tmg2010ebook

7/29/2019 TMG2010Ebook

1/68

iu khin truy cp Internet: Gii thiu v

TMG Access Rule Phn 1Su tm t nhiu ngun trn Internet.

ng gi:Ghost0bkBlog: www.CD4pro.infoCall:09.34.36.38.33

Trong lot bi ny chng ti s gii thiu cho cc bn v mt s vn c bn ca AccessRules i vi vic qun tr TMG firewall mi.

Tng la ISA c lch s pht trin kh lu, cc phin bn dn c nng cp ln nn theothi gian v tin trnhpht trin.

Nm 2010, phin bn k tip ca tng la ISA khng ch c cc tnh nng v chc nng ming ch , n cn mang mt ci tn mi tn ISA c thay bng TMG - ThreatManagement Gateway 2010. y l mt thay i ln v mt quan im v l mt tn hiu ttv tnh hiu qu trong tin trnh pht trin bo mt ca Microsoft, Microsoft hon ton thayi cch to phn mm v tp trung vo vn bo mt trong mi giai on pht trin.

Thch thc i vi cc thit lp tng la TMG mi l hc nhng vn c bn. Chng ta tri qua hng thp k lm vic vi ISA v hu ht trong mi qun tr vin u hiu rt su vcc chi tit k thut cng nh cc kch bn trin khai phc tp ca n. Tuy nhin c rt nhiungi gp phi vn khi truy cp cng nh cch lm vic ca tng la TMG. Rt nhiuqun tr vin TMG mi tp trung vo tm hiu cch iu khin truy cp gi vo (cho v d, iu khin s truy cp n Exchange v SharePoint). V lc ny h mun bit cch iukhin truy cp cc kt ni gi ra. l l do m chng ti gii thiu cho cc bn bi vit ny,

bi vit s tp trung vo cc nhng vn c bn ca Access Rules.

Tm hiu v Access Rules

Access Rule c s dng iu khin truy cp gi ra t mt mng c bo v bi tngla TMG. Khi bn mun cho php mt my tnh nm pha sau s kim sot ca tng laTMG truy cp mt mng khc (gm c Internet), bn cn to mt Access Rule (lut truy cp) cho php kt ni . Mc nh, khng c Access Rule no cho php cc kt ni qua tngla, v vy mc nh tng la TMG l mt bc tng gch vng chc bo v cho mng.Trng thi ng ca mc nh ny l mt cu hnh an ton, tuy nhin n cng c ngha nu bn
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

2/68

mun cho php lu lng qua tng la TMG, bn cn phi hiu cch Access Rule lm vicv cch to chng nh th no.

To mt Access Rule gi ra

bt u, chng ta s to mt Access Rule gi ra n gin cho php tt c ngi dng c th

truy cp Internet bng tt c giao thc. Trong phn tip theo ca lot bi ny, chng ta s i tmhiu cc vn chi tit ca Access Rules v xem cc Access Rules c cc vn ph thuc gv cch bn c th iu chnh cc vn ph thuc .

Chng ta hy bt ubng cch m giao din iu khin tng la TMG v kch nt FirewallPolicy trong phn panel tri ca giao din, nh nhng g th hin trong hnh bn di.

Hnh 1

Sau khi kch nt Firewall Policy trong panel tri, chng ta s kch tab Tasks trong panel phica giao din. y bn s thy mt s ty chn, a s trong chng c lin quan n vic tocc rule tng la. Trong v d ny, chng ta s to mt rule truy cp cho php truy cp gira qua tng la. Kch lin kt Create Access Rule khi chy Access Rule wizard, nhhin th trong hnh bn di.
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

3/68

Hnh 2

Trong trang Welcome to the New Access Rule Wizard, t tn trong hp vn bn AccessRule name. Ni chung, bn nn t mt tn c ngha cho Access Rule ca mnh c thqut chnh sch tng la v bit rule lm g, c bit l bit mc ch c mc ch ca rule.Trong v d ny, chng ti s t tn rule l All Open 1. Trong mi trng sn xut, bn skhng mun to mt rule nh vy v rule ny s cho php tt c cc my tnh c th truy cpInternet v chc chn khng phi nhng g bn mun c trong mi trng sn xut.
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

4/68

Hnh 3

Trong trang Rule Action, bn s c cc la chn Allow hoc Deny i vi rule. Lu rng

ty chn mc nh l Deny, y l mt ty chn tt v gc bo mt. Chng ta s thay itrng thi Deny thnh Allow trc khi kch Next bin n tr thnh rule Allow.

7/29/2019 TMG2010Ebook

5/68

www.CD4pro.info T ho l ni Bn Key Windows Server

2003,2003r2,2008,2008R2,Windows Small Business Server,ExchangeServer,SQL,Kaspersky Small Office (dnh cho server),KIS,BIS...bn quyn! vbo hnh vnh vin

Hnh 4

Trong trang Protocols, chn cc giao thc m bn mun p vi rule ny. Trong hp s xung

This rule applies to, bn c cc la chn sau:

All outbound traffic S dng ty chn nu bn mun p rule ny cho tt c cc giaothc.

Selected protocols S dng ty chn ny chn mt s giao thc no m bnmun p cho rule ny. y l ty chn chc chn hu ht trong s cc bn s cn n.

All outbound traffic except selected Ty chn ny cho php bn cho php hoc tchi tt c cc giao thc ngoi tr mt s giao thc no m bn chn ra.
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

6/68



Hnh 5

Nu chn ty chn th hai hoc th ba, bn c th kch nt Add chn cc giao thc m bn

mun p rule ny cho chng. Sau khi kch nt Add, bn s thy hp thoi Add Protocols xuthin. Khi kch vo mt th mc no nm trong hp thoi ny, th mc s c m v hinth cho bn mt danh sch cc giao thc. Nhm pht trin tng la TMG to s d dngtrong s dng bng cch tch bit cc giao thc theo cc nhm bn d dng hn trong victm cc giao thc m mnh quan tm. Kch p vo cc giao thc m bn mun cho php,chng s xut hin trn trang Protocols trong danh sch Protocols.
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

7/68

Hnh 6

Mt ty chn khch bn c trong trang ny s c l din khi bn kch nt Source Ports.Thao tc ca bn s lm xut hin hp thoi Source Ports. y bn c th iu khin cccng ngun c php cho cc kt ni tng xng vi rule ny. Mc nh Allow traffic fromany allowed source port c chn, tuy nhin nu bn mun kha cc cng ngun, bn c thchn Limit access to traffic from this range of source ports v sau nhp cc gi tr votrong cc trng From v To ch r cc cng ngun ny.

