Using ISABPA for Proactive and Reactive Work with ISA Server

[LEFT][CODE]http://blogs.technet.com/yuridiogenes/archive/2009/03/13/using-isabpa-for-proactively-and-reactively-work-with-isa-server-part-1-of-2.aspx[/CODE]

[B]Part -1[/B]


[B]Using ISABPA for Proactive and Reactive Work with ISA Server – Part 1 of 2 [/B]

[FONT=Calibri][SIZE=3]It is very interesting to me that many people didn’t fully realized yet the benefits of ISABPA. Certainly we already have lots of admins that use this tool, but do you know if you really use the full capability of this tool? This post will describe the most common scenarios of using ISABPA and how to take full advantage of it. In this first part of the post I’m going to discuss how ISA BPA can assist you proactively to mitigate possible issues.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[B][SIZE=3][FONT=Calibri]2. Proactive Health Check[/FONT][/SIZE][/B]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]When you deploy ISA Server you should first of all plan, plan and plan. I worked in many cases where the ISA was installed like you install Microsoft Office, using NNF technology (Next, Next and Finish), no kidding. We all know that it is easy to install, but you need to collect information prior to deploy. Here some typical questions that can influence how you will size ISA for your environment:[/SIZE][/FONT]
[FONT=Symbol][SIZE=3]·[/SIZE][FONT=Times New Roman] [/FONT][/FONT][FONT=Calibri][SIZE=3]What type of scenario you plan to install ISA:[/SIZE][/FONT]
[FONT=Courier New][SIZE=3]o[/SIZE][FONT=Times New Roman] [/FONT][/FONT][FONT=Calibri][SIZE=3]Web Proxy?[/SIZE][/FONT]
[FONT=Courier New][SIZE=3]o[/SIZE][FONT=Times New Roman] [/FONT][/FONT][FONT=Calibri][SIZE=3]Firewall?[/SIZE][/FONT]
[FONT=Courier New][SIZE=3]o[/SIZE][FONT=Times New Roman] [/FONT][/FONT][FONT=Calibri][SIZE=3]VPN Access?[/SIZE][/FONT]
[FONT=Courier New][SIZE=3]o[/SIZE][FONT=Times New Roman] [/FONT][/FONT][FONT=Calibri][SIZE=3]Secure Publishing Server?[/SIZE][/FONT]
[FONT=Courier New][SIZE=3]o[/SIZE][FONT=Times New Roman] [/FONT][/FONT][FONT=Calibri][SIZE=3]All of them?[/SIZE][/FONT]
[FONT=Symbol][SIZE=3]·[/SIZE][FONT=Times New Roman] [/FONT][/FONT][FONT=Calibri][SIZE=3]What applications are you planning to publish through ISA?[/SIZE][/FONT]
[FONT=Courier New][SIZE=3]o[/SIZE][FONT=Times New Roman] [/FONT][/FONT][FONT=Calibri][SIZE=3]Exchange OWA?[/SIZE][/FONT]
[FONT=Courier New][SIZE=3]o[/SIZE][FONT=Times New Roman] [/FONT][/FONT][FONT=Calibri][SIZE=3]Outlook Anywhere?[/SIZE][/FONT]
[FONT=Courier New][SIZE=3]o[/SIZE][FONT=Times New Roman] [/FONT][/FONT][FONT=Calibri][SIZE=3]Sharepoint?[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]This is definitely not the complete list, is just an example of some questions that you should ask your customer (or yourself) when planning an ISA Server installation. After gather all the data, go ahead and use [/SIZE][/FONT][URL="http://www.microsoft.com/isaserver/capacityplanner.swf"][FONT=Calibri][SIZE=3]ISA Server Capacity Planner[/SIZE][/FONT][/URL][FONT=Calibri][SIZE=3] to see if you have the correct hardware for ISA.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Ok, but where ISA BPA comes in on this? I didn’t want to lose the opportunity to bring how important it is the planning phase; this is the reason why I started with that. ISABPA using Health Check option will be a post installation task. [/SIZE][/FONT]

[IMG]http://blogs.technet.com/photos/yuridio/images/3212547/original.aspx[/IMG]
[FONT=Calibri] [SIZE=3]Figure 1 – Starting a new scan.[/SIZE]
[SIZE=3] [/SIZE]
[SIZE=3]The following screen shows ISABPA performing the scanning operation:[/SIZE]

