How to Allow Ping From Selected Computers To ISA Server Machine

[LEFT][CODE]http://www.elmajdal.net/ISAServer/How_to_Allow_Ping_From_Selected_Computers_To_ISA_Server_Machine.aspx[/CODE]


Enable ping to ISA Server, but not from a wide open source Network, just enable it from a short list of machines, from the Remote Management Computers
[B] Configuration[/B]


[LIST=1][*] Open ISA Server Management Console, Click on [B][SIZE=2] Start[/SIZE][/B][SIZE=2] > [B]All Programs[/B] > [B]Microsoft ISA Server[/B] > [/SIZE][B] [SIZE=2]ISA Server Management

[/SIZE][/B] [IMG]http://www.elmajdal.net/ISAServer/Installing_ISA_Server_2006_Remotely/ISA_Page_15_Open_ISA.jpg[/IMG]

[*]Click on the [B]Firewall Policy[/B] node, as you can see, this is a fresh install of ISA Server 2006, and it still has its [B]default Deny rule[/B]. We will not create any new rule to allow Ping to ISA Server, we will be working with ISA Server System Policy, [SIZE=2]Click [URL="http://www.isaserver.org/tutorials/Editing-ISA-2004-system-policy-Part1.html"] [B]here[/B][/URL] to read more about System Policy.[/SIZE][SIZE=2]
[B]
[IMG]http://www.elmajdal.net/ISAServer/Administrating_ISA_Server_2006_Remotely_Using_MMC_and_Remote_Desktop_Connection/Remote_administration_isa_2.gif[/IMG][/B][/SIZE][*] [SIZE=2]From the right side panel, under the [B]Tasks[/B] tab, click on the [/SIZE] [SIZE=2][B] Edit System Policy

[IMG]http://www.elmajdal.net/ISAServer/Administrating_ISA_Server_2006_Remotely_Using_MMC_and_Remote_Desktop_Connection/Remote_administration_isa_2006.JPG[/IMG] [IMG]http://www.elmajdal.net/ISAServer/Administrating_ISA_Server_2006_Remotely_Using_MMC_and_Remote_Desktop_Connection/Remote_administration_isa_2006_2.JPG[/IMG]

[/B][/SIZE] [SIZE=2]The [B]System Policy Editor[/B] will open, in this article we will be working with one System Policy rule, which falls under the [B]Remote Management[/B] configuration group, the System Policy that we are going to work with in this article from the System Policy Editor is ICMP (Ping)

[/SIZE][SIZE=2] [IMG]http://www.elmajdal.net/ISAServer/How_to_Allow_Ping_From_Selected_Computers_To_ISA_Server_Machine/Ping_System_Policy.JPG[/IMG][/SIZE][*] [SIZE=2]By default ICMP (Ping) is Enabled, it is ? OK ! then why no one can ping the server ? This is because you will need to specify from which machine(s) you are going to allow ping to your ISA Server, this can be configure by clicking on the [B]From[/B] Tab, by default the [/SIZE][B][SIZE=2] Remote Management [/SIZE][SIZE=2]Computers [/SIZE][/B][SIZE=2]is included under the From tab, and by default , the Remote Management Computers is empty and you will need to populate it.

[IMG]http://www.elmajdal.net/ISAServer/How_to_Allow_Ping_From_Selected_Computers_To_ISA_Server_Machine/Ping_System_Policy_from_tab.JPG[/IMG][/SIZE][*]Click on the [B]Remote Management Computers[/B] and then click on the [B]Edit[/B] Button, the [B]Remote Management Computers Properties[/B] page will open, here you can add a single Computer, an address range, or a complete subnet to the remote management computers, in this article, I am the only administrator of ISA Server, and I will only allow ping from my Vista Laptop, so I will add a Computer, click the [B]Add[/B] button , then click on [B]Computer[/B]

[IMG]http://www.elmajdal.net/ISAServer/Administrating_ISA_Server_2006_Remotely_Using_MMC_and_Remote_Desktop_Connection/remote_management_computers_add.JPG[/IMG][*]Click on the [B]Remote Management Computers[/B] and then click on the [B]Edit[/B] Button, the [B]Remote Management Computers Properties[/B] page will open, here you can add a single Computer, an address range, or a complete subnet to the remote management computers, in this article, I am the only administrator of ISA Server, and I will only allow ping from my Vista Laptop, so I will add a Computer, click the [B]Add[/B] button , then click on [B]Computer[/B]

[IMG]http://www.elmajdal.net/ISAServer/Administrating_ISA_Server_2006_Remotely_Using_MMC_and_Remote_Desktop_Connection/remote_management_computers_add.JPG[/IMG][*] [SIZE=2]Browse to the computer that you want to add by clicking on the [B]Browse[/B] button, or start filling its name, IP address and a brief description if you want, once its set, click on the [B]OK[/B] Button[/SIZE]

[IMG]http://www.elmajdal.net/ISAServer/Administrating_ISA_Server_2006_Remotely_Using_MMC_and_Remote_Desktop_Connection/remote_management_computers_add_laptop.JPG[/IMG]

The Computer will be listed as shown below, Click on the [B]OK[/B] button

[IMG]http://www.elmajdal.net/ISAServer/Administrating_ISA_Server_2006_Remotely_Using_MMC_and_Remote_Desktop_Connection/remote_management_computers_added.JPG[/IMG][*]Click the [B]Apply[/B] button so the changes take effect

[IMG]http://www.elmajdal.net/ISAServer/Allowing_FTP_Uploads_Through_ISA_Server_2004_2006/Apply_button.JPG[/IMG][*]Now, I will go to my laptop and start pinging my ISA Server.

As you can see from the image below, request time out was the first result of the ping, then once the changes took place after the Apply operation completed, reply responses started to come back as shown.

[IMG]http://www.elmajdal.net/ISAServer/How_to_Allow_Ping_From_Selected_Computers_To_ISA_Server_Machine/cmd_result.jpg[/IMG]

Before I conclude , I want to show the details of this allow ICMP (Ping) rule. From the left side panel, click on Firewall Policy, then below the menu bar, click on the [B]Show/Hide System Policy Rules[/B] button shown below in the red rectangle

[IMG]http://www.elmajdal.net/ISAServer/Administrating_ISA_Server_2006_Remotely_Using_MMC_and_Remote_Desktop_Connection/Show_hide_system_policy.JPG[/IMG]

All the System Policy rules will be displayed in details.

[IMG]http://www.elmajdal.net/ISAServer/How_to_Allow_Ping_From_Selected_Computers_To_ISA_Server_Machine/All_System_Policy.gif[/IMG]

As you can see, the System Policy rule that we worked with is rule number 11

[SIZE=2] [IMG]http://www.elmajdal.net/ISAServer/How_to_Allow_Ping_From_Selected_Computers_To_ISA_Server_Machine/Ping_System_Policy_details.gif[/IMG][/SIZE]
[/LIST]
[B]Summary[/B]
In this article, we enabled Ping from only Selected Computers to ISA Server. Do not enable ping from a wide range of computers or from all your Internal Network, enable it only from few selected machines. Believe me you do not want to flood your Firewall with unneeded traffic.




[/LEFT]