7/29/2019 TMG2010Ebook

8/68

Hnh 7

Chng ta s khng chn bt c cng ngun no lc ny m s chn ty chn All outboundtraffic v sau kch Next.

Trang tip theo l Access Rule Sources. y bn s chn v tr ca cc my tnh nm phasau tng la TMG m bn mun p vi rule ny. Kch nt Add khi bn s thy hp thoiAdd Network Entities. Kch th mc c cha thnh phn mng hin din v tr ngun ca ccmy tnh m bn mun p vi rule ny. Trong v d ny, chng ta s cu hnh rule ny p vi

tt c cc my tnh nm trn mng bn trong mc nh bng cch kch th mc Networks vsau kch p vo mng Internal.
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

9/68

Hnh 8

Sau khi chn Network ngun l Internal Network v kch Next, bn s thy trang k tip, yl trang Access Rule Destinations. y bn thit lp cc ch n m bn mun cc mytnh t ngun chn trc c th truy cp qua rule ny. Trang Access Rule Destinations lmvic ging nh trang trc, ni bn kch nt Add v sau trong hp thoi Add NetworkEntities, kch th mc, tip na l kch p vo thnh phn mng mun cho php truy cp
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

10/68

bng rule ny. Trong v d ny, chng ta s chn mng External mc nh.

Hnh 9

Trang tip theo ca wizard l User Sets. Trong trang ny, bn ch nh ngi dng m mnhmun p vi rule ny. Mc nh, Access Rules c p cho tt c ngi dng. Cn lc ny,

7/29/2019 TMG2010Ebook

11/68

www.CD4pro.info T ho l ni Bn Key Windows Server2003,2003r2,2008,2008R2,Windows Small Business Server,Exchange

Server,SQL,Kaspersky Small Office (dnh cho server),KIS,BIS...bn quyn! vbo hnh vnh vin



nh ngha all users ca bn c th khng ging nh nh ngha all users ca tng laTMG. All users khng c ngha rule ca bn s p vi tt c cc ti khon trong t chc ca

bn m All users t phi cnh ca tng la TMG c ngha tt c ngi dng nc danh cckt ni khng c nhn thc. Nu kch nt Add, bn c th chn ngi dng khc, chng hnnh All Authenticated Users hoc System and Network Service. Cng c th to cc tpngi dng ty bin da trn Active Directory v cc ti khon RADIUS. Tuy nhin chng tas cp thm v cc ty chn ny trong phn tip theo. Trong v d ny, chng ta s chn tychn All Users v kch Next chuyn sang trang khc.

7/29/2019 TMG2010Ebook

12/68





Hnh 10

Trang cui cng ca wizard l Completing the New Access Rule Wizard. y l trang cho

php bn xem li cc thit lp ca mnh v sau kch Finish.

7/29/2019 TMG2010Ebook

13/68





Hnh 11

Sau khi rule c to, n s vn cha c hiu lc cho ti khi bn kch nt Apply pha trnca panel gia trong TMG firewall console. Chng ta s kch nt Apply ny ngay by gi.

Hnh 12

Cc ty chn khcSau khi kch nt Apply, hp thoi Configuration Change Description s xut hin. y

bn c th thm vo phn m t cho nhng thay i m bn thc hin i vi chnh schtng la v phn m t ny s xut hin trong bn ghi v s thay i. Bn ghi v s thay irt hu dng khi bn cn kim tra li v tm ra nhng g bn hoc ai thc hin i vichnh sch tng la trong trng hp gp vn g khng nh mong i.
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

14/68

7/29/2019 TMG2010Ebook

15/68





Hnh 14

Rule mi ny xut hin trong danh sch chnh sch ca tng la, nh nhng g bn c ththy trong hnh bn di. V tr trn danh sch ph thuc vo nibn kch khi bt uwizard. Mc d vy, nh nhng g chng ti s gii thiu cho cc bn trong phn tip theo, bnc th y rule ny ln trn hoc xung di trong danh sch.

7/29/2019 TMG2010Ebook

16/68





Hnh 15

Kt lun

Trong bi ny, chng ti gii thiu cho cc bn mt s vn c bn v Access Rules catng la TMG. Nh nhng g cc bn thy, Access Rules c s dng iu khin lulng gi ra t mng c bo v TMG n cc mng khc. Mc nh, khng c Access Rulesv khng c lu lng no c th qua tng la TMG. Mt Access Rule cn phi c thitlp cho php lu lng gi ra. Access Rules cho php bn c th iu khin lu lng, datrn mt s cc h s, chng hn nh v tr ngun, v tr ch, ngi dng, cc giao thc sc s dng. Ngoi ra cn c nhiu ty chn khc cha c l din trong Access Rule

wizard, v chng ti s gii thiu cho cc bn cc ty chn ny trong phn tip theo.

iu khin truy cp Internet: Gii thiu vTMG Access Rule Phn 2Trong phn 1 ca lot bi gm c hai phn v Access Rules ny, chng ti gii thiu chocc bn v mc ch v qu trnh to Access Rule cng nh cch s dng Access Rule wizardcho vic to mt rule no . Trong phn ny, chng ti s gii thiu cho cc bn chi tit vAccess Rules sau khi cng nhau i to bng wizard trong phn 1. Chng ti mun thc hiniu ny l v c mt s thit lp khng l din trong Access Rule wizard.