[SIZE=3][IMG]http://blogs.technet.com/photos/yuridio/images/3212548/original.aspx[/IMG][/SIZE]
[SIZE=3]Figure 2 – Scanning in Progress[/SIZE]
[SIZE=3] [/SIZE]
[SIZE=3]When this process finished you can click and view report and you will see (depends on the amount of warning or errors you have) a screen similar to Figure 3:[/SIZE]

[SIZE=3][IMG]http://blogs.technet.com/photos/yuridio/images/3212549/original.aspx[/IMG][/SIZE]
[SIZE=3]Figure 3 – ISA Report[/SIZE]
[SIZE=3] [/SIZE]
[SIZE=3]This is an example of a pristine installation of ISA Server 2006 on top of Windows Server 2003 SP2 with some basic rules configured on it. Notice how many warnings I have and how many improvements I can make on this configuration. If you want more details about each one of those suggestions, just click on it and you will see what the recommendation is as shown in Figure 4:[/SIZE]


[IMG]http://blogs.technet.com/photos/yuridio/images/3212552/original.aspx[/IMG]
[SIZE=3]Figure 4 – Details about the warning message.[/SIZE]
[SIZE=3] [/SIZE]
[SIZE=3]If you want to see a hierarchal view plus more details about this configuration you can click in Tree Reports and you will have a view like the one below:[/SIZE]

[IMG]http://blogs.technet.com/photos/yuridio/images/3212554/original.aspx[/IMG]
[SIZE=3]Figure 5 – Tree Reports View.[/SIZE]

[SIZE=3] [/SIZE]
[B][SIZE=3]3. Conclusion[/SIZE][/B]
[SIZE=3] [/SIZE]
[SIZE=3]In this first part of the article I explained some advantages of using ISA BPA for a proactive work, next article I will show you how ISBPA Tools can assist you during a troubleshooting scenario.[/SIZE]
[/FONT]




[/LEFT]

[LEFT][CODE]http://blogs.technet.com/yuridiogenes/archive/2009/05/07/using-isabpa-for-proactive-and-reactive-work-with-isa-server-part-2-of-2.aspx[/CODE]

[B]Part -2[/B]


[B]Using ISABPA for Proactive and Reactive Work with ISA Server – Part 2 of 2 [/B]

[B][SIZE=3][FONT=Calibri]1. Introduction[/FONT][/SIZE][/B]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[URL="http://blogs.technet.com/isablog/archive/2009/05/06/announcing-the-availability-of-isa-tmg-best-practices-analyzer-version-7.aspx"][FONT=Calibri][SIZE=3][COLOR=#0000ff]This week we launched ISA BPA V7[/COLOR][/SIZE][/FONT][/URL][FONT=Calibri][SIZE=3] and this is a great opportunity to continue the explanation on how ISABPA can be useful for proactive and reactive work. [/SIZE][/FONT][URL="http://blogs.technet.com/yuridiogenes/archive/2009/03/13/using-isabpa-for-proactively-and-reactively-work-with-isa-server-part-1-of-2.aspx"][FONT=Calibri][SIZE=3][COLOR=#0000ff]Last session[/COLOR][/SIZE][/FONT][/URL][FONT=Calibri][SIZE=3] I explained how you can use ISA BPA for proactive work with ISA Server. This session will explain the benefits of using ISABPA while troubleshooting an issue.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[B][SIZE=3][FONT=Calibri]2. ISA Data Packager[/FONT][/SIZE][/B]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Besides the ISABPA itself, when you install this tool a group of programs is created within Microsoft ISA Server group as you can see in Figure 1:[/SIZE][/FONT]

[IMG]http://blogs.technet.com/photos/yuridio/images/3236920/original.aspx[/IMG]
[FONT=Calibri][SIZE=3]Figure 1 – Tools that are installed by ISA BPA.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]ISA Data Packager is a data gathering tool that can assist you to collect a set of data in one single shot. Let’s use as an example a scenario where user can’t access certain web sites. You can launch the ISA Data Packager and the first screen will present you the templates that are available:[/SIZE][/FONT]

[IMG]http://blogs.technet.com/photos/yuridio/images/3236929/original.aspx[/IMG]
[FONT=Calibri][SIZE=3]Figure 2 – ISA Templates.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]The template that you will choose will depend on the scenario that you are dealing with; here are some examples of usability of the main templates:[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]

