When you have made these selections, click Next. in C#

Generate QR Code in C# When you have made these selections, click Next.

5-51

Figure 5-20

6. On the Access Rule Sources page, shown in Figure 5-21, click Add to open the Add Network Entities dialog box. You can choose from any of the network objects defined on ISA Server. Select the network object or objects that you want, click Add, and then click Close. On the Access Rule Sources page, click Next.

Figure 5-21

7. On the Access Rule Destinations page, shown in Figure 5-22, click Add to open the Add Network Entities dialog box, click Networks, select the External network (representing the Internet), click Add, and then click Close. On the Access Rule Destinations page, click Next.

5-52

5

8. On the User Sets page, shown in Figure 5-23, you configure which users will be able to use the access rule. If you want to grant access to the Internet for all users, you can leave the user set All Users in place and proceed to the next page of the wizard. If the rule applies to specific users, select All Users, and then click Remove. Then, click Add to open the Add Users dialog box, from which you can add the user set to which the rule applies. When you have completed the user set selection, click Next.

5-53

9. On the Completing The New Access Rule Wizard page, review the information in the wizard summary, and then click Finish. 10. To configure the content types for the access rule, double-click the access rule. On the Content Types tab, shown in Figure 5-24, either accept the default setting that applies the rule to all content types or select the content types that the rule applies to.

Figure 5-24

11. To configure the schedule, on the Schedule tab, select the appropriate schedule from the Schedule list or click New to configure a new schedule element. Click OK. 12. To change the order of your access rules, select the access rule on the Firewall Policy tab and click Move Selected Rules Up or Move Selected Rules Down. 13. In the Firewall Policy details pane, click Apply to apply the new access rule.

For detailed walk-throughs of a variety of Internet access scenarios, see the article Controlling Secure Internet Access Using ISA Server 2004, located at http://www.microsoft. com/technet/prodtechnol/isa/2004/plan/controllingsecureinternetaccess.mspx.

Because access rules are evaluated in order based on the priority assigned in the ISA Server Management Console interface, it is important that you assign these priorities correctly.

5-54

5

One of the more common reasons why access rules do not operate as expected is because of the access rule priorities. ISA Server evaluates the access rules listed in the ISA Server Management Firewall Policy from the top down. As soon as ISA Server encounters a rule that corresponds with the client request, ISA Server evaluates that rule and grants or denies access. When you get an exam question in which users cannot access resources on another network, examine the access rule properties and examine the access rule order. If an access rule that denies access is evaluated before an access rule that enables access, the client connection will be denied.

In general, you should apply deny rules first, followed by the more specific rules, followed by general rules. For example, you may have the following requirements when configuring Internet access:

All computers should be able to access the Internet except for selected file servers. All users should be able to access the Internet except temporary employees. Users who access the Internet from a public kiosk computer located in the organization s reception area should be able to use only HTTP and HTTPS to access the Internet. Users should be able to access the Internet using all protocols.

Tip If you have worked as a Windows server administrator for a while and configured permissions using NTFS permissions, you are used to the idea that Windows always applies the deny permissions first, and then evaluates the allow permissions. This is not the case with ISA Server 2004. ISA Server evaluates all the access rules in order, regardless of whether the access rule allows or denies access.

To configure the access rules in this scenario, you could configure the rules with the following priorities: 1. Create an access rule that blocks Internet access to a computer set that includes all the file servers. 2. Create an access rule that blocks Internet access to the domain group that contains all temporary employees. 3. Create an access rule that allows only HTTP or HTTPS traffic from the public kiosk computer to access the Internet. 4. Create an access rule that allows all users to access the Internet using any protocol.