Nu kch p vo mt rule truy cp no sau khi to n, bn s thy hp thoi Propertiescho rule xut hin. Tab u tin m bn s thy l tab General. y bn c th t li tn carule v cung cp phn m t cho n. Chng ti thy phn m t l rt hu dng, v bn c thminh chng bng ti liu mc ch ca rule, ai to rule, rule c to khi no v l do nc to, chng hn nh ai yu cu to rule hoc vn doanh nghip no m n cngii quyt.

7/29/2019 TMG2010Ebook

17/68





Lu rng th t nh gi Evaluation order nm trong tab ny. Mc d vy, bn cn bit yl th t nh gi cho danh sch cc rule tng la nm bn ngoi cc rule System Policy. Cc

rule System Policy lun c nh gi trc cc rule chnh sch. Bn cng c th kch hothoc v hiu ha rule bng cch s dng hp kim Enable.

Hnh 1

Trn tab Action, bn c mt s ty chn:

Allow Khi chn ty chn ny, rule s tr thnh rule cho php v khi c gng kt nikhp vi cc thit lp trong rule ny, kt ni s c cho php. Deny Khi chn ty chn ny, rule tr thnh rule t chi v c gng kt ni khp vi

cc thit lp trong rule ny, kt ni s b t chi. Display denial notification to user Nu rule l HTTP rule v chn ty chn ny th

bn c th nhp vo mt on vn bn, on vn bn ny s c tr v vi ngi dngkhi kt ni b t chi. Thng tin ny s c hin th trong ca s ca trnh duyt. Bngcch s dng ty chn ny, bn c th cho php ngi dng bit ti sao kt ni b tchi.

7/29/2019 TMG2010Ebook

18/68





Add denied request category to notification Ty chn ny ch c sn khi URLfiltering c kch hot nu kch hot URL filtering trn tng la TMG ca mnh, ban

s c ty chn cho php ngi dng bit, khi yu cu b t chi, site m ngi dngc gng truy cp nm trong hng mc no. Ni chung, ngi dng khng thc s quantm n cc thng tin ny, tuy nhin nu bn c cc rule p cho cc qun tr vin vmt s ngi dng c bit, rt c th h s quan tm n cc thng tin ny to ccyu cu nhm phn loi li cc site.

Redirect web client to the following URL Nu khng mun cung cp cho ngidng mt trang hin th ti sao kt ni b t chi, bn c ty chn chuyn hng(redirect) ngi dng n mt website no . y c th l website gm c cc hngmc tha thun dch v m bn t ra vi ngi dng hoc mt site gio dc cung cpcho h cc thng tin v vic s dng thch hp kt ni Internet cng ty.

Log requests matching this rule Ty chn ny c kch hot mc nh v cho phpcc kt ni khp vi rule ny s c ghi vo trong bn ghi ca tng la TMG. Mcd vy, s c ln bn khng mun ghi cc thng tin chng hn nh lu lng khngthch hp. iu ny s lm gim c kch thc tng th ca file bn ghi v to chocc bn ghi ca bn trong sng hn, d dng c v phn tch c php hn.
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

19/68





Hnh 2

Trong trang Protocols, bn c mt s ty chn tng t nh cc ty chn c trong AccessRule wizard. Hp chn This rule applies to cng cung cp cc ty chn tng t v bn cth s dng cc nt Add, Edit v Remove chnh sa, thm, bt cc giao thc s p vi ruleny. Bn cng c ty chn Ports c sn. Nt Filtering, khi c kch hot, s cho php bncu hnh HTTP Policy cho rule (nu n l mt HTTP rule). Tnh nng ny c nhm vo cc

phin bn trc ca tng la ISA, c bit n nhiu hn vi cc tn HTTP SecurityFilter. Cng c th c cc b lc khc ph thuc vo giao thc bn s dng nu b lc c

th p vi cc giao thc gi ra. Hu ht cc b lc giao thc m chng ta c vi TMG uc thit k bo v kt ni gi vo, tuy nhin c mt s p cho cc giao thc gi ra.
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

20/68





Hnh 3

Trong tab From, bn c th nh ngha cc ngun m rule s p cho chng. C nhiu mykhch nm trn mngbo v TMG. Ty chn ny tng t nh nhng g bn thy trongAccess Rule wizard. Khi kch Add, bn s thy xut hin hp thoi Add Network Entities vc th chn t mt s entry mng hoc to cc entry mi. Mt ty chn c sn trong tab nynhng khng l din trong Access Rule wizard l phn Exceptions. y bn c th thit lpcc ngun m mnh mun rule p vi n, tuy nhin li c mt tp con bn trong nhm lngoi l, bn c th t cc trng hp ngoi l vo phn Exceptions. y l mt ty chn

ht sc mnh v i khi cn phi lu trong thit k Access Rules ca bn.

7/29/2019 TMG2010Ebook

21/68





Hnh 4

Tab To cng tng t vi tab From, ni bn nh ngha ch m mnh mun rule khp vi.Khi kch Add,bn s thy hp thoi Add Network Entities, c th chn ch t danh schhoc c th to mt ch mi. Nh bn trong tab From, bn cng c ty chn cho vic to ccngoi l Exceptions.
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

22/68





Hnh 5

Trong tab Users, bn c th nh ngha rule s p cho ngi dng no. Mc nh, All Users ltp ngi dng c s dng cho Access Rules. Cn lu All Users y khng thc s cngha l tt c ngi dng m ch l cc kt ni nc danh v cc kt ni c nhn thc vvy n c ngha phm vi ngi dng khng c xem xt. Nu bn mun bt ngi dng

phi nhn thc, bn cn phi s dng mt tp ngi dng khc v remove tp ngi dng AllUsers.

7/29/2019 TMG2010Ebook

23/68





Nu kch Add, bn c th chn All Authenticated Users v ch c ngi dng c th nhnthc vi tng la TMG mi c php truy cp qua rule ny. S nhn thc c th c thc

hin qua cu hnh web proxy my khch hoc cu hnh Firewall my khch (TMG my khch).Nu mun to mt tp ngi dng ca ring mnh, bn hy kch nt New.