[B][SIZE=3][FONT=Calibri]Scenario[/FONT][/SIZE][/B]
[B][SIZE=3][FONT=Calibri]Template[/FONT][/SIZE][/B]
[FONT=Calibri][SIZE=3]Unable to access Internet[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Web Proxy and Web Publishing[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Unable to access some parts of the web site[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Get prompt for authentication when accessing a web site[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]OWA Exchange Publishing rule not working[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Sharepoint Publishing rule no working[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Unable to establish a VPN Site to Site[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]VPN[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Unable to connect from a client to ISA using PPTP or L2TP[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]VPN[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]When I open my ISA Console I receive a 0x800 Error and nothing shows up[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]ISA Administration[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]ISA Console is crashing[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Firewall Policy doesn’t show the rules[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Monitoring / Configuration shows one node is not out of Sync[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Configuration Storage Server[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]When accessing Internet Firewall Client turns red.[/SIZE][/FONT]
[SIZE=3][FONT=Calibri]Firewall Client [B](NEW in ISABPA7)[/B][/FONT][/SIZE]
[FONT=Calibri][SIZE=3]Collect data from ISA Server to review the configuration later (no issue to reproduce)[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Basic Repro and Static Configuration[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Next step is to choose the template according to the scenario, for this example I’m going to chose Web Proxy and Web Publishing. After select and click Next you will see the following screen:[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[IMG]http://blogs.technet.com/photos/yuridio/images/3236931/original.aspx[/IMG]
[FONT=Calibri][SIZE=3]Figure 3 – Summary of the default selections[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]A set of options are selected by default when you choose the template, those options will vary according to the template that was previously selected. Notice that [I]ISAInfo Report[/I] is not selected, which is something that is very useful since with this information you will be able to review all the details from this particular ISA box. In case you want to add that in your data collection you just need to click [I]Modify Options[/I] and the following screen will appear:[/SIZE][/FONT]

[IMG]http://blogs.technet.com/photos/yuridio/images/3236933/original.aspx[/IMG]
[FONT=Calibri][SIZE=3]Figure 4 – Changing default Options.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Here are some other guidelines about this screen:[/SIZE][/FONT]
[FONT=Symbol][SIZE=3]·[/SIZE][FONT=Times New Roman] [/FONT][/FONT][FONT=Calibri][SIZE=3]If you are having issues such as prompt for authentication when browsing internet, or ISA Server losing the secure channel with the DC, make sure to enable the option [I]Netlogon Logging[/I].[/SIZE][/FONT]
[FONT=Symbol][SIZE=3]·[/SIZE][FONT=Times New Roman] [/FONT][/FONT][SIZE=3][FONT=Calibri]If you are not dealing with Performance issue, disable the option [I]Performance Monitor Snapshot.[/I][/FONT][/SIZE]
[FONT=Symbol][SIZE=3]·[/SIZE][FONT=Times New Roman] [/FONT][/FONT][FONT=Calibri][SIZE=3]If you are using MSDE Database for logging and you want to collect data from it, select [I]MSDE Error Logs[/I].[/SIZE][/FONT]
[FONT=Symbol][SIZE=3]·[/SIZE][FONT=Times New Roman] [/FONT][/FONT][SIZE=3][FONT=Calibri][I]Change Tracking [/I]is [B]NEW in ISABPA7[/B].[/FONT][/SIZE]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]After making the selection, click Start Data Collection and wait until the option [I]press space bar to continue[/I] appears as shown in Figure 5:[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[IMG]http://blogs.technet.com/photos/yuridio/images/3236935/original.aspx[/IMG]
[FONT=Calibri][SIZE=3]Figure 5 – Starting capture.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]At this point you should go to the workstation that is facing the problem and reproduce the issue that you are having. After reproduce the issue press space bar again in the collecting data window and wait until the CAB is generated.[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[B][SIZE=3][FONT=Calibri]3. Now What?[/FONT][/SIZE][/B]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]ISA Data Packager Creates a file called ISAPackage.CAB, by default located in the desktop. This file contains the following folder / files:[/SIZE][/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]

