Shulou(Shulou.com)06/01 Report--

Today, I will talk to you about the use of the monitoring function of ISA firewall, which may not be well understood by many people. In order to make you understand better, the editor has summarized the following contents for you. I hope you can get something according to this article.

Recently, the server has been attacked and the traffic has soared. I would like to check the use of ISA Server. I need to turn on the monitoring function. How can I use the monitoring function in the ISA Server firewall?

If it is a LAN computer attack server, you can consider deploying a special LAN network admission control system. For example, there is a "general trend to network admission control system" (download address: http://www.grablan.com/wailaidiannaokongzhi.html), which only needs to be deployed on a local area network computer to prevent local area network computers from accessing the server, prohibit local area network computers from communicating with each other, and detect local area network ARP attacks. Once a computer attack server is found, the communication between the computer and the server can be directly blocked. So as to stop its attack. In addition, the system can also prevent foreign computers from casually accessing the LAN, forbidding LAN computers from changing IP or MAC addresses, detecting the use of LAN wireless routers, prohibiting LAN network sniffing, and so on, so as to protect the security of the LAN network in an all-round way. As shown in the following figure:

In the firewall system based on ISA Server server and Microsoft firewall client, it is very easy to monitor system and network activities. Through the "Monitoring" node in the ISA Server server management window, users can understand the conversation between the ISA server and the firewall client, the service operation of the ISA server, check connectivity, and can query the client's network activity in real time through the log.

Open the ISA Server management window, click the Dashboard tab in the right pane, and you can clearly see the current system and network operation of the ISA Server server in the Dashboard tab. On the Sessions tab, you can learn about the client computers that are currently communicating with the ISA Server server, as shown in the figure.

Dashboard tab

Through the log feature, you can know the network activity of the firewall client like the back of your hand. Users can specify log query conditions by editing the filter. The steps are as follows:

Step 1, open the ISA Server server management window, switch to the Log tab under the Monitoring node, and click the Edit filter hyperlink, as shown in the figure.

Click the Edit filter hyperlink

Step 2, open the "Edit filter" dialog box, select the "client IP" option in the "filter by" drop-down menu, then select the "equal" option in the "condition" drop-down menu, and enter the target firewall client IP address 10.115.223.198 in the "value" edit box, and finally click the "add to list" button. Then select the filter you just created in the Show only items that meet these criteria list and click the start query button, as shown in the figure.

Click the start query button

Step 3, return to the manager window, where you can get the current network activity information of the firewall client in real time in the Log tab, as shown in the figure.

Log tab

After reading the above, do you have any further understanding of how to use the ISA firewall monitoring feature? If you want to know more knowledge or related content, please follow the industry information channel, thank you for your support.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.