7/29/2019 TMG2010Ebook

24/68





Hnh 6

Khi kch New, chng trnh s khi chy Welcome to the New User Set wizard. Trn trangu tin ca wizard, nhp vo tn cho tp ngi dng. Trong v d ny, chng ta s to mt tpngi dng gm c nhm Domain Admins Active Directory, v vy hy t tn cho rule ny lAdministrators v kch Next

7/29/2019 TMG2010Ebook

25/68





.

Hnh 7

Trong trang Users, khi kch Add, mt menu s xut hin. Menu ny gm c cc ngun nhnthc sau:

Windows users and groups C nhiu ngi dng v nhm ngi dng bn trongmin Active Directory hoc mt min ch thc m tng la TMG thuc v n.

LDAP C nhiu ngi dng v nhm ngi dng bn trong Active Directory v bnc th s dng khi tng la TMG khng phi l mt thnh vin ca min. Cn lu rng TMG khng h tr nhn thc LDAP cho Access Rules.

RADIUS C ngi dng c th truy cp qua RADIUS. Lu rng bn thn RADIUSkhng h tr Group Membership, mc d vy bn c th to mt tp ngi dng ccha nhiu ti khon c th truy cp thng qua RADIUS, mt th kh hiu qu trongcc nhm c bit trn tng la TMG. RADIUS c h tr cho cc kt ni web gira qua tng la TMG.

7/29/2019 TMG2010Ebook

26/68





SecurID C nhiu ngi dng c nh ngha bi SecurID. Tuy nhin SecurIDkhng c h tr cho cc kt ni gi ra qua tng la TMG thng qua Access Rules.

Trong v d ny, tng la TMG gia nhp vo min Active Directory, v vy chng ta schn Windows users and groups.

Hnh 8

Bn s thy xut hin hp thoi Select Users or Groups. Chng ta nhp Domain Admins votrong hp vn bn Enter the object names to select v kch Check Names sau kch OKthm nhm Active Directory ny vo tp ngi dng.

7/29/2019 TMG2010Ebook

27/68





Hnh 9

Bn s thy tp ngi dng mi trn trang Users. C th thm nhiu ngi dng na vo tpngi dng ny nu thch. Trong v d ny, chng ta s kch Next v khng thm bt c ai votp ngi dng ny.
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

28/68





Hnh 10

Trong trang Completing the New User Set Wizard, kch Finish to tp ngi dng mi.

7/29/2019 TMG2010Ebook

29/68





Hnh 11

Ch : www.CD4pro.info hin cung cp key bn quyn Standar v Enterprise cho Forefront

Threat Management Gateway

Cc bn cn xin lin h theo a ch trn www.CD4pro.info hoc Yahoo= ghost0bk.Call:09.34.36.38.33

Lc ny, bn c th to nhm Administrators trong hp thoi Add Users v c th s dngnhm ny trong Access Rules v vic publish cc rule.

7/29/2019 TMG2010Ebook

30/68





Hnh 12

Trn tab Schedule, bn c th thit lp mt lch trnh cho rule t thi gian rule s c pdng. Lu rng khi bn nh ngha mt lch trnh, lch trnh s ch c p dng cho cc ktni mi phng trng hp ngi dng kt ni trc khi lch trnh ht hn, khi kt nica ngi dng s khng b t. Mc d vy, nu mt c gng kt ni mi hp vi rule nm

bn ngoi lch trnh, kt ni s b t chi. Lch trnh mc nh lun l Always, tuy nhin chai lch trnh i km khc: Weekends v Work hours. Nu khng thch cc lch trnh i kmny, bn c th kch nt New v to mt lch tnh ty bin.

Ch : www.CD4pro.info hin cung cp key bn quyn Standar v Enterprise cho ForefrontThreat Management Gateway


7/29/2019 TMG2010Ebook

31/68





Hnh 13

Tab Malware Inspection l mt tab ch c sn trn tng la TMG. C mt vi ty chn trntab ny khng c l din trong Access Rule wizard:

Inspect content downloaded from web servers to clients Khi bn kch hot tychn ny, tt c cc ni dung c download t cc my ch web s c thanh tramalware bng Microsoft AV engine c s dng bi tng la TMG.

Force full content requests (remove HTTP Range header) Buc tng la phiyu cu ni dung hon chnh n c th c nh gi mt cch ton b. Nu chnh gi mt di no , cc mi nguy him tim tng c th b b st.

Use rule specific settings for malware inspection Bn c th ty bin cc thit lpchng malware cho rule khi chn ty chn ny. Nu chn ty chn ny, bn cn kchnt Rule Settings hon tt cu hnh ty bin ca mnh.

7/29/2019 TMG2010Ebook

32/68







Hnh 14

Trong trang Edit Rule Malware Inspection Settings, bn c mt s ty chn. Hnh di thhin cc thit lp mc nh:

Attempt to clean the infected files Khi thit lp ny c kch hot, tng la TMGs c gng lm sch file trc khi chuyn tip n n ngi dng. Nu file khng thlm sch, n s xa file.

7/29/2019 TMG2010Ebook

33/68





Block files with low and medium severity threats (higher level threats are blockedautomatically) Tng la TMG mc nh s khng kha cc file mc nguy him

thng thng v thp, bng h thng phn loi ca Microsoft AM engine. Block suspicious files Tng la TMG s dng phng php suy nghim xc

nh xem mt file no c phi l malware hay khng. Khi ty chn ny c chn,file s b kha nu phng php suy nghim xc nh file c th l malware.

Block corrupted files Khi ty chn ny c kch hot, cc file c xc nh l lis b kha.

Block files that cannot be scanned Khi ty chn ny c kch hot, nu MicrosoftAV engine khng th qut file, file s b kha.

Block encrypted files Nu file c m ha, Microsoft AV engine s khng th nhgi file v v vy, khi ty chn ny c kch hot, n s kha file.

Block files if scanning time exceeds (seconds) Khi ty chn ny c kch hot, ns hn ch thi gian Microsoft AV engine c th nh gi mt file trc khi quyt nhchuyn tip hoc kha n. Gi tr mc nh l 5 pht.

