Overview of the Forefront Threat Management Gateway 2010 Management Console

[LEFT][CODE]http://www.isaserver.org/tutorials/Overview-Forefront-Threat-Management-Gateway-2010-Management-Console.html[/CODE]

[B]Introduction[/B]

The introduction of Microsoft Forefront Threat Management Gateway (TMG) 2010 brings us a number of exciting and compelling reasons to upgrade from previous versions of Microsoft ISA Server. Some of these are major new security features included in the product, such as URL filtering, web anti-virus and anti-malware inspection, forward SSL inspection, an all new intrusion detection and prevention system, and enhanced e-mail protection. There are also numerous small things that have changed that are sure to make TMG’s daily management much easier. In this article I will introduce you to some of my favorite new features and enhancements in the TMG management console.
[B]New and Improved[/B]

[B]Rule Base Search[/B] – This feature has been a long time coming! The new search functionality included in the TMG management console makes managing large and complex rule sets much simpler. Want to display any rule that uses the DNS protocol? Simply enter ‘DNS’ in the search box and click the magnifying glass icon to execute the search.
[IMG]http://www.isaserver.org/img/upl/image0021262978986112.jpg[/IMG]
[B]Figure 1[/B]
The main window displays any rule that includes the DNS protocol.
[IMG]http://www.isaserver.org/img/upl/image0041262978986112.jpg[/IMG]
[B]Figure 2[/B]
There are several ways to construct queries. You can choose free text, name:value pairs, and property:value pairs. For more information, click the [B]Examples[/B] link next to the search box.
[B]Web Access Policy[/B] – The new [B]Web Access Policy[/B] node in the navigation tree displays a consolidated view of Web access rules configured in TMG.
[IMG]http://www.isaserver.org/img/upl/image0061262978986144.jpg[/IMG]
[B]Figure 3[/B]
[B][IMG]http://www.isaserver.org/img/upl/image0081262978986175.jpg[/IMG]
[/B][B]Figure 4[/B]
As with the rule base search functionality, this will significantly simplify administration for implementations with large and complex rule sets. A clear and concise view of web access rules reduces the chance of configuration error. Quick and easy access to common settings for enabling web access is also included in this view. These settings include web proxy configuration, authentication, compression, HTTPS inspection, malware inspection, and web caching.
[B]Routing Configuration[/B] – Highlight the [B]Networking[/B] node in the navigation tree and you will see a new tab called [B]Routing[/B].
[IMG]http://www.isaserver.org/img/upl/image0101262979073675.jpg[/IMG]
[B]Figure 5[/B]
[B][IMG]http://www.isaserver.org/img/upl/image0121262979073675.jpg[/IMG]
[/B][B]Figure 6[/B]
Here you can create [B]network topology routes[/B] (static routes). It is no longer necessary to connect to each TMG firewall individually and enter route commands from the command line. To add a static route, click on the [B]Create Network Topology Route[/B] link in the task pane.
[IMG]http://www.isaserver.org/img/upl/image0141262979073691.jpg[/IMG]
[B]Figure 7[/B]
Enter the destination host or network, the appropriate subnet mask, and the next hop gateway address. You can also specify a metric if required.
[IMG]http://www.isaserver.org/img/upl/image0161262979073706.jpg[/IMG]
[B]Figure 8[/B]
This feature also allows you to view the routing configuration for each TMG firewall.
[IMG]http://www.isaserver.org/img/upl/image0181262979165362.jpg[/IMG]
[B]Figure 9[/B]
[B]Network Interface Configuration[/B] – In addition to being able to configure static routes in the management console, you can also configure network interface properties. Highlight the [B]Networking[/B] node in the navigation tree and select the [B]Network Adapters[/B] tab.
[B]Note:
[/B]This tab is only visible when running the management console on an array member. It is not displayed in the management console on the Enterprise Management Server.
[IMG]http://www.isaserver.org/img/upl/image0191262979165362.jpg[/IMG]
[B]Figure 10[/B]
