Install and configure Forefront TMG 2010 Enterprise Management Server (EMS) for centralized Management—Step by Step


Forefront TMG 2010 provides standard and enterprise version. On an Enterprise version you can deploy Forefront TMG in a single server (standalone deployment) or multiple servers in Enterprise Management Array deployment. In an Enterprise deployment, one TMG server perform as an Enterprise Management Server in an Enterprise Management Array (EMS). And rest of the TMG servers join in that array. A Forefront TMG array is a collection of Forefront TMG servers that are managed centrally, via a single management interface. It provides better management capacity, redundancy, fault tolerance and High Availability in a organisation where HA is calculated by 99.9%. An Array stored following information in Enterprise Management Server.

  1. Array configuration settings, which are relevant for, and shared by, all members of the array.
  2. Server configuration settings, which are relevant only for a specific array member, for each of the array members.

Standalone—Depending on the selected load balancing method, a standalone array can have up to 50 Forefront TMG servers managed by one of the array members that acts as the array manager; for more information about load balancing. Use this type of array if Forefront TMG is deployed in a single logical location and handles a medium traffic load.

EMS-managed—An EMS-managed array can have up to 200 Forefront TMG arrays, each holding up to 50 Forefront TMG servers, that are managed by an Enterprise Manager Server (EMS). Once you have set up an EMS-managed array, you can replicate its settings and manage up to 15 EMS-managed arrays using the same settings, thus enabling central management of up to 150,000 Forefront TMG servers.

Load balancing Forefront TMG servers in an array

An integrated Network Load Balancing (NLB) Feature is available in Forefront TMG. It enables you to take advantage of the benefits of central management, configuration, maintenance, and troubleshooting, which are not available if you configure NLB directly via the Windows-based NLB tools. Load balancing serves to balance network traffic among array members, so that traffic is optimized across all available servers.

Installation of Forefront TMG 2010 EMS

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

20

Check invoke and Click Finish once installation is done.

To assign administrative roles for enterprise administrators

1. In the Forefront TMG Management console, in the tree, click the Enterprise node.

2. On the Tasks tab, click Assign Administrative Roles.

3. On the Assign Roles tab, click the upper Add button. Then, do the following:

1. In Group or User, enter the name of the group or user that will be allowed to access information stored in the local instance of Active Directory Lightweight Directory Services (AD LDS), and monitor arrays in the domain.

2. In Role, select one of the following:

Forefront TMG Enterprise Administrator—Authorizes the specified group or user to perform all administrative tasks in the enterprise and arrays in the domain.

Forefront TMG Enterprise Auditor—Authorizes the specified group or user to perform monitoring tasks, and to view enterprise and array configuration.

4. When you have finished, click OK.

5. In the details pane, click the Apply button, and then click OK.

21

22 

To assign administrative roles for array administrators

1. In the Forefront TMG Management console, in the tree, click the Forefront TMG node.

2. On the Tasks tab, click Assign Administrative Roles.

3. On the Assign Roles tab, click the upper Add button. Then, do the following:

1. In Group or User, enter the name of the group or user that will be allowed to access information stored in the local instance of AD LDS.

2. In Role, select one of the following:

Forefront TMG Array Administrator—Authorizes the specified group or user to perform all administrative tasks in the array.

Forefront TMG Array Auditor—Authorizes the specified group or user to perform all monitoring tasks, and to view the array configuration.

Forefront TMG Array Monitoring Auditor—Authorizes the specified group or user to perform specific monitoring tasks.

4. When you are finished, click OK.

5. In the details pane, click the Apply button, and then click OK.

To enable Microsoft Update and activate licenses

  1. In the Forefront TMG Management console, in the tree, click the server name node.
  2. On the Tasks tab, click Launch Getting Started Wizard, and then click Define deployment options.
  3. On the Microsoft Update Setup page, click Use the Microsoft Update service to check for updates (recommended).
  4. On the Forefront TMG Protection Features Settings page, activate licenses for the protection features you want to enable. You can only download and install updated definitions for features that you have enabled.
  5. If you activated the Network Inspection System (NIS) license, on the NIS Signature Update Settings page, select the automatic update action you desire.
  6. Complete the wizard, and then click Finish. On the Apply Changes bar, click Apply.
  7. For WSUS update visit this Link

To Create an Enterprise Array

1. On the EMS, in the Forefront TMG Management console, Right click on Arrays. In the task pane, click New Array.

35

2. In the New Array Wizard, on the Welcome to the New Array Wizard page, enter the name of the array.

 36      

3. On the Array DNS Name page, enter the Domain Name System (DNS) of the array.

37

4. On the Assign Enterprise Policy page, in the Select the Enterprise policy to apply to this new array list, click the enterprise policy to apply to the array.