Block files if archive level depth exceeds - Khi ty chn ny c kch hot, AVengine s kha cc file vt qu thit lp v su lu tr y. Gi tr mc nh l 20mc.

Block files larger than (MB) - Khi ty chn ny c kch hot, n s kha cc fileln hn gi tr c lit trong hp vn bn, vi gi tr mc nh l 1000MB (1GB). Tychn ny c th c s dng ci thin hiu sut trn tng la TMG, tuy nhin bncn phi cn thn nu khng s kha cc file m ngi dng cn v kh nhiu ngidng thng lm vic vi cc file c dung lng ln.

Block archive files if unpacked content is large than (MB) Ty chn ny thit lpkch thc ln nht ca mt file c gii nn. Gi tr ny c s dng d tr bnh trong tng la TMG.

7/29/2019 TMG2010Ebook

34/68





Hnh 15

Kt lun

Trong bi ny, chng ti gii thiu cho cc bn cc chi tit v Access Rules. Hu ht trongs cc ty chn m bn mun cu hnh u l din trong Access Rule Wizard, tuy nhin vnc mt s ty chn quan trng khc ch c th truy cp sau khi bn to rule, bng cch truycp vo hp thoi Properties ca rule. Chng ti hy vng lot bi gm c hai phn ny s gipch c cho cc bn, nht l nhng ngi mi lm quen vi tng la TMG v cc thng tinny s gip cc bn to cc chnh sch truy cp gi ra ph hp vi t chc mnh.

iu khin truy cp Internet: Gii thiu vTMG Access Rule Phn 3Web publishing l mt thut ng m chng ta s dng trong vic reverse proxy cc website ngi dng bn ngoi c th truy cp vo cc website nm bn trong tng la TMG. Lu rng c hai cch bn c th cho php ngi dng bn ngoi c th s dng cc website: web

publishing v server publishing. Web publishing cho php tng la TMG hnh ng nh mt

7/29/2019 TMG2010Ebook

35/68





reverse proxy, trong khi server publishing li cung cp cc my ch web thng qua reverseNAT. Trong hai phng php ny th Web publishing l phng php c a thch hn, vi

phng php ny bn c th s dng u im ca phng php tin nhn thc v nhiu tnhnng khc khng c sn qua reverse NAT.

gii thiu cho cc bn qu trnh web publishing, chng ta hy bt u bng cch publishmt HTTP site n gin nm pha sau tng la TMG. Site c bn ny khng yu cu SSL vcng khng yu cu nhn thc. V sau, chng ta s i xem xt mt s v d phc tp hn,trong bn c th s dng SSL v nhn thc.

bt u, hy kch nt Firewall Policy trong panel bn tri ca giao din iu khin TMGfirewall, nh th hin trong hnh 1 bn di.

Hnh 1

Trong panel bn phi ca giao din, kch Tasks Tab. Sau trn Tasks Tab, kch lin ktPublish Web Sites c th hin nh trong hnh 2 bn di.

7/29/2019 TMG2010Ebook

36/68





Hnh 2

Thao tc ny s lm xut hin trang Welcome to the New Web Publishing Rule Wizard.Trn trang ny, hin th trong hnh 3, bn cn t tn cho rule. Trong hp vn bn Webpublishing rule name, ly v d, chng ta nhp vo tnHTTP Web Serverv sau kchNext.
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

37/68





Hnh 3

Trong trang Select Rule Action, nh th hin trong hnh 4, bn c th cu hnh rule l Allowhoc Denycho kt ni. Trong v d ny, chng ta s chn Allow. Ty chn Deny c sdng cho cc trng hp s dng c bit; bn cng c th to cc rule web publishing cho

php cc kt ni n mt website no nm pha sau tng la TMG.



7/29/2019 TMG2010Ebook

38/68





Hnh 4

Trong trang Publishing Type, nh th hin trong hnh 5, bn chn mt trong s ba kch bntng ng vi mi trng my ch web ca mnh. Trong v d ny, do mun publish mt webserver nm pha sau tng la TMG, v vy chng ta chn ty chn Publishing a single Website or load balancer v kch Next.



7/29/2019 TMG2010Ebook

39/68





Hnh 5

Trong trang Server Connection Security, th hin trong hnh 6, bn phi chn xem tng laTMG c cn s dng SSL kt ni vi my ch web hay khng. Trong kch bn ny, chngta khng yu cu SSL gia tng la TMG v my ch web, v vy hy chn ty chn Usenon-secured connections to connect the published Web server or server farm.

Cn nh rng kt ni an ton nht, bn nn s dng SSL.


7/29/2019 TMG2010Ebook

40/68






Hnh 6

Trong trang Internal Publishing Details, hin th trong hnh 7, bn s c yu cu nh

ngha tn my ch trong mng ni b. Trong v d ny, chng ta nhp vo Fully QualifiedDomain Name (FQDN) ca my ch trong mng ni b ang hosting website, ldc1.msfirewall.org. Bn cng c ty chn kch hot hp kim Use a computer name or IPaddress to connect to the published server, sau nhp vo tn hoc a ch IP khc camy ch. Ty chn ny cho php tng la TMG tm my ch nu n ang s dng mt tnkhc khng ging tn bn nhp trong hpInternal site name. Sau khi nhp vo cc thng tinny, kch Next.

7/29/2019 TMG2010Ebook

41/68







Hnh 7

Trong trang Internal Publishing Details, hin th trong hnh 8, bn c th nhp vo ng dn hn ch ngi dng truy cp vo mt file hoc th mc no trn my ch web. Trong vd ny, do mun cho php truy cp ton b site nn chng ta khng nhp ng dn no y.Sau khi thc hin xong cc la chn y, kch Next.

7/29/2019 TMG2010Ebook

42/68







Hnh 8

Trn trang Public Name Details, hnh 9, nhp vo tn ca website m ngi dng s truy cp.y l tn m ngi dng s dng truy cp site. thc hin iu ny, chn ty chn Thisdomain name (type below) t danh sch s xungAccept requests for. Sau khi chn ty chn, nhp vo tn m ngi dng s truy cp site trong hp vn bn Public name. Trong v dny, ngi dng s s dng tn www.msfirewall.org truy cp site, v vy chng ta s nhptn vo hp vn bn. Tip na, chng ta s c ty chn nhp vo ng dn, tuy nhinchng ta khng thc hin cng vic m hy kch Next.

