Configure Active Directory Discovery for Forefront TMG

Forefront TMG provides a new feature that automatically detects clients on the TMG server side. Unlike previous versions of Firewall clients, TMG clients can use one of the tags in the Active Directory to find the appropriate TMG server. In the Active Directory, TMG clients use the Lightweight Directory Access Protocol (ldap,lightweight directory, Access Protocol) to find the information they need. After you install the Forefront TMG Client, in the Settings tab, you can view the two methods that Forefront TMG clients automatically detect to the Forefront TMG Server: "Using active Directory (recommended)" and " Use other DHCP-and DNS-based automatic detection methods, as shown in 1-1.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/73/0F/wKiom1Xy106zkR81AAQWAsTuqrU136.jpg "/>

Figure 1-1 Forefront TMG Client Auto-discovery method

Description: In Active Directory networks (that is, workstations join Active Directory), if the TMG client cannot find Active Directory tags, it is not automatically detected through DHCP and DNS for security reasons. This is done to reduce the risk that an attacker will forcibly restore the system to an unsafe state. If an Active Directory connection is established and the Active Directory tag cannot be found, the TMG client automatically switches to DHCP and DNS.

1 Configuring Active Directory tagging on the TMG server

However, by default, the Forefront TMG server does not automatically configure this feature in Active Directory, and it needs to be configured using one of the tools provided by Microsoft TmgAdConfig.exe.

This article describes how to configure Active Directory tagging. To configure Active Directory tagging, you can download the TMG Active Directory Configuration Tool AdConfigPack.EXE from the Microsoft Download Center, and then install the software on the Forefront TMG 2010 server computer. The installation of the tool is relatively straightforward, as shown in Figure 1-5 of 1-2~.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/73/0C/wKioL1Xy2X3C3ebZAAKlCX_3SIg357.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/73/0F/wKiom1Xy106CHtxRAAPCOqYGqek069.jpg "/>

Figure 1-2 Installation Tools Figure 1-3 accept the license Agreement

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/73/0C/wKioL1Xy2X6wxeFiAAJwvC2aBQk219.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/73/0F/wKiom1Xy10-BBhwdAAJGA_8r4WU365.jpg "/>

Figure 1-4 Select Installation Location Figure 1-5 Installation Complete

If you want to store the token key in Active Directory, at the command prompt, type:

TmgAdConfig.exe add-default-type Winsock-url <service-url> [f]

Where: The format of the Service-url item should be Http://<TMG Server name>:8080/wspad.dat.

The following parameters can be used in these commands:

(1) If you want to delete the key from Active Directory, at the command-line prompt, type:

TmgAdConfig.exe Del-default-type Winsock

(2) If you want to configure Active Directory tags for a specific site, use the site command-line parameter.

The Tmgadconfig tool creates a book entry in Active Directory:

Ldap://configuration/services/internet Gateway ("Container")/winsock Proxy ("ServiceConnectionPoint")

The server binding information for the key is set to <service-url>. The key will be retrieved by the Forefront TMG client and will be used to download the Wspad configuration file.

The following is an introduction to specific examples. After downloading and installing Tmgadconfig, go to the command prompt, go to the program installation location (shown in Figure 1-4), execute the following command line to register, 1-6 shows.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/73/0C/wKioL1Xy2X6jb5XJAAEHV33oq9M278.jpg "/>

Figure 1-6 Register TMG2010 Server's URL address, service port

2 Enabling Active Directory discovery on a workstation

After the Active Directory tag is configured, on workstations joined to the domain, after the Forefront TMG Client is installed, you can use Active Directory to discover the TMG 2010 server, as shown in 1-7.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/73/0F/wKiom1Xy11DhQRZ8AAVpsi0aCY8052.jpg "/>

Figure 1-7 Auto Detect to Forefront TMG Server

If you do not use Active Directory tagging support, you can also use the TMG Active Directory Configuration tool to clear the tag, in the following format:

Tmgadconfig del Default type Winsock

As shown in 1-8.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/73/0C/wKioL1Xy2X-BF648AACz5f4E55g548.jpg "/>

Figure 1-8 Clear Marks

At this point, you can configure the Forefront TMG option named WPAD on the DHCP server, as shown in 1-9.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/73/0F/wKiom1Xy11Diz6HZAARCcFg8Bts438.jpg "/>

Figure 1-9 Configuration WPAD Options

This article from "Wang Chunhai blog" blog, declined reprint!

Configure Active Directory Discovery for Forefront TMG