38

5. On the Array Policy Rule Types page, select the types of rules that may be created for the array firewall policy.

39

6. Click Finish and Apply Changes.

40

42

41

Important! All internal networks must be able to ping DNS record mentioned in step3.

To join an enterprise array from second TMG server.

1. In the Forefront TMG Management console, click the server name node.

2. On the Tasks tab, click Join Array.

43

3. On the Join Membership Type page, click Join an array managed by an EMS server.

  44 45   

4. On the Enterprise Management Server Details page, enter the fully qualified domain name (FQDN) of the EMS server, and then click the user account form used to connect to the server.

46

5. On the Join EMS Managed Array page, select whether to join an existing EMS managed array, or to create a new EMS managed array.

47

6. If you selected to create a new EMS managed array, on the Create New Array page, enter the details of the new array or Select existing Array, Click next and Click Finish.

48

49

Configuring intra-array communication on array members

1. In the Forefront TMG Configuration console, in the tree, expand the ServerName of the array, and then click System.

2. On the Servers tab, select a server, then on the Task tab, click Configure Selected Server.

3. On the Communication tab, on the Intra-Array Communication dialog box, enter the IP address used to communicate with other array members.

Important! Apply changes after every configuration has been done in TMG EMS.

To Configure Network Topology

Forefront TMG supports unlimited network adapters. However, the following network types, you can specify an IP address range or select a network adapter associated with the network you are configuring:

  • Internal network
  • Perimeter network
  • External network

IP addresses for network adapters associated with the same network should be identical on each array member.

Click on Enterprise Networks, Click Create a New Network Wizard or editing a selected network from Taskpad.

 23 24 25 26

27

The list of network adapter settings configured in Windows Server is logged to the Network Adapters tab in the Networking node. You can edit the network adapter settings.

From the Taskpad, Click Create New Network Rule Wizard

  28  30

29

31 32 33

34

Further Study:

Configure Forefront TMG 2010 to receive definition update from Windows server update services (WSUS)

Forefront TMG 2010: How to install and configure Forefront TMG 2010 —-Step by step

Forefront TMG 2010: how to install and configure Forefront TMG 2010—Step by step part II

Forefront Protection 2010: how to install and configure Forefront Protection 2010 for Exchange Server 2010—Step by step

Forefront TMG 2010 as an Anti-spam, an Antivirus and a Content Filter systems

Share thisAdd to FacebookAdd to DiggAdd to Del.icio.usAdd to StumbleuponAdd to RedditAdd to BlinklistAdd to TwitterAdd to TechnoratiAdd to Yahoo BuzzAdd to Newsvine

About Raihan Al-Beruni

My Name is Raihan Al-Beruni. I am working as an Infrastructure Architect in Data Center Technologies in Perth, Western Australia. I have been working on Microsoft technologies for more than 15 years. Other than Microsoft technologies I also work on Citrix validated solution and VMware data center virtualization technologies. I have a Masters degree in E-Commerce. I am certified in Microsoft, VMware, ITIL and EMC. My core focus is on cloud technologies. In my blog I share my knowledge and experience to enrich information technology community as a whole. I hope my contribution through this blog will help someone who wants more information on data center technologies.
This entry was posted in Windows Server and tagged , . Bookmark the permalink.