7/29/2019 TMG2010Ebook

43/68







Hnh 9

Trong trang Select Web Listener, hnh 10, chn b lng nghe web listener s c s dng chp nhn cc kt ni t ngi dng bn ngoi truy cp vo website. Trong v d ca chngti, cha c b lng nghe no c thit lp, v vy khng c la chn no trong hp chn sxung. to mt b lng nghe HTTP web listener mi, kch nt New.

7/29/2019 TMG2010Ebook

44/68





Hnh 10

Thao tc ny s lm xut hin trang Welcome to the New Web Listener Wizard, hnh 11. ychng ta nhp tn cho b lng nghe web listener trong hp vn bn Web listener name (chngta s s dng tn HTTP Listener) v sau kch Next.

7/29/2019 TMG2010Ebook

45/68





Hnh 11

Trong trang Client Connection Security, hnh 2, bn phi ch nh mun hay khng mun sdng SSL kt ni vi tng la TMG. Trong v d ny, chng ta mun publish mt siteHTTP n gin, do hy chn Do not require SSL secured connection with clients v kchNext.

7/29/2019 TMG2010Ebook

46/68





Hnh 12

Trong trang Web Listener IP Addresses, hnh 13, chn mng m bn mun tng la TMGchp nhn cc kt ni n website. Trong hu ht cc trng hp, khi publish mt website chongi dng bn ngoi, bn nn chn mng External mc nh chp nhn cc kt ni gin. Nu bn c nhiu a ch IP c rng buc vi giao din ngoi, bn c th kch Select IPAddresses v sau chn a ch IP c th m bn mun chp nhn cc kt ni; trong hu htcc trng hp, bn nn thc hin iu ny thay v chp nhn cc kt ni trn tt c a ch IPc th c cu hnh trn giao din ngoi ca tng la TMG. Trong v d ny, chng ta ch

c mt a ch IP trn giao din ngoi, tuy nhin chng ta s chn mt a ch IP c th trong trng hp cn add thm nhiu a ch IP vo giao din ngoi trong tng lai.

7/29/2019 TMG2010Ebook

47/68





Hnh 13

Trong trang Authentication Settings, hnh 4, chn kiu thng tin s c s dng kt niti tng la TMG nhm truy cp site. Kiu nhn thc ny thng c gi l tin nhn thcv ngi dng nhn thc vi tng la TMG trc khi nhn thc vi my ch web. Trong vd ny, chng ta khng yu cu nhn thc v vy hy chn ty chn No Authentication vkch Next.

7/29/2019 TMG2010Ebook

48/68





Hnh 14

Trong trang Single Sign On Settings, hnh 15, bn c th cu hnhb lng nghe web listener h tr c ch ng nhp mt ln (single sign-on) cho tt c cc site c publish qua b lngnghe ny. Mc d vy, c ch ng nhp mt ln lm vic, ngi dng phi ng nhp. Dochng ta khng yu cu nhn thc trong v d ny do c ch ng nhp l khng cn thit,vy hy chuyn sang phn tip theo bng cch kch Next.

7/29/2019 TMG2010Ebook

49/68





Hnh 15

Sau khi kch Next bn s thy xut hin trong cui cng ca web listener wizard, hnh 16. y chng ta s xem xt li cc thit lp trn trang Completing the New Web Listener Wizardv kch Finish.

7/29/2019 TMG2010Ebook

50/68





Hnh 16

Gi y chng ta hy quay tr v wizard gc. web listener mi lc ny s xut hin trong trangSelect Web Listenernh c th hin trong hnh 17, y bn c th thy mt s thng tinchi tit v Web Listener. C mt s ty chn b sung bn c th cu hnh trn web listener.

Ngoi ra bn c th truy cp chng bng cch kch nt Edit. Chng ti s gii thiu v vn ny trong phn sau. Cn gi y, chng ta hy tip tc bng cch kch Next.

7/29/2019 TMG2010Ebook

51/68





Hnh 17

Trong trang Authentication Delegation, hnh 18, bn cu hnh cch TMG firewall y nhimchng ch cho website c publish. iu ny c ngha ngi dng s ch cn nhn thcmt ln vi tng la TMG. Trong v d ny, chng ta khng yu cu nhn thc, do khngc l do g y nhim cc tiu chun, chng ta s chn ty chn No delegation, and clientcannot authenticate directly v kch Next.

7/29/2019 TMG2010Ebook

52/68





Hnh 18

Trong trang User Sets, hnh 19, chn ngi dng hoc nhm ngi dng c php truy cpvo website c publish. kch hot ty chn ny, bn phi yu cu ngi dng nhnthc h s c nhn dng. Do khng yu cu nhn thc trong v d ny nn chng ta s sdng nhm mc nh, l All Users. Trong ng cnh ca TMG firewall, all users khng cngha l tt c ngi dng c nhn thc; n c ngha l ngi dng nc danh v vy khicho php truy cp all users, bn ang cho php ngi dng khng nhn thc c th truy cp

site.

7/29/2019 TMG2010Ebook

53/68





Hnh 19

Chng ta s nh gi li cc thit lp trong trang Completing the New Web Publishing RuleWizardnh c hin th trong hnh 20, sau kch nt Test Rule.

7/29/2019 TMG2010Ebook

54/68





Hnh 20

Nt Test Rule cho php bn thy liu website c th truy cp t TMG firewall hay khng. Nhnhng g bn c th thy trong hnh 21 bn di, khi kch nt Test Rule, TMG s c gng ktni vi my ch web bng kt ni HTTP v n thc hin hnh ng ping ng dn(PathPing) n my ch web. Nh nhng g trong hnh, tng la TMG c th kt ni nmy ch web v PathPing din ra thnh cng.

7/29/2019 TMG2010Ebook

55/68





Hnh 21Lc ny bn c th thy rule mi trong danh sch cc rule tng la. kch hot rule, bn

phi kch nt Apply, nh th hin trong hnh 22 bn di.

