one-way DFSR on Windows Server 2008 R2 (part 1 of 3)

Recently, I need to confirm DFSR function for one Project verification. Based on this necessity, I have to study DFSR mechanism on 64 bit Windows Server 2008 R2 so that build a environment for testing its function on my lab.
The following process summary my testing steps for your reference. In this article, I will introduce the prerequisite of one way DFSR.

TMG 2010 Firewall Rule Setting
Set “Firewall Rule” from DMZ (Server with DFSR Role) to Internal (Server with DFSR Role)  for TCP:135, 445, 24158 (Custom) , 49999 (Custom)
Set “Firewall Rule” from DMZ (Server with DFSR Role) to Internal (Server with AD Role) for TCP: 53, 88, 135, 389, 5000~5100 (Custom), 50000 (Custom)
Set “Firewall Rule” from Internal (Server with DFSR Role) to DMZ (Server with DFSR Role) for TCP:135, 445, 24158 (Custom) , 49999 (Custom)

Set static RPC for AD Logon/Directory Replication
Add Registry Key and correct value as a single port(50000/TCP). For detailed configuration, please refer to this URL as ADLogon/DirRep setting.
Open firewall port for Computer join Domain & Account logon Domain

Disable Windows Firewall
Turn off Windows Firewall on all Servers with DFSR role

Installing DFS Replication
In Server Manager, click “Roles” ---> “Add Roles” to trigger [Add Roles Wizard]
Click “Next >” button if you have already verified the suggestion.
Enable “File Services” check box next to click “Next >” button
Click “Next >” button
Enable “DFS Replication” check box next to click “Next >” button
Click “Install” button
Click “Close”button if the installation succeeded.
So dose that it also install the DFS Management Console(dfsmgmt.msc) with MMC snap-in in the feature of Server Manager.

Configure DFSR to a Static Port
By running the DFSRDIAG STATICRPC command on the DFSR Server as VBHV-FS-01, the DFSR RPC listening port will be forced on a static port as TCP/49999.
After finish the above activity, please remember to restart “DFS Replication Service” again.



Set a Fixed Port for WMI
By executing the command on the console of DFSR role servers as VBHV-FS-01 & VBHV-FS-11 to set a fixed port as TCP/24158 for WMI

Until now, I have already finish the related prerequisite for DFSR. In next article, I will introduce the configure and setup DFSR mechanism.

one-way DFSR on Windows Server 2008 R2 (part 2 of 3)   >>>

Install Microsoft Forefront TMG 2010 (part 3 of 3)

The previous article(part 2) has already finished the Getting Started Wizard. In the moment, it will continue to run the Web Access wizard after enable check box and click “Close” button.
In the beginning screen, please directly click “Next >” button if you clearly this wizard will helps you define something.
URL FilteringSelect “Yes, create a rule blocking the minimum recommended URL categories” option next to click “Next >” button
It will show a rule about Block access to these Web destinations. If no need to add other rule, please directly click “Next >” button
Malware and HTTPS Inspection
In Malware Inspection Settings, selecting “Yes, inspect Web content requested from the Internet” and “Block encrypted archives…”  for scanning HTTP content requested from Internet.
In HTTPS Inspection Settings, select “Allow users to establish HTTPS connections to Web sites” and “Inspect HTTPS traffic and validate HTTPS site certificates” option for let TMG can scan HTTPS traffic.
In HTTPS Inspection Preferences, select “No, do not notify users of HTTPS inspection” option if HTTPS traffic is inspected and “Use a certificate automatically generated by Forefront TMG” option for generating the HTTPS inspection certificate.
Web Caching
Due to this TMG is not a member of a Windows Active Directory Domain, it just only selection for us to choose “I will manually export and deploy the certificate” for deploying HTTPS inspection trusted root CA to the client computers.
Please click “Browse…” button for where is the exported certificate location.
Choose the right location as “My TMG 2010” and assign a file name as “https inspection trusted root CA” next to click “Save” button
Click “Next >” button if the certificate path and name is right.
In Web Cache Configuration, I want to enable the default Web caching rule so that need to create Cache Size by click “Cache Drives…” button
Select “Drive C:” and write down Maximum cache size(MB) “1024” next to click “Set” button
You will see Cache size has value “1024” now. Click “OK” to exist this setting.
Click “Next >” button to complete Web Cache Configuration.
Until now, we have already complete the Web Access Policy Wizard”.
Finally, we need to save changes and update the configuration by clicking “Apply” button.
The Firewall Policy will define some policy based on the above setting now.

<<< Install Microsoft Forefront TMG 2010 (part 2 of 3)

Install Microsoft Forefront TMG 2010 (part 1 of 3) >>>

Install Microsoft Forefront TMG 2010 (part 2 of 3)

Last article, I have already finish Software installation based on role selection and assign the internal network adapter. In the moment, I will continue to do the related configuration.

Network Settings
Click “Start” –> "Forefront TMG Management” to launch “Getting Started Wizard”
In Getting Started Wizard, click “Configure network settings”
Click “Next >” button
Select “Edge firewall” option next to click “Next >” button
Select the Internal network adapter next to click “Next >” button
Select one network adapter to connect to the Internet and “Obtain an IP address automatically” option next to click “Next >” button. In the moment,the alert message will show up and tell us the suggestion --- Use a static IP for a more secure configuration. Due to the selection is right for me, I decide to ignore this alert next to click “OK” button.
Click “Finish” button to complete the network setup wizard.
Now we will continue to configure system settings

System SettingsIn Getting Started Wizard, click “Configure network settings”
Click “Next >” button
Click “Next >” button if host identification is exact.
Click “Finish” button to complete the system setup wizard.
Now we will continue to define deployment options.

Define Deployment
In Getting Started Wizard, click “Define deployment options”click “Next >” button
Select “User the Microsoft Update service to check for updates” option next to click “Next >” button
In the NIS and Web Protection selection, it will depend on whether you need this function on TMG. In the moment, I will enable NIS and Web Protection by default next to click “Next >” button.
In the configuration of Signature Set Update and New Signature Set, it still depend on your decision. I still select recommended option next to click “Next >” button.
Select a feedback option next to click “Next >” button
Select your level of participation next to click “Next >” button
Click “Finish” button to complete the Deployment Wizard
Until now, we have already finish Getting Started Wizard.
In next article, we will continue to run the Web Access Wizard.

<<<  Install Microsoft Forefront TMG 2010 (part 1 of 3)