configured the rule correctly, and then click Finish.
  20. Click Apply to save the changes and update the configuration, and then click OK.

How to configure a Web publishing rule in ISA Server 2004

  1. Start the ISA Server Management snap-in.
  2. Expand the ISA Server computer node, and then click Firewall Policy.
  3. On the Tasks tab, click Publish a Web Server to start the New Web Publishing Rule Wizard.
  4. Type a name for the rule in the Web publishing rule name box. For example, type Publish internal Web server, and then click Next.
  5. On the Select Rule Action page, make sure that the default Allow action is selected. This setting permits requests to reach your Web server according to the conditions that are set by the rule.
  6. Click Next.
  7. On the Define Website to Publish page, do the following:
    1. Type the computer name or the IP address of your ISA Server 2004 computer in the Computer name or IP address box.
    2. Verify that the Forward the original host header instead of the actual one (specified above) check box is not selected. By default, this check box is not selected.
    3. In the Path box, you can specify the Web site folder that you want to publish. If you leave this box blank, you will publish the whole site.
  8. Click Next.
  9. On the Public Name Details page, provide information about what requests will be received by the ISA Server computer and forwarded to the Web server component.
    1. In the Accepts requests for list, click either Any domain name or This domain name (type below). If you click Any domain name, any request that is resolved to the IP address of the external Web listener of the ISA Server computer will be forwarded to your Web site. If you click This domain name (type below) and provide a specific domain name, such as www.fabrikam.com, only requests for http://www.fabrikam.com will be forwarded to the Web server component. This configuration assumes that the domain name resolves to the IP address of the external Web listener of the ISA Server computer.

      Note If you want to publish Web sites under more than one domain name, such as www.fabrikam.com and www.adatum.com, you must click This domain name (type below) and specify the domain name in this step. You must specify the domain name so that separate Web publishing rules for the two domains will route requests to the correct sites.
    2. If you click This domain name (type below), type the domain name in the Public name box. For example, type www.fabrikam.com.
    3. If you specify a folder in the Path box, such as News, the path will be required in the request. For example, if you specify News as the path, you must visit the http://www.fabrikam.com/news address to access the Web site. The required request format is shown in the Site box.
  10. Click Next.
  11. On the Select Web Listener page, click the Web listener that you want to use in the Web listener list. The Web listener will listen for Web page requests that should be redirected to the Web server component on your ISA Server 2004 computer. If you have not defined a Web listener, click New, and then follow these steps to create a new listener:
    1. On the Welcome to the New Web Listener Wizard page, type the name of the new listener. For example, type Listener on external network for internal Web publishing, and then click Next.
    2. On the IP Addresses page, click to select the check box that corresponds to the network that will listen for Web requests. Because you want ISA Server to receive requests from the external network, the listener should be one or more IP addresses on the external network adapters of ISA Server. Therefore, click to select the External check box, and then click Next.
    3. On the Port Specification page, make sure that the HTTP port is set to 80. Port 80 is the default setting.
    4. If you want to receive HTTPS requests, click to select the Enable SSL check box, make sure that the Secure Sockets Layer (SSL) port is set to 443, and then provide the certificate name in the Certificate box. To use SSL, you must have a digital certificate installed on the ISA Server computer. For more information about digital certificates for ISA Server 2004, visit the following Microsoft Web site:

      http://go.microsoft.com/fwlink/?LinkId=20794

    5. Click Next, and then click Finish.
  12. Click Next.
  13. On the User Sets page, make sure the default All users user set is displayed. This setting permits any computer in the external network to access the published Web pages.

    Note To restrict access to specific users, click All Users, click Remove, and then click Add to add a specific user set.
  14. Click Next.
  15. On the Completing the New Web Publishing Rule Wizard page, scroll through the rule configuration to make sure that you have configured the rule correctly, and then click Finish.
  16. Click Apply to save the changes and update the configuration.

REFERENCES

For more information about how to publish a Web server by using ISA Server 2004, visit the following Microsoft Web site:

http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/publishingwebservers.mspx

Modification Type:MinorLast Reviewed:9/20/2006
Keywords:kbISA2006Swept kbFirewall kbhowto KB885186 kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.