7/29/2019 TMG2010Ebook

56/68





Hnh 22

Hp thoi Configuration Change Description, nh th hin trong hnh 23, bn c th nhp vobnh lun v thay i m mnh thc hin trong chnh sch tng la. Tng la TMG s lucc thng tin ny bn c th s dng n nh mt phn ca h thng qun l thay i, mcch h tr cho vic khc phc s c sau ny. S dng hp thoi ny, bn cng c th exportcu hnh tng la c th khi phc cu hnh v im trc khi thc hin thay i. KchApply lu cc thay i.

Hnh 23

Cu hnh lc ny s c lu v bn c th thy cc kt qu trong hp thoi SavingConfiguration Changes, hnh 24. Lu rng cc kt ni khch ang tn ti s c nh gili theo chnh sch mi. y l im mi i vi tng la TMG vi tng la ISA, chnhsch tng la ch c p vi cc kt ni mi.

7/29/2019 TMG2010Ebook

57/68





Hnh 24

Kt lun

Trong phn ny, chng ti gii thiu cho cc bn mt s c bn ca vic web publishing viTMG. Trong phn, chng ta to mt web publishing rule, mtb lng nghe HTTP weblistener n gin. Cui phn to rule, chng ta s dng nt test xc nh xem website ckh nng reachable hay khng. Trong phn tip theo ca lot bi ny, chng ta s to mt SSLweb site c yu cu nhn thc. Trong phn , bn s bit mt s ty chn nng cao khi tocc web publishing rule.

Trong phn tip theo ca lot bi ny, chng ti s gii thiu cho cc bn mt s khinim c s dng trong mng c tng la TMG firewall - TMG firewall Network vTMG firewall Network Rule.

Trong lot bi gii thiu nhng vn c bn ca tng la TMG, chng ti gii thiu chocc bn v cc rule truy cp v cc rule cho web publishing. Trong phn tip theo ny chngti s gii thiu cho cc bn v cc mng TMG v cc rule mng. Tng la TMG chc chnl mt trong nhng tng la trc quan hn. Bn khng cn phi nh cc cu lnh m thay vo l s dng giao din ngi dng c thit k kh chuyn nghip.

To mt TMG Firewall Network
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

58/68





M hnh kt ni mng c tng la TMG da trn khi nim TMG firewall Network, vich N vit hoa. Mt TMG firewall Network l mt b su tp cc a ch IPv4 khng thuc v

bt c TMG firewall Network no khc. NIC kt ni chnh tng la TMG vi cc a ch IP c coi l root ca TMG firewall Network.

Gi s rng bn c mt TMG firewall c hai NIC. Mt giao din c kt ni vi Internet v l giao din External mc nh, n c kt ni vi External Network mc nh. Mt NICkhc c kt ni vi mt mng subnet khc, l Internal Network mc nh. Nu subnetnm trong di 10.0.0.0.-10.0.0.255 th mng Internal Network mc nh ca bn c nhngha bng cc a ch v NIC kt ni vi subnet l root ca Internal Network mcnh.

Trong hnh 1 bn di, bn c th thy tab Networks trong nt Network panel bn tri ca

giao din TMG firewall. C 5 mng TMG firewall mc nh y:

External. Mng External Network mc nh gm c tt c cc a ch IP khng nmtrong mng TMG firewall khc.

Internal. Mng Internal Network mc nh c nh ngha khi bn ci t tng la.Internal Network mc nh in hnh l mt mng gm c cc b iu khin min(domain controller) hoc my ch DNS m tng la TMG cn thc hin cc hotng c bn.

Local Host. Local Host Network c nh ngha bi cc a ch IP rng buc vi ttc giao din mng trn cc NIC ca tng la TMG.

Quarantined VPN Clients. Quarantined VPN Clients Networkl mt mng c tong, gm c tt c cc a ch IP ca my khch VPN hin ang c cch ly.

VPN Clients. VPN Clients Network l mt mng c to ng khc gm c cc ach IP ca tt c cc my khch VPN hin khng c cch ly.

Hnh 1
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

59/68





Nu mun c nhiu hn hai NIC trong mt tng la TMG, bn cn phi to cc mng mi h tr cc NIC ny.

Lu :

Bn c th c thm nhiu NIC trn cng mt mng tng la TMG, tuy nhin chng ta skhng cp n kch bn trong bi ny.

to mt mng tng la TMG mi, hy kch lin kt Create a New Networktrong phnpanel bn phi ca giao din iu khin. Thao tc ny s lm xut hin Welcome to the NewNetwork Wizard, xem th hin trong hnh 2 bn di. Trong trang ny, bn cn phi gn tncho mng. Trong v d trong bi, chng ti t tn cho mng l DMZ v kch Next.

Hnh 2

Trong trang Network Type, bn phi ch cho wizard v kiu mng m bn mun to. y lcc la chn m bn cn chn:

Internal Network Internal Network l mt mng c bo v bi tng la TMG.Khi to mt Internal Network, bn s c mt s ty chn cu hnh c th cho mng ,chng hn nh cc thit lp web proxy m cc my khch trn mng s dng. Chng tas cp n vn ny sau.

7/29/2019 TMG2010Ebook

60/68





Perimeter Network Mng Perimeter Network cng tng t nh mng InternalNetwork di dng cc ty chn c sn cho bn sau khi mng c hon tt. Trong

thc t, khng c s khc bit trong thc hin gia Perimeter Network v InternalNetwork, ch nh kiu lm cho n tr nn d dng hn trong vic phn bit mngno m bn cho l mng bn trong, mng no c xem l DMZ.

VPN Site-to-Site Network y l kiu mng c bit m TMG s dng kt nihai mng vi nhau qua Internet, s dng cc router VPN.

External Network Mng External Network l mt mng khng c cc ty chn ctrong cc mng Internal v Perimeter, v khng c coi nh mt mng c bo v

bi TMG; n cho php bn kt ni vi cc ti nguyn bn ngoi t chc, tuy nhinkhng th reach (vi ti) qua cng mc nh trn mng External Network mc nh.

