Install and configure Forefront TMG 2010 Enterprise Management Server (EMS) for centralized Management—Step by Step

Forefront TMG 2010 provides standard and enterprise version. On an Enterprise version you can deploy Forefront TMG in a single server (standalone deployment) or multiple servers in Enterprise Management Array deployment. In an Enterprise deployment, one TMG server perform as an Enterprise Management Server in an Enterprise Management Array (EMS). And rest of the TMG servers join in that array. A Forefront TMG array is a collection of Forefront TMG servers that are managed centrally, via a single management interface. It provides better management capacity, redundancy, fault tolerance and High Availability in a organisation where HA is calculated by 99.9%. An Array stored following information in Enterprise Management Server.

1. Array configuration settings, which are relevant for, and shared by, all members of the array.
2. Server configuration settings, which are relevant only for a specific array member, for each of the array members.

Standalone—Depending on the selected load balancing method, a standalone array can have up to 50 Forefront TMG servers managed by one of the array members that acts as the array manager; for more information about load balancing. Use this type of array if Forefront TMG is deployed in a single logical location and handles a medium traffic load.

EMS-managed—An EMS-managed array can have up to 200 Forefront TMG arrays, each holding up to 50 Forefront TMG servers, that are managed by an Enterprise Manager Server (EMS). Once you have set up an EMS-managed array, you can replicate its settings and manage up to 15 EMS-managed arrays using the same settings, thus enabling central management of up to 150,000 Forefront TMG servers.

Load balancing Forefront TMG servers in an array

An integrated Network Load Balancing (NLB) Feature is available in Forefront TMG. It enables you to take advantage of the benefits of central management, configuration, maintenance, and troubleshooting, which are not available if you configure NLB directly via the Windows-based NLB tools. Load balancing serves to balance network traffic among array members, so that traffic is optimized across all available servers.

Installation of Forefront TMG 2010 EMS

Check invoke and Click Finish once installation is done.

To assign administrative roles for enterprise administrators

1. In the Forefront TMG Management console, in the tree, click the Enterprise node.

2. On the Tasks tab, click Assign Administrative Roles.

3. On the Assign Roles tab, click the upper Add button. Then, do the following:

1. In Group or User, enter the name of the group or user that will be allowed to access information stored in the local instance of Active Directory Lightweight Directory Services (AD LDS), and monitor arrays in the domain.

2. In Role, select one of the following:

Forefront TMG Enterprise Administrator—Authorizes the specified group or user to perform all administrative tasks in the enterprise and arrays in the domain.

Forefront TMG Enterprise Auditor—Authorizes the specified group or user to perform monitoring tasks, and to view enterprise and array configuration.

4. When you have finished, click OK.

5. In the details pane, click the Apply button, and then click OK.

 

To assign administrative roles for array administrators

1. In the Forefront TMG Management console, in the tree, click the Forefront TMG node.

2. On the Tasks tab, click Assign Administrative Roles.

3. On the Assign Roles tab, click the upper Add button. Then, do the following:

1. In Group or User, enter the name of the group or user that will be allowed to access information stored in the local instance of AD LDS.

2. In Role, select one of the following:

Forefront TMG Array Administrator—Authorizes the specified group or user to perform all administrative tasks in the array.

Forefront TMG Array Auditor—Authorizes the specified group or user to perform all monitoring tasks, and to view the array configuration.

Forefront TMG Array Monitoring Auditor—Authorizes the specified group or user to perform specific monitoring tasks.

4. When you are finished, click OK.

5. In the details pane, click the Apply button, and then click OK.

To enable Microsoft Update and activate licenses

1. In the Forefront TMG Management console, in the tree, click the server name node.
2. On the Tasks tab, click Launch Getting Started Wizard, and then click Define deployment options.
3. On the Microsoft Update Setup page, click Use the Microsoft Update service to check for updates (recommended).
4. On the Forefront TMG Protection Features Settings page, activate licenses for the protection features you want to enable. You can only download and install updated definitions for features that you have enabled.
5. If you activated the Network Inspection System (NIS) license, on the NIS Signature Update Settings page, select the automatic update action you desire.
6. Complete the wizard, and then click Finish. On the Apply Changes bar, click Apply.
7. For WSUS update visit this Link

To Create an Enterprise Array

1. On the EMS, in the Forefront TMG Management console, Right click on Arrays. In the task pane, click New Array.

2. In the New Array Wizard, on the Welcome to the New Array Wizard page, enter the name of the array.

       

3. On the Array DNS Name page, enter the Domain Name System (DNS) of the array.

4. On the Assign Enterprise Policy page, in the Select the Enterprise policy to apply to this new array list, click the enterprise policy to apply to the array.

5. On the Array Policy Rule Types page, select the types of rules that may be created for the array firewall policy.

6. Click Finish and Apply Changes.

Important! All internal networks must be able to ping DNS record mentioned in step3.

To join an enterprise array from second TMG server.

1. In the Forefront TMG Management console, click the server name node.

2. On the Tasks tab, click Join Array.

3. On the Join Membership Type page, click Join an array managed by an EMS server.

     

4. On the Enterprise Management Server Details page, enter the fully qualified domain name (FQDN) of the EMS server, and then click the user account form used to connect to the server.

5. On the Join EMS Managed Array page, select whether to join an existing EMS managed array, or to create a new EMS managed array.

6. If you selected to create a new EMS managed array, on the Create New Array page, enter the details of the new array or Select existing Array, Click next and Click Finish.

Configuring intra-array communication on array members

1. In the Forefront TMG Configuration console, in the tree, expand the ServerName of the array, and then click System.

2. On the Servers tab, select a server, then on the Task tab, click Configure Selected Server.

3. On the Communication tab, on the Intra-Array Communication dialog box, enter the IP address used to communicate with other array members.

Important! Apply changes after every configuration has been done in TMG EMS.

To Configure Network Topology

Forefront TMG supports unlimited network adapters. However, the following network types, you can specify an IP address range or select a network adapter associated with the network you are configuring:

• Internal network
• Perimeter network
• External network

IP addresses for network adapters associated with the same network should be identical on each array member.

Click on Enterprise Networks, Click Create a New Network Wizard or editing a selected network from Taskpad.

 

The list of network adapter settings configured in Windows Server is logged to the Network Adapters tab in the Networking node. You can edit the network adapter settings.

From the Taskpad, Click Create New Network Rule Wizard

   

Further Study:

Configure Forefront TMG 2010 to receive definition update from Windows server update services (WSUS)

Forefront TMG 2010: How to install and configure Forefront TMG 2010 —-Step by step

Forefront TMG 2010: how to install and configure Forefront TMG 2010—Step by step part II

Forefront Protection 2010: how to install and configure Forefront Protection 2010 for Exchange Server 2010—Step by step

Forefront TMG 2010 as an Anti-spam, an Antivirus and a Content Filter systems

Share this