[B][IMG]http://www.isaserver.org/img/upl/image0211262979165378.jpg[/IMG]
[/B][B]Figure 11[/B]
Right-click on a network interface and choose [B]Properties[/B]. Here you can change IP addresses, subnet masks, default gateways, and configure DNS servers. Additionally you can enable or disable interfaces.
[IMG]http://www.isaserver.org/img/upl/image0231262979165425.jpg[/IMG]
[B]Figure 12[/B]
[B][IMG]http://www.isaserver.org/img/upl/image0251262979291409.jpg[/IMG]
[/B][B]Figure 13[/B]
[B]Getting Started Wizard[/B] – After TMG is installed, opening the management console for the first time will launch the [B]Getting Started Wizard[/B].
[IMG]http://www.isaserver.org/img/upl/image0271262979291409.jpg[/IMG]
[B]Figure 14[/B]
Here you are prompted to configure network and system settings and also define your deployment options. In the event you need to make significant configuration changes to your system or redefine deployment options post-installation, you can run the wizard again by highlighting the top node in the navigation tree then selecting the [B]Tasks[/B] tab in the task pane and clicking on the [B]Launch Getting Started Wizard[/B] link.
[IMG]http://www.isaserver.org/img/upl/image0291262979291425.jpg[/IMG]
[B]Figure 15[/B]
Please note that you cannot run the Getting Started Wizard when the TMG firewall is a member of an array. Attempting to launch the wizard will generate the following error:
[IMG]http://www.isaserver.org/img/upl/image0311262979291425.jpg[/IMG]
[B]Figure 16[/B]
[B]Network Load Balancing (NLB) Configuration[/B] – TMG now includes the ability to change the NLB operating node in the GUI.
[IMG]http://www.isaserver.org/img/upl/image0331262979378300.jpg[/IMG]
[B]Figure 17[/B]
In the past, this change could only be made programmatically. This made confirming the settings difficult, requiring the administrator to drop down to the command line for verification.
[B]Dashboard System Performance[/B] – The dashboard overview in the TMG management console now displays new counters for system performance. CPU Usage and Available Memory are included; this is much more useful to the average TMG administrator than the Allowed Packets/Sec and Dropped Packets/Sec that previous versions included.
[IMG]http://www.isaserver.org/img/upl/image0351262979378316.jpg[/IMG]
[B]Figure 18[/B]
[B]Connectivity Test[/B] – Highlighting the [B]Troubleshooting[/B] node in the navigation tree shows a new [B]Connectivity Test[/B] tab.
[IMG]http://www.isaserver.org/img/upl/image0371262979378316.jpg[/IMG]
[B]Figure 19[/B]
[B][IMG]http://www.isaserver.org/img/upl/image0391262979378316.jpg[/IMG]
[/B][B]Figure 20[/B]
This new tool allows you to test basic web connectivity from the firewall in the management console. Complete the [B]Destination URL:[/B] field and click the [B]Test Connectivity[/B] button to perform the test. Optionally you can select to run a pathping during the test to gather additional information. Be aware that the destination URL cannot contain a path, so if you are in the habit of adding the trailing slash when entering URLs like I am, you will see the following error:
[IMG]http://www.isaserver.org/img/upl/image0411262979450800.jpg[/IMG]
[B]Figure 21[/B]
[B]Firewall Policy Grouping [/B]– This is another feature administrators of large and complex rule sets will appreciate. To create a rule group select one or more rules, right-click on the selected rule(s) and choose [B]Create Group[/B].
[IMG]http://www.isaserver.org/img/upl/image0431262979450800.jpg[/IMG]
[B]Figure 22[/B]
Give the policy group a descriptive name and choose [B]Ok[/B].
[IMG]http://www.isaserver.org/img/upl/image0451262979450800.jpg[/IMG]
[B]Figure 23[/B]
The rules you selected are now part of a group. By right-clicking on the group and choosing [B]Properties[/B] you can enable, disable, or move the entire group. You can also rename the group or ungroup these rules.
[B]Summary[/B]

Those are my favorite new features in the Forefront Threat Management Gateway 2010 management console. There are many more features that you will likely find useful, so I encourage you to begin exploring the new TMG management console today!

[/LEFT]