Trong v d ny, chng ta s to mt mng DMZ v vy hy chn ty chn Perimeter

Networknh th hin trong hnh 3 v kch Next.

Hnh 3

Trong trang Network Addresses, bn cn cu hnh cc a ch IP c s dng nh nghamng. C nhiu a ch c th reach trc tip bi NIC kt ni vi mng m bn ang to. C

ba cch c th add a ch nh ngha mt mng:

7/29/2019 TMG2010Ebook

61/68





Add Adapter y l cch tt nht cho vic add a ch. Nu bn cu hnh bng nhtuyn trn tng la TMG trc khi to mng, ty chn ny s t ng bao hm tt c

cc a ch c th reach bi NIC trn mng m bn ang nh ngha. Add Private. Ty chn ny cho php d dng add mt b cc a ch IP ring nh

ngha mt mng mi ca bn. Add Range. Ty chn ny cho php bn ch nh mt di a ch IP no nh

ngha cho mng ca bn. Bn thng phi s dng ty chn ny nu cha cu hnhbng nh tuyn trn tng la TMG; trong trng hp , tt c a ch c th vi trctip bi NIC u khng c bao hm khi bn s dng ty chn Add Adapter.

Trong v d ny, chng ta s chn NIC (Guest) (chng ti t li tn cc NIC d dngphn bit hn) l root ca mng DMZ ang to. Xem th hin trong hnh 4.

Hnh 4

Xem li cc la chn trn trang Completing the New Network Wizard, trang bn c th thy

trong hnh 5 v kch Finish.

7/29/2019 TMG2010Ebook

62/68





Hnh 5

Ti y, mng mi c to xong. Mc d vy, khng c nhiu th bn thc hin lc nycho ti khi to mt Network Rule.

To mt TMG Firewall Network Rule

Mng c kt ni vi cc mng khc bng cc rule mng (Network Rule). Nu khng c ruleno kt ni mt mng vi mt mng khc s khng c lu lng truyn ti gia cc mng.Khi bn kt ni mt mng vi mt mng khc, bn cn phi nh ngha mi quan h tuyn giacc mng. Mi quan h tuyn c th l NAT hoc c th l Route. Mt mi quan h tuyn cngha rng cc gi t mt mng ngun no n mt mng ch s c nh tuyn, gingnh bt c mt kt ni c nh tuyn no. Nu bn chn quan h NAT, cc kt ni t mngngun s c NAT n mng ch, vi a ch IP chnh trn NIC gn nht vi mng ch thaycho a ch IP ngun gc ca host trn mng ngun.

to mt rule mi, kch tab Network Rules trong nt Networks trong giao din tng la.Sau kch lin kt Create a Network Rule trong panel phi ca giao din. Trang u tin

bn thy s l Welcome to the New Network Rule Wizard, nh nhng g th hin trong hnh6 bn di. u tin bn cn gn tn cho rule trong hp thoi Network rule name. Trong vd ny chng ti t tn cho rule l Internal to DMZ, y l rule s kt ni mng Internal

Network mc nh vi mng DMZ Network mi. Kch Next.

7/29/2019 TMG2010Ebook

63/68





Hnh 6

Trong hp thoi Network Traffic Sources, bn cn thit lp mng ngun cho rule mng.Trong v d ny, chng ti chn mng Internal mc nh lm mng ngun. Kch Add vsau trong hp thoiAdd Network Entities kch p Internal, xem th hin trong hnh 7.Kch Close v tip sau kch Next.
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

64/68





Hnh 7

Trong trang NetworkTraffic Destinations, thit lp pha ch n ca rule. Trong v d nychng ti chn mng Guest ( l mt mng DMZ Network) lm pha ch ca NetworkRule. Kch nt Add v chn DMZ Network t danh sch Networks trong hp thoi AddNetwork Entities, xem th hin trong hnh 8, sau kch Next.
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

65/68





Hnh 8

Trong trang NetworkRelationship, hnh 9, chn mi quan h tuyn gia mng ngun v ch.Trong v d ny, chng ti chn ty chn Route v kch Next.
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

66/68





Hnh 9

Trang cui cng ca wizard l Completing the New Network Rule Wizard nh th hintrong hnh 10. Kim tra cc thit lp ca bn v kch Finish.

7/29/2019 TMG2010Ebook

67/68





Hnh 10

Bn c th thy rule mng mi trong danh sch Network Rule trong trang Network Rules, nhnhng g bn thy trong hnh 11. Network Rules c nh gi theo th t - v vy nu thy cs chng trong mt s rule bn c th di chuyn rule m bn mun c nh gi cao hnln trn trong danh sch bng cch kch phi vo n v kch lnh Move Up. Sau khi rule cnchuyn nm v tr mong mun, hy kch nt Apply lu cu hnh vo chnh sch tngla.
http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/http://www.cd4pro.info/

7/29/2019 TMG2010Ebook

68/68



Hnh 11

Kt lun

Trong bi ny chng ti gii thiu c cho cc bn mt s khi nim c bn c s dngtrong kt ni mng c tng la TMG - TMG firewall Network v TMG firewall Network

Rule. Nu cha tng s dng nhiu hn hai NIC trong mt tng la TMG, bn s khng baogi cn phi ngh n ch ny. Tuy nhin nu quyt nh mun nng tng la TMG lnmc cao hn, bn c th ci t nhiu NIC trong tng la v to cc mng tng la TMGmi. C mt iu quan trng cn nh y l bn khng th s dng cc mng cho ti khito rule kt ni cc mng vi nhau xong. Khi cc mng c kt ni thng qua rule no, s truyn thng s c cho php gia cc mng ny.

Trong phn tip theo ca lot bi ny, chng ti s gii thiu cho cc bn cc ty chn mcnh c sn trong cu hnh mng khi to mt mng Internal hoc Perimeter.

Ch : www.CD4pro.info hin cung cp key bn quyn Standar v Enterprise cho Forefront

Threat Management Gateway


tmg2010ebook

Documents