Publishing a server farm over HTTPS
To publish a server farm over HTTPS
In the Forefront TMG Management console tree, click Firewall Policy.
In the task pane, click the Toolbox tab.
On the Toolbox tab, click Network Objects, click New, and then select Server Farm.
Complete the New Server Farm Wizard as outlined in the following table.
Page Field or property Setting or action Welcome to the New Server Farm Wizard
Server farm name
Type a name for the server farm. For example, type Content Server Farm.
Servers
Servers included in this farm
For each Web server that you want to include in the server farm, click Add. Then, in Server Details, click Browse, and in Enter the object name to select, type the NetBIOS name of the Web server. Click Check Names, click OK, and then click OK again.
Server Farm Connectivity Monitoring
Method used to monitor server farm connectivity
Select the method that Forefront TMG will use to verify connectivity with the Web servers in the server farm. If you select Send an HTTP/HTTPS GET request and you want to specify a URL that differs from the URL that will be set in the Web publishing rule for this server farm, or if you want to specify a custom Host header that differs from the Host header that will be sent based on the Web publishing rule, click Configure, type the URL and HOST header, and then click OK.
Completing the New Server Farm Wizard
Review the settings, and then click Finish.
If a message box appears indicating that the Allow HTTP/HTTPS requests from Forefront TMG to selected servers for connectivity verifiers system policy rule will be enabled, click OK.
On the Toolbox tab, click Network Objects, click New, and then select Web Listener to open the New Web Listener Wizard.
Complete the New Web Listener Wizard as outlined in the following table.
Page Field or property Setting or action Welcome to the New Web Listener Wizard
Web listener name
Type a name for the Web listener. For example, type HTTPS Server Farm Listener.
Client Connection Security
Select Require SSL secured connections with clients.
Web Listener IP Addresses
Listen for incoming Web requests on these networks
Select the External network. Click Select IP Addresses, and then select Specified IP Addresses on the Forefront TMG computer in the selected network. Under Available IP Addresses, select the appropriate IP address, click Add, and then click OK.
Listener SSL Certificates
Select Use a single certificate for this Web listener, click Select Certificate, and then select a certificate for which the host name that users use to access the published Web site appears in the Issued To field.
Authentication Settings
Select how clients will provide credentials to Forefront TMG
For HTTP authentication (the default option), select one or more of the check boxes. In a workgroup deployment, you can select only Basic.
If you want to require clients to provide a certificate, in the drop-down list, select SSL Client Certificate Authentication.
For form-based authentication, in the drop-down list, select HTML Form Authentication.
Collect additional delegation credentials in the form
This check box appears only when HTML Form Authentication is selected.
Select this check box only if you intend to select RADIUS OTP or SecurID.
Select how Forefront TMG will validate client credentials
For HTTP authentication, if you select Basic authentication in a workgroup, you can select LDAP (Active Directory) or RADIUS.
For forms-based authentication, select one of the available options.
Single Sign On Settings
Enable SSO for Web sites published with this listener
Single sign on (SSO) is available only when forms-based authentication is used. If you enable SSO, you must click Add and then specify a domain within which SSO will be applied.
Completing the New Web Listener Wizard
Review the settings, and then click Finish.
In the task pane, click the Tasks tab.
On the Tasks tab, click Publish Web Sites to open the New Web Publishing Rule Wizard.
Complete the New Web Publishing Rule Wizard as outlined in the following table.
Page Field or property Setting or action Welcome to the New Web Publishing Rule Wizard
Web publishing rule name
Type a name for the Web publishing rule. For example, type Server Farm (HTTPS).
Select Rule Action
Action
Select Allow.
Publishing Type
Select Publish a server farm of load balanced Web servers.
Server Connection Security
Select Use SSL to connect the published Web server or Web farm.
Internal Publishing Details (1)
Internal site name
Type the fully qualified domain name (FQDN) of one of the members of the server farm.
Internal Publishing Details (2)
Path (optional)
Type the path for your Web site.
Specify Server Farm
Select the server farm you want to publish
In the drop-down list, select the server farm that you created in step 4.
Select how Forefront TMG will load balance incoming Web requests
Select Cookie-based load balancing.
Public Name Details
Accept requests for
Select This domain name (type below).
Public name
Type the public FQDN or IP address that external users will use to access the published Web site.
Select Web Listener
Web Listener
In the drop-down list, select the Web listener that you created in step 7.
Authentication Delegation
Select the method used by Forefront TMG to authenticate to the published Web server
Select No delegation, and client cannot authenticate directly.
User Sets
This rule applies to requests from the following user sets
Do not change the default option, All Authenticated Users.
Completing the New Web Publishing Rule Wizard
Review the settings, and then click Finish.
In the details pane, click Apply, and then click OK.
Notes
- For more information about server farms, see About server farms.
- For more information about Web listeners, see Web listener overview.
- The internal site name must be resolvable to an IP address.
- Forefront TMG automatically creates a link translation mapping between the internal site name and the first public name specified in the rule. This mapping is used to translate links that use the internal site name to reference the server farm on Web pages and in e-mail messages that external users may receive.
- By default, Forefront TMG changes the original Host header supplied by a browser application to a Host header corresponding to the internal site name.
- When publishing over SSL, an SSL server certificate that was issued to the public host name of the published Web site must be installed in the Personal store for the local computer on the Forefront TMG computer. If the Web publishing rule requires an SSL connection between the Forefront TMG computer and a member of the published server farm, a unique server certificate with a name corresponding to the name or IP address of the server can be installed on each member of the published server farm, or the same certificate with a name corresponding to the internal site name can be installed on all members of the server farm. For more information about obtaining and installing SSL server certificates, see Configuring server certificates for secure Web publishing.
- You can configure the way in which credentials are passed to the published server in a Web publishing rule. For more information, see About delegation of credentials.
- Web publishing rules match incoming client requests to the appropriate Web site on the Web server.
- You can create Web publishing rules that deny traffic, to block incoming traffic that matches the rule conditions.
- Forefront TMG does not treat paths as case-sensitive. If your Web server includes both foldera and folderA, and you publish a path to one of the folders, both folders will be published.
- For more information about other settings in Web publishing rules, see Overview of Web publishing concepts.