26 Responses to Install and configure Forefront TMG 2010 Enterprise Management Server (EMS) for centralized Management—Step by Step

  1. Pingback: Install and configure Forefront TMG 2010 Enterprise Management Server (EMS) for centralized Management (part II)—Step by Step « Information Technology Blog

  2. Eric says:

    Hi,

    I need your help about installation and configuration of Forefront TMG 2010 fot the edge topology. I have some problems to do it. And, i can’t see the step by step document guide about the installation and configuration of the edge topology.
    can i call you? my phone number is…+241-05-300-272

    Like

  3. Junaid Ahmed says:

    Dear Rehan,

    How to configure EMS replica Server and how to monitor the replication of configuration storage.
    I have added the new EMS server’s IP in “Replicate CCS Server” group and installed the 2nd EMS server with the option to copy its configuration from 1st EMS server. Is here anything else i need to configure??
    And how to check whether the replication between both the EMS is fine??

    Like

  4. Junaid Ahmed says:

    Actually what putting me in confusion is that I can not see the Enterprise Array on the new EMS Server.

    Like

  5. Kashif Noor says:

    AoA,
    I have downloaded Microsoft ForeFront TMG Enterprise Edition from Microsoft website, when the installer is begin it show the error messege “Package Integrity distribution”…. Please help me regarding this error.
    Note: I am running Windows 2008 server on my Server machine(DELL PowerEdge 2600).

    Like

  6. Pierre says:

    Hi Rihan,

    Thanks for this great article. I just have a (maybe silly ?) question. I have created the EMS array and joined my second TMG into that array. When I created the array, I have to specify a DNS record, which will be used by client for proxy address. But what IP should be resolved by this DNS record ? The EMS Server ? A round robin with all my TMG Array members ?

    Thanks in advance for ou answer.

    BR

    Like

    • Pierre says:

      Ok Rihan,

      I just found the answer, I had to go in network configuration and enable NLB on my internal Networks.If I make a persistant ping on my cluster IP, I got answer (regardin mac adress, its the second TMG which is answering). If I disconnect the second TMG, I would believe that the first TMG would handle the trafic. Actually, not 🙂
      When I look in Array> Systems, I can only see TMG2.

      So my question is : The EMS Server is only han only a centralized configuration role and not a TMG role ? If I want to have a redondancy, shall I have 3 TMG Servers ? 1 EMS and 2 TMG integrated in the array ?

      BR,
      Pierre

      Like

  7. Edward says:

    thanks Raihan but please i need your help regarding how to configure NLB over TMG , awaiting your response…

    Like

  8. glen says:

    Hi Raihan,

    First of all thanks for your site, this is very helpful for me as i am doing my small Laboratory to test the TMG. I just want to know on how to integrate my AD Domain Controller to my TMG server. Can you please help me the step by step by procedure to perform this task. The scenario is i have 1 AD server and 1 client PC. please help!!

    regards,

    glen

    Like

  9. Mike F says:

    Where can i find instructions for NLB with a standalone array? i am unable to find the setup instruction for the noda that will be joining the array.

    Like

  10. BrianWelch says:

    Is it possible to install the Enterprise Management Server on a server that will also be a member of the array? I cannot seem to locate where to add in the local server into the array. Thanks!

    Like

  11. Ksrini says:

    Nice Blog thank us for sharing information about the TMG issue .
    We have an issue with NLB getting error ( RPC services unavailable) while join host another array node server
    we have 2 TMG nodes and 1 EMS server both 2 nodes have been successfully joined to EMS array ,I am trying to enable NLB for both nodes in TMG console and i have enabled and check the NLB manage the another node has not join to cluster RPC error
    As i was go through the comments in the blog NLB manager is not required to manager but when i enabled NLB in TMG console its trying to add using NLB manager and getting error (RPC service )
    Workaround :
    I disabled RPC filter in Enterprise and system array and get re- solved the RPC error but when i disabled RPC error both nodes getting configuration error in EMS server not sync
    could you please provide more details how we need to work with NLB

    Like

  12. Arsalan Zia says:

    Dear Raihan,

    Its Arsalan I am an IT Officer, Sir I am having some issue in TMG I have one external NIC (Public IP from ISP) & one internal NIC (Private IP for local LAN) my TMG 2010 can ping another Public IP of my sister company but my clients can’t ping or connect with the same. Sir I want to connect with my sister company through VPN because some of our servers installed in my sister company Data Center, but after deploying TMG 2010 I am unable to do that please help me out in this issue I will be thankful to you.

    Regards,
    Arsalan Zia
    IT Officer.

    Like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s