Just passed ISA

Taz69 · #1 17-Jul-2004, 05:45 PM

And I'm first to post to the Security Forum

I passed ISA on Friday with a score of 777 so am feeling pretty happy about now.

Other than saying it is quite a tough exam I'm not sure what advise I can give other than try to have knowedge of everything in the Microsoft MOC as it is all covered in the exam. Microsoft get a bit sneaky with the questions and I did find myself re-reading the answers to spot the differences on more than 1 occasion.

Also try to get time to experiment with having 2 or 3 ISA servers set up in various configurations. Playing with Enterprise policies, Arrays and VPNs really does help pull the theory together.

My other comment is to manage your time. I had 145 mins to answer 62 questions, I ended up with 45 mins to answer the last 30 questions

and ended up trying to clear the exibit on the final question so I could hit 'End Exam' when my time ran out.

punkboy101 · #2 17-Jul-2004, 05:49 PM

Well done Taz, glad to hear you passed. Hope you had a few celebratory beers last nite!

Jakamoko · #3 17-Jul-2004, 06:01 PM

Well done from me too, Taz - hope you enjoy a bit of a celebration

**nugget** · #4 17-Jul-2004, 06:49 PM

Well done Taz.

AJ · #5 17-Jul-2004, 08:00 PM

Nice one Taz

well done and big congrats

~~flex22~~ · #6 17-Jul-2004, 09:54 PM

Congrats

and thanks for the tips

**Phoenix** · #7 17-Jul-2004, 10:19 PM

Well done Taz mate, might have to rope you in for an ISA Masterclass at somepoint :P

**SiFor** · #8 18-Jul-2004, 06:40 AM

Congrats Taz, sink a cold one from me

**Bluerinse** · #9 18-Jul-2004, 10:54 PM

Congratulations Taz u r da man

I can tell others that ISA is one complex mother and Taz has done really well to pass this thing first time. I know tutors on other sites that have stated this exam to be harder than most and possibly even as hard as 216. That is what has put me off taking it for sooo long!

Once again Taz you have my repsect brother!!!

Pete

PS good luck with 219 for the E

Taz69 · #10 18-Jul-2004, 11:13 PM

Thanks Guys....

I'm sure you'll all be glad to know that I've tried to keep a little blood in the alcohol stream over this weekend

but a few tinnies have crossed my lips

I'll just save the real celebrations for another 2 - 3 when I hope to finally get the 'E' if I can manage to get through 219.

FLEX: Is ISA something you intend to study? If you are looking to take on ISA I would recommend taking on the Beast first. I think they are brothers

Not sure that I'd make enough sense for a masterclass

but if I come across any ISA questions that I can help with I'll try.

**Bluerinse** · #11 19-Jul-2004, 12:04 AM

Okay Taz, here is a question for ya!

You are the entreprise admin of kanga poop fertilizer company, you are installing an ISA server in integrated mode in order to improve your users surfing experience and tighten network security with a firewall.

You have a dsl link to the Internet via a Netgear router which has a private IP address of 192.168.0.1 on it's internal side.

Your ISA server has two network cards, one for the internal network and one which you would like to configure as the external interface.

Your ISA server is connected to the DSL router directly by a network cable

You go into ISA management and would like your ISA server to send Internet requests to this router but you are confounded because ISA wants to use a dial up connection as it's external interface.

How do you configure ISA to use a dial up connection when there is no modem as such attached to the server?

This is a real life problem that I am facing and can't find a sensibe solution that doesn't cost money. I believe WinPoet may be a solution but I am not about to spend money on software when there must be another way?

What do you think?

PS there is a step by step on isaserver.org but the vital link that is supplied there retrieves and error 404 page not found

Pete

Taz69 · #12 19-Jul-2004, 01:22 AM

Thanks Pete... It looks like you sent your original post whilst I was plotting my responce. as you were one of the people who helped me whilst I was starting out your kind words mean alot and all I can say is THANKYOU...

Didn't take long for the gauntlet to be thrown down so here goes.

I'm assuming that the ADSL router is configured with NAT.

I don't see why you would want to use a dialup connection. Just configure the external NIC with an IP in the same subnet as your routers internal interface with the router as the default gateway. About the only thing you'll have to watch out for is to make sure that the external NIC's network isn't mentioned in the LAT.

For example you could configure your external NIC with an IP of 192.168.0.2, probably subnet mask of 255.255.255.0 and a default gateway of 192.168.0.1. Your internal interface could be 192.168.1.1 (trying to keep things simple)

and won't need a default gateway added.

If this helps the penny drop then job done... Otherwise I'll pop back later and see if I've managed to make any sense.
Night and thanks again to everyone...

~~flex22~~ · #13 19-Jul-2004, 10:41 AM

Not concerned with ISA just at the moment Taz.However, your comments are helpful, so just thanking you for them.

ISA does interest me though, as it concerns the internet, and the nets becoming more and more useful in business use.

I'll probably take it as an elective, but am unsure as yet.
I've got a few certs to get before then, but I'll be sure to bug you when I get around to ISA

**Bluerinse** · #14 20-Jul-2004, 11:39 PM

Thanks for the suggestion Taz!

Quote:

“

Your internal interface could be 192.168.1.1 (trying to keep things simple)

and won't need a default gateway added.

”

I Agree, you should never put a default gateway on the internal interface as ISA takes care of the routing of all IP packets.

In the actual real case scenario my buddy had a dial up connection to the net and only recently got ADSL. I think that is where it all went tits up because we removed the modem and hence broke the original DUN. ISA will not let us remove/delete the original Dial upo entry in ISA management and it will not let us create a dummy one either. Just get an error saying an error occured

So, ISA is stuck in wanting to dial up with no dial up connectoid present.

The thing that confuses me, mainly because I have no experience with ADSL is this PPPoE thing and WinPoet etc etc. I have seen solutions albeit they were not explained very well, stating that to connect ISA to ADSL you need to have PPPoE and some kind of dialer? Can you dismiss these claims Taz? Have I gone off on another tangent and lost my way?

At last a book arrived this morning, Osbournes ISA Server 2000 exam prep. Hopefully that will be an interesting read and not be like the MOC/watching paint dry !

I wish I had this one behind me

Pete

Taz69 · #15 21-Jul-2004, 03:25 AM

I see what you mean about being unable to delete the default Dial-up entry. Looks like plan B now.

Eventhough you cannot delete it you can add a dummy VPN connection to it though.

Then I expect that you will need to diable the Automatic dial out option on any routing rules and also deselect the 'Use Dial Up Entry' on the Firewall Chaining tab under the Network Configuration Properties.

About all that should be left to do is add a static route of 0.0.0.0 mask 0.0.0.0 out of your external NIC toward your ADSL router's internal interface. The PPPoE dialer should be built into your router so that as long as you get the external interface of ISA pointing at your router's internal interface you should be okay.

I know what you mean about wanting to get ISA passed

Eventhough I didn't need ISA for my MCSE I'm still pleased that I took ISA and hopefully alongside Exchange should prove to be very useful.