Installing Threat Management Gateway 2010 RTM Enterprise Edition

[LEFT][CODE]http://www.isaserver.org/tutorials/Installing_Threat_Management_Gateway_2010_RTM_Enterprise_Edition.html[/CODE]
[SIZE=3][B]
PART-1[/B][/SIZE]

Introduction I love new things, and I am excited about coming into this new position just in time to introduce a new product: Microsoft's Threat Management Gateway 2010 EE RTM. In this article, we'll start at the beginning, with how to how to install TMG 2010 EE RTM.
Of course, the real beginning is the planning phase, where you determine what the hardware requirements are going to be, and what role the TMG firewall is going to play on your network. However, if you're new to the TMG firewall, you probably just want to get it installed and see what it looks like. Planning for deployment can take place later if you decide you like what you see, and we'll address that in a later article. Meanwhile, this is the first of a two-part piece that will guide you through the installation process and point out potential "gotchas" that you might encounter along the way.
[B]Let us get started![/B]

As always, the first step is to make sure your hardware meets the minimum requirements, which you can find [URL="http://technet.microsoft.com/en-us/library/dd896981.aspx"][U]here[/U][/URL].
Many of you will be doing this initial installation for testing and evaluation purposes. So we will install the RTM release of the TMG firewall in a virtual machine, and the VM will have two network interfaces:

[LIST][*]An external interface, which is bridged to the production network that allows it to connect to the Internet, and[*]An internal interface that only allows it to connect to other virtual machines.[/LIST]
In this example, the only other virtual machine is a domain controller, and the TMG firewall belongs to the same domain as the domain controller.
This is going to be a "vanilla" install. The only thing we have done in advance is join the TMG virtual machine to the domain and then installed Windows Updates. I have not installed any Exchange components or any other "out of band" software. Our goal is to do what most admins will do - install the software in an "out of the box" configuration and then try to make it do what we want it to do as we learn more about the product.
[B]NOTE:
[/B]One thing that you should know before we get started is the DNS configuration on the TMG VM's NICs. Because you should never (well, almost never) include an external DNS server on any of the firewall's NICs, I have configured the external interface with no DNS server setting, and the internal interface with the IP address of the internal DNS server, which is also a domain controller. This is going to cause some issues that I'll take about later when we run into them.
Here is a simple network diagram of what I am working with right now and for this article:
[IMG]http://www.isaserver.org/img/upl/image0001260183757020.gif[/IMG]
[B]Diagram 1[/B]
The first step is to download the evaluation version of the software. At this time, TMG is not available on MSDN, but you can download an evaluation [URL="http://www.microsoft.com/downloads/details.aspx?FamilyID=E05AECBC-D0EB-4E0F-A5DB-8F236995BCCD&displaylang=en"][U]here[/U][/URL].
After you get the file downloaded, double click on it and it will unpack the files. After the files are unpacked, you will see the [B]Welcome to Microsoft Forefront TMG[/B] page. This looks a bit different compared to what we saw with the ISA firewall and it includes some welcome new options. Notice the [B]Prepare and Install[/B] section - now you can run Windows Updates from the installation page. We already did that, so we don’t need to do it now. Another new option, [B]Run Preparation Tool[/B], is one that we will use. Click that one now.
[IMG]http://www.isaserver.org/img/upl/image0011260184112739.jpg[/IMG]
[B]Figure 1[/B]
It’s clear that the TMG developers had large monitors when they created this interface. The dialog boxes are huge. I suppose that makes it nice for both the devs and the users – but makes it a bit of a pain for writers who have limited horizontal space for screenshots J
On the [B]Welcome to the Preparation Tool for Microsoft Forefront Threat Management Gateway (TMG)[/B] page, click [B]Next[/B].
[IMG]http://www.isaserver.org/img/upl/image0021260184188974.jpg[/IMG]
[B]Figure 2[/B]
On the [B]License Agreement[/B] page, put a checkmark in the [B]I accept the terms of the License Agreements[/B] checkbox and click [B]Next[/B]. Here you are accepting the license agreements for the [B]Microsoft Chart Controls for Microsoft .NET Framework 3.5 and 3.5 SP1[/B] and [B]Microsoft Windows Installer 4.5[/B].
[IMG]http://www.isaserver.org/img/upl/image0031260184476161.jpg[/IMG]
[B]Figure 3[/B]
On the [B]Installation Type[/B] page, you have three options:

[LIST][*][B]Forefront TMG services and Management[/B][*][B]Forefront TMG Management only[/B][*][B]Enterprise Management Server (EMS) for centralized array management[/B][/LIST]
The new TMG makes it easier than ever to work with TMG EE, in contrast to the complexity of EE management with the ISA firewall. That is why we are installing EE in this article series – to show that you can get EE installed easily. Later we’ll create a standalone array and then we will take down the standalone array and create an enterprise array. It’s easy and fun! But first, let’s just handle the basics and select the [B]Forefront TMG services and Management[/B] option. Click [B]Next[/B].
[IMG]http://www.isaserver.org/img/upl/image0041260184476161.jpg[/IMG]
[B]Figure 4[/B]
On the [B]Preparing System[/B] page, you will see installation progress for the prerequisite software.
[IMG]http://www.isaserver.org/img/upl/image0051260184476161.jpg[/IMG]
[B]Figure 5[/B]
The [B]Preparation Complete[/B] page shows that the prerequisite software was installed successfully.
[IMG]http://www.isaserver.org/img/upl/image0061260184695708.jpg[/IMG]
[B]Figure 6[/B]
Now the [B]Welcome to the Installation Wizard for Forefront TMG Enterprise[/B] page appears. Click [B]Next[/B] to start installing TMG EE.
[IMG]http://www.isaserver.org/img/upl/image0071260184695724.jpg[/IMG]
[B]Figure 7[/B]
On the [B]License Agreement[/B] page, select the [B]I accept the terms in the license agreement[/B] option and click [B]Next[/B].
[IMG]http://www.isaserver.org/img/upl/image0081260184695724.jpg[/IMG]
[B]Figure 8[/B]
Enter your customer information (user name, organization name and product serial number) on the [B]Customer Information[/B] page and click [B]Next[/B].
[IMG]http://www.isaserver.org/img/upl/image0091260185296974.jpg[/IMG]
[B]Figure 9[/B]
On the [B]Installation Path[/B] page, you can use the default path or choose your own path in specifying the location where you want to install the TMG firewall’s files. In this example, we’ll use the default path and click [B]Next[/B].
[IMG]http://www.isaserver.org/img/upl/image0101260185296974.jpg[/IMG]
[B]Figure 10[/B]
Ah, now here is a blast from the past - the [B]Define Internal Network[/B] page. For the TMG firewall, as for the ISA firewall, the default Internal Network is where your core infrastructure services are contained; these include Active Directory, DNS, DHCP and WINS. You can change this definition later if you like, but we need to be able to access these resources during installation, so we have to define the default Internal Network now.
Click the [B]Add[/B] button on the [B]Define Internal Network[/B] page. This brings up the [B]Addresses[/B] dialog box. There are several ways to add the addresses for the default Internal Network, but my preferred method is to use the [B]Add Adapter[/B] approach. Click [B]Add Adapter[/B].
[IMG]http://www.isaserver.org/img/upl/image0111260186134989.jpg[/IMG]
[B]Figure 11[/B]
On the [B]Select Network Adapters[/B] dialog box, select the [B]LAN[/B] NIC (or whatever name you have defined for that NIC) and then put a checkmark in the checkbox for that NIC. Make sure the information in the [B]Network adapter details[/B] section accurately reflects the details of the NIC you selected. Then click [B]OK[/B].
[IMG]http://www.isaserver.org/img/upl/image0121260186134989.jpg[/IMG]
[B]Figure 12[/B]
The addresses associated with the internal NIC now appear in the [B]Addresses[/B] text box. These addresses are based on routing table entries on the firewall - if you have not configured routing table entries on the firewall yet, these addressees might not be entirely correct, but it’s something that we can fix later, which you’ll see as we move through the installation process.
[IMG]http://www.isaserver.org/img/upl/image0131260186313380.jpg[/IMG]
[B]Figure 13[/B]
Click [B]Next[/B] on the [B]Define Internal Network[/B] page.
[IMG]http://www.isaserver.org/img/upl/image0141260186313395.jpg[/IMG]
[B]Figure 14[/B]
As with the installation of the ISA firewall, a number of services will need to be restarted or disabled when you’re installing the TMG firewall. In this case, these include:

