Microsoft Sharepoint Products and Technologies Resource Kit eBook

Chapter 25: Firewall Considerations for SharePoint Portal Server Deployments 675
This is because the servers benefit from the ISA Server network address translation
(NAT) architecture. Web publishing rules determine how ISA Server should intercept
incoming HTTP requests for a server located behind the ISA Server computer, and
how ISA Server should respond on behalf of this server. Requests are forwarded
downstream to the server (or a server farm) running SharePoint Portal Server. If
possible, requests are serviced from the ISA Server cache. Essentially, Web publishing
rules map incoming requests to the appropriate server behind the ISA Server
computer.
Note Web publishing uses the ISA proxy service as well as the firewall service.
Therefore, ISA Server 2000 has to be installed in integrated mode.
When Web publishing is used, Secure Sockets Layer (SSL) connections to the
SharePoint site are terminated at the ISA Server 2000 firewall so that the traffic can
be decrypted and the HTTP payload examined. For a Web publishing rule, you can
configure how HTTPS (HTTP over SSL) requests should be redirected from ISA
Server to the internal SharePoint site—as HTTP requests or as HTTPS requests. This
is known as SSL bridging.
You can further enhance your solution by configuring link translation. Link
translation provides the ability to replace text strings in an HTTP response based on
a dictionary that is set up at the ISA Server. This functionality allows you to address
the problem of broken links that might result from using internal computer names
when responding to external clients. We will discuss setting up link translation later
in this chapter.
An additional layer of protection can be provided by enabling basic credentials
delegation on the ISA Server. In this scenario, the external users are authenticated at
the ISA Server. If the authentication at the ISA Server is successful, the user credentials
are then forwarded to the internal SharePoint site for authentication. The Share-
Point authentication is transparent to the users; the users submit their credentials
only once.
Note Link translation and basic credentials authentication are available in
ISA Server 2000 Feature Pack 1. Feature Pack 1 can be downloaded from
http://www.microsoft.com/isaserver/featurepack1/howtogetfp1.asp.
We will start with setting up a Web publishing rule for a SharePoint Portal
Server deployment. We will then look into configuring SSL bridging, link translation,
and basic authentication delegation.