[B][SIZE=3][FONT=Calibri]Folder[/FONT][/SIZE][/B]
[B][SIZE=3][FONT=Calibri]File(s)[/FONT][/SIZE][/B]
[B][SIZE=3][FONT=Calibri]Description[/FONT][/SIZE][/B]
[FONT=Calibri]BpaDataPackagerLogFiles[/FONT]
[FONT=Calibri]BpaDataPackagerLogFile.txt[/FONT]
[FONT=Calibri]This is the ISA Data Packager Log that has information about the moment of the data collection. You will use this file to troubleshoot issues where the Data Packager failed to run for example.[/FONT]
[FONT=Calibri]IDP.2009-5-7.9-8-29.trace.log[/FONT]
[FONT=Calibri]Verbose logging for ISA Data Packager, also used to troubleshoot ISA Data Packager itself.[/FONT]
[FONT=Calibri]BpaReportFiles[/FONT]
[FONT=Calibri]BPAReport_ISACONTN1_200905070911.xml[/FONT]
[FONT=Calibri]This is the ISA BPA Health Check report that you can load using the ISA BPA Tool.[/FONT]
[FONT=Calibri]BPAReport_ISACONTN1_200905070911.xml.log[/FONT]
[FONT=Calibri]Log for data collection of the ISA BPA, used to troubleshoot ISA Health Check itself.[/FONT]
[FONT=Calibri] [/FONT]
[FONT=Calibri]IsaConfigExport.200905070911.xml[/FONT]
[FONT=Calibri]This is the export configuration of the ISA Server. Consider this your backup if you never made one, here it goes.[/FONT]
[FONT=Calibri]EventViewerEvents[/FONT]
[FONT=Calibri]Application.evt[/FONT]
[FONT=Calibri][B]NEW on BPA7[/B] – this is the export of the Application log in EVT format.[/FONT]
[FONT=Calibri]EventViewer_ErrorEvents6.csv[/FONT]
[FONT=Calibri]Only errors events (windows event viewer events) in CSV format.[/FONT]
[FONT=Calibri]EventViewer_IsaEvents6.csv[/FONT]
[FONT=Calibri]Only ISA errors events logged in windows event viewer.[/FONT]
[FONT=Calibri]System.evt[/FONT]
[FONT=Calibri][B]NEW on BPA7[/B] – this is the export of the System log in EVT format.[/FONT]
[FONT=Calibri]IsaInfoFiles[/FONT]
[FONT=Calibri]ISAInfo_isacontn1.log[/FONT]
[FONT=Calibri]Log for data collection of the ISA Info, used to troubleshoot ISA Info itself.[/FONT]
[FONT=Calibri]ISAInfo_isacontn1.xml[/FONT]
[FONT=Calibri]ISAInfo file that you can open using [/FONT][URL="http://isatools.org/tools/isainfo.zip"][FONT=Calibri][COLOR=#0000ff]ISA Info tool from ISA Tools .org[/COLOR][/FONT][/URL][FONT=Calibri].[/FONT]
[FONT=Calibri]ISALogs[/FONT]
[FONT=Calibri]IsaLogs_Firewall_TextEXT_200905070911.csv[/FONT]
[FONT=Calibri]Firewall Logging in CSV format.[/FONT]
[FONT=Calibri]IsaLogs_WebProxy_TextEXT_200905070911.csv[/FONT]
[FONT=Calibri]Web Proxy Logging in CSV format.[/FONT]
[FONT=Calibri]IsaTraces[/FONT]
[FONT=Calibri]isalog.bin[/FONT]
[B][FONT=Calibri]Files used by Microsoft CSS Engineers only since they require internal symbols to parse it.[/FONT][/B]
[FONT=Calibri]manifest.txt[/FONT]
[FONT=Calibri]NetworkCaptures[/FONT]
[FONT=Calibri]External_20090507090839.cap[/FONT]
[FONT=Calibri]Network Capture from the external interface. Correct, you don’t need to start netmon separately when using ISA Data Packager.[/FONT]
[FONT=Calibri]LocalCorp_20090507090839.cap[/FONT]
[FONT=Calibri]Network Capture from the Internal interface.[/FONT]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[I][SIZE=3][FONT=Calibri]Note1: amount of files and folders will vary according to the template that you choose.[/FONT][/SIZE][/I]
[I][SIZE=3][FONT=Calibri]Note 2: file name will vary according to the date of the day.[/FONT][/SIZE][/I]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[B][SIZE=3][FONT=Calibri]4. Conclusion[/FONT][/SIZE][/B]
[FONT=Calibri][SIZE=3] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]With this set of data you have enough data to start troubleshooting the issue that you are facing with ISA Server. You have logs, network captures and capability to read ISA Server configuration. My recommendation is that you install this tool in your lab, and start to test simple scenarios so you get used to read those logs. Try to simulate simple issues in your lab and look the logs to see what you can do to fix the issue.[/SIZE][/FONT]


[/LEFT]