[LIST][*]SNMP service[*]IIS Admin service[*]WWW Publishing Service[*]Microsoft Operations Manager Service[/LIST]
[B]NOTE:[/B]
TMG is not saying that these are currently installed – it’s just telling you that if they are installed, they’ll be disabled or restarted.
Click [B]Next[/B].
[IMG]http://www.isaserver.org/img/upl/image0151260186313395.jpg[/IMG]
[B]Figure 15[/B]
Click [B]Install[/B] on the [B]Ready to Install the Program[/B] page.
[IMG]http://www.isaserver.org/img/upl/image0161260186681880.jpg[/IMG]
[B]Figure 16[/B]
A progress bar shows your progress in the installation.
[IMG]http://www.isaserver.org/img/upl/image0171260186681880.jpg[/IMG]
[B]Figure 17[/B]
Another dialog box will appear and give you more information about how long things are going to take. Notice that these are estimated figures; despite the numbers you see here, it took almost 30 minutes for installation to complete for me. This might be related to DNS issues, which I'll discuss later.
[IMG]http://www.isaserver.org/img/upl/image0181260186681895.jpg[/IMG]
[B]Figure 18[/B]
Now the [B]Installation Wizard[/B] has competed and you might think you’re finished. In the past, with the old ISA firewall, this would have been it. The next step would have been to go into the ISA firewall console and get to configuring Networks, Access Rules, and other components to get the thing working. But with TMG, you’re not quite done yet.
If you select the [B]Launch Forefront TMG Management[/B] when the wizard closes, there will be a set of three more wizards that make it possible to get up and running at the end of the installation process.
[IMG]http://www.isaserver.org/img/upl/image0191260186681895.jpg[/IMG]
[B]Figure 19[/B]
Because these wizards are new, and we’re at the end of our word count for this article, we’ll save our discussion of the new installation wizards for the next article in this two part series. Hopefully this will whet your appetite for what comes next.
[B]Summary
[/B]

In this article, we started off by explaining that we would install the new TMG 2010 EE firewall in a plain vanilla configuration. The only settings on the TMG firewall VM are the DNS settings, and the firewall VM has been joined to the domain before beginning the installation of the firewall software. Next we launched the installation processes, configured the default Internal Network, and let the installation complete. In the next installment of this series, we’ll complete the installation of the firewall by going through the three new wizards that are nested in a new [B]Getting Started Wizard[/B]. See you then! - Deb.

[/LEFT]

[LEFT][CODE]http://www.isaserver.org/tutorials/Installing-Threat-Management-Gateway-2010-RTM-Enterprise-Edition-Part2.html[/CODE]

[SIZE=3][B]PART-2[/B][/SIZE]

[B]Introduction[/B]

In the first part of this two part series, we began the installation of TMG Enterprise Edition in a simple “vanilla” setup. Most of what you have seen so far undoubtedly looks very similar to the installation experience you have had with ISA Server over the last decade. In this, part two of the series, we will see some new components of the installation process; specifically, we will be taking a look at the new [B]Getting Started Wizard[/B].
Let us pick up where we left off. At this point you will see the [B]Getting Started Wizard[/B] page, and the first part of this process is to configure the network settings. Click the [B]Configure network settings[/B] link.
[B]Note:[/B]
Notice that at the bottom of the page that if you need to import your ISA 2006 configuration into TMG, you need to do that [I]before[/I] you run the [B]Getting Started Wizard[/B]. We’ll talk about migrating your ISA firewall configuration settings to TMG in a future article, so we won’t cover that right now.
[IMG]http://www.isaserver.org/img/upl/image0021263635015153.jpg[/IMG]
[B]Figure 1[/B]
Also note that you can get help with the [B]Getting Started Wizard[/B] by clicking the [B]Help about the Getting Started Wizard[/B] link toward the bottom of the page.
Click [B]Next[/B] on the [B]Welcome to the Network Setup Wizard[/B] page.
[IMG]http://www.isaserver.org/img/upl/image0041263635015169.jpg[/IMG]
[B]Figure 2[/B]
On the [B]Network Template Selection[/B] page, you have up to four options to choose from:

[LIST][*] [B]Edge Firewall - [/B]This is the default option and the one used in the majority of cases. This will create a default Internal Network and a default External Network.[*] [B]3-Leg perimeter - [/B]This option allows you to configure a trihomed DMZ segment. The reason it doesn’t appear as an option in the figure below is because you need at least three NICs for this option to be available. When you select this option, a TMG Firewall Network will be created by the DMZ segment, and Network Rules will be automatically created for you.[*] [B]Back firewall - [/B]This option is used when you have another firewall, such as another TMG firewall, ISA firewall or 3rd party firewall, in front of the TMG firewall. A perimeter TMG Firewall Network will be automatically created as well as a default Internal Network. [*] [B]Single network adapter - [/B]This option is used when you have a single NIC installed on the TMG firewall. This is used only when the firewall is going to be used as a Web proxy server. This configuration does not support any protocols other than HTTP, HTTPS and FTP. It does support remote access VPN.[/LIST]
In this example we will select the [B]Edge firewall[/B] option and click [B]Next[/B].
[IMG]http://www.isaserver.org/img/upl/image0061263635015169.jpg[/IMG]
[B]Figure 3[/B]
On the [B]Local Area Network (LAN) Settings[/B] page, you configure the IP addressing configuration of the internal interface. If you already configured the interface, you will see the settings here. You can also change the settings on this page. In the [B]Specify additional network topology routes[/B] section, you can click the [B]Add[/B] button and add routing table entries (not sure why they called routing table entries “network topology routes”, but I was not at that meeting).
After configuring your internal interface settings, click [B]Next[/B].
[IMG]http://www.isaserver.org/img/upl/image0081263635015184.jpg[/IMG]
[B]Figure 4[/B]
On the [B]Internet Settings[/B] page you configure the IP address settings on the external interface. Notice that you have the option to set static entries or use DHCP. Select the appropriate NIC and then choose the settings that work for you. Click [B]Next[/B].
[IMG]http://www.isaserver.org/img/upl/image0101263635112090.jpg[/IMG]
[B]Figure 5[/B]
That is all for the [B]Network Setup Wizard[/B]. Review your settings on the [B]Completing the Network Setup Wizard[/B] page and click [B]Finish[/B].
[IMG]http://www.isaserver.org/img/upl/image0121263635112090.jpg[/IMG]
[B]Figure 6[/B]
The next step is the [B]Configure system settings[/B] wizard. Click the [B]Configure system settings[/B] link to get started.
[IMG]http://www.isaserver.org/img/upl/image0141263635112106.jpg[/IMG]
[B]Figure 7[/B]
Click [B]Next[/B] on the [B]Welcome to the System Configuration Wizard[/B] page.
[IMG]http://www.isaserver.org/img/upl/image0161263635112106.jpg[/IMG]
[B]Figure 8[/B]
Several configurable options are available on the [B]Host Identification [/B]page:

[LIST][*] [B]Computer name -[/B] Here you can click the [B]Change[/B] button to change the name of the computer. This will require a restart of the machine.[*] [B]Member of - [/B]Here you can choose to make the TMG firewall a member of a [B]Windows domain[/B] or a [B]Workgroup[/B]. In most cases, the TMG firewall should be made a member of a domain so that you have the highest level of security possible for the firewall. You will need to restart the machine after changing workgroup or domain membership.[*] [B]Primary DNS Suffix -[/B] Here you can change the primary DNS suffix used by the TMG firewall. This is used by the firewall to append a suffix to single label name queries that the firewall may need to perform. If the TMG firewall is a member of a domain, it will automatically pick up the Active Directory domain name as the primary DNS suffix. [/LIST]
At the bottom of the page you’ll see the full computer name of the TMG firewall after you make changes here. In general, I handle these configuration tasks [I]before[/I] beginning installation of the TMG firewall. However, if you forget to do this in advance, it’s nice to know that you can take care of these tasks by using the System Configuration Wizard.
Click [B]Next[/B].
[IMG]http://www.isaserver.org/img/upl/image0181263635203856.jpg[/IMG]
[B]Figure 9[/B]
Wow! That was a pretty short wizard. Read the information on the [B]Completing the System Configuration Wizard[/B] page to confirm that it is correct and then click [B]Finish[/B]. Note that if you change the domain, workgroup or compute name the machine will restart before you can move onto the next steps.
[IMG]http://www.isaserver.org/img/upl/image0201263635203872.jpg[/IMG]
[B]Figure 10[/B]
The third step of the [B]Getting Started Wizard[/B] is [B]Define deployment options[/B]. Click the [B]Define deployment options[/B] link.
[IMG]http://www.isaserver.org/img/upl/image0221263635203872.jpg[/IMG]
[B]Figure 11[/B]
Click [B]Next[/B] on the [B]Welcome to the Deployment Wizard[/B] link.
[IMG]http://www.isaserver.org/img/upl/image0241263635203872.jpg[/IMG]
[B]Figure 12[/B]
The first thing the Deployment Wizard wants you to do is choose your [B]Microsoft Update Setup[/B] options. Here you have three choices:

