Introduction
This article describes how to configure the following new features that are added in Microsoft Forefront Threat Management Gateway (TMG) 2010:
-
HTTPS inspection caching in a forward proxy scenario
-
HTTPS inspection inclusion list
Note The HTTPS inspection inclusion list feature lets you specify the domains that are subjected to HTTPS inspection.