[LIST][*] [B]Use the Microsoft Update service to check for updates (recommended) - [/B]This option has the TMG firewall use Microsoft update on the Internet to update firewall, OS, anti-malware and NIS signatures. Since it’s likely that Microsoft has higher uptime than your internal WSUS or SCCM configuration, this is probably the best option for the majority of cases.[*] [B]I do not want to use the Microsoft Update service -[/B] Use this option if your company has policy in place where you are not supposed to use the Microsoft Update to automatically update the firewall. You might use this option if you’re wary about installing updates and want to validate them before installing them on your firewall or firewall arrays.[/LIST]
Notice that if the computer is not connected to the Internet, this step could take several minutes, as the firewall will try multiple attempts to connect to the Internet Microsoft Update Services. This is a little misleading because your firewall might be able to connect to the Internet, but if you didn’t configure the TMG firewall to use an external DNS server (which is not recommend – you should avoid configuring an external DNS server on any of the firewall’s interfaces), then the TMG firewall has no way to resolve the names of the Internet Microsoft Update servers.
You might have configured the internal interface to use an internal DNS server, but the TMG firewall won’t be able to use that DNS server yet because you do not have an Access Rule in place that allows outbound access to internal DNS servers to external DNS servers. This puts you in a bit of a catch 22 – you need to resolve Internet host names, but you can not get to the configuration interface yet to make those DNS servers available to you.
Maybe in a future service pack update they’ll create a temporary DNS rule during setup that allows internal DNS servers to resolve public host names. Until then, we’ll just have to wait a bit during this phase of the installation.
[IMG]http://www.isaserver.org/img/upl/image0261263635383559.jpg[/IMG]
[B]Figure 13[/B]
On the [B]Forefront TMG Protection Features Settings[/B] page you have several options:

[LIST][*] [B]Network Inspection System (NIS) - [/B]Here you can choose to activate the complementary license or choose not to activate it. You do not need to license the NIS signatures – all copies of the TMG firewall allow you to take advantage of NIS.[*] [B]Web Protection -[/B] Here you have the option to Activate the evaluation license and enable Web protection. You can also enter your license details if you have licensed this feature. At this time, the details of how to license the Web protection updates is unclear.[*] [B]Enable Malware Inspection -[/B] If you enable this option, the TMG firewall will be able to inspect Web (HTTP/HTTPS) connections for malware. Note that only Web connections are inspected – this feature does not inspect other protocols such as NNTP, SSH, etc.[*] [B]Enable URL Filtering[/B] - This option turns on the URL Filtering capabilities of the TMG firewall and allows you to later configure sites or site categories that you might want to block access to, using Access Rules. [/LIST]
Notice how the URL Filtering service works. The TMG firewall doesn’t download an entire database. Instead, the TMG firewall sends the URL string to the Microsoft Reputation Service over an SSL connection to get a category result and uses that result to evaluate the connection request.
[IMG]http://www.isaserver.org/img/upl/image0281263635383559.jpg[/IMG]
[B]Figure 14[/B]
On the [B]NIS Signature Update Settings[/B] page, you have several options again:

[LIST][*] [B]Select automatic definition update action[/B] – You can choose to check and install the options, or check and download, or not even check. In most cases, you’ll want to automatically check for NIS signatures and install them automatically.[*] [B]Automatic polling frequency -[/B] Microsoft works around the clock on putting together signatures to protect your network. In order to take advantage of this, you want to poll Microsoft servers frequently so that you have the most up to date protection. The default interval is 15 minutes, but you can change that value if you like to make the check more or less frequent.[*] [B]Trigger an alert if no updates are installed after this number of days -[/B] This setting allows you to get an alert if updates don’t happen after “x” number of days. [*] [B]New Signature Set Configuration[/B] - This allows you to set a default response policy for new signatures. The default setting is typically the best one, which is [B]Microsoft default policy (recommended)[/B]. I’ll do an article on NIS in the future that will give you more insight about NIS signatures and response policies.[/LIST]
Click [B]Next[/B].
[IMG]http://www.isaserver.org/img/upl/image0301263635383575.jpg[/IMG]
[B]Figure 15[/B]
On the [B]Customer Feedback[/B] page, you have the option to join the Microsoft Customer Experience Improvement Program. I highly recommend that you participate in this program. It allows Microsoft to find out how you use the TMG firewall and helps them focus on making the product better based on how people use the firewall. In this example we will select the [B]Yes, I am willing to participate anonymously in the Customer Experience Improvement Program[/B] option and click [B]Next[/B].
[IMG]http://www.isaserver.org/img/upl/image0321263635383575.jpg[/IMG]
[B]Figure 16[/B]
On the [B]Microsoft Telemetry Reporting Service[/B] page you can help Microsoft and other TMG firewall owners by providing information about malware and other attacks on your network to Microsoft. Unless you have a strong reason for not participating, I highly recommend that you select the [B]Advanced [/B]option. This makes the anti-malware component more effective and ends up making everyone’s networks more secure. However, when you select the advanced option, in addition to basic information being sent to Microsoft, information about potential threats are sent in greater details, including traffic samples and full URL strings. The additional information provides Microsoft with more help in analyzing and mitigating threats.
In this example we will select the [B]Advanced[/B] option and click [B]Next[/B].
[IMG]http://www.isaserver.org/img/upl/image0341263635642887.jpg[/IMG]
[B]Figure 17[/B]
That was a long wizard! On the [B]Completing the Deployment Wizard[/B] page read the information about the choice you made to confirm that they are correct, then click [B]Finish[/B].
[IMG]http://www.isaserver.org/img/upl/image0361263635642903.jpg[/IMG]
[B]Figure 18[/B]
At this point things seem to get stuck. As mentioned earlier, I suspect the issue is that the TMG firewall isn’t able to resolve the names it needs to get to the Internet locations required to download the updates to the anti-malware and NIS services. This is a problem related to the fact that you don’t want to put an external DNS server address on any of the TMG firewall’s NICs – but during installation, this might be required. However, it can also cause problems with Active Directory communications. The problem can be solved later by creating an Access Rule that allows internal DNS servers access to the Internet, the type of access depending on how you configure your internal DNS servers to resolve Internet hosts names – either via recursion or forwarders.
At this point we are done with the [B]Getting Started Wizard[/B]. It will say on the bottom of the page that [B]You have successfully completed all the steps of the Getting Started Wizard. You are now ready to define Web Access policy for your organization[/B]. For ISA firewall admins, the Web Access Policy feature can be a bit confusing – because this policy creates Access Rules and groups them into a Web Access Policy.
[IMG]http://www.isaserver.org/img/upl/image0381263635642919.jpg[/IMG]
[B]Figure 19[/B]
So how did we do? I would expect that after installing the firewall that the [B]Alerts[/B] tab will be nice and clean and only tell me that the services have started and life is great – there will be plenty of time for me to mess up the configuration later. What’s the result?
[IMG]http://www.isaserver.org/img/upl/image0401263635663122.jpg[/IMG]
[B]Figure 20[/B]
Oops. What’s up with that? No more endpoint mappers, and I did not try to map an endpoint yet and even if I did, I wouldn’t know what endpoints to even try to map. I see the problem sometimes related to name resolution issues, so maybe the DNS issue I talked about earlier could be related to this. The malware inspection problem is most likely due to DNS issues, so I am not too worried about that one. Let us restart the firewall and see if anything interesting happens.
That’s a little better. The [B]WFP Filter Conflict Detected[/B] alert is a “normal” alert – i.e., it is a spurious alert that you can ignore. Not sure why the [B]Malware Inspection Currently Unavailable[/B] alert is still there, but it is probably due to the fact that the machine has not been running long enough to download updates.
[IMG]http://www.isaserver.org/img/upl/image0421263635663122.jpg[/IMG]
[B]Figure 21[/B]
[B]Summary
[/B]

In this two part series, we went over the installation experience for the TMG firewall. In the first part of the series, we saw what appeared to be a installation experience that was very close to the ISA firewall installation experience. However, in part 2 of this series, we were introduced to the [B]Getting Started Wizard[/B], which is all new with the TMG firewall. We went through the three sub-wizards that are part of the [B]Getting Started Wizard[/B] and successfully completed installation of the TMG firewall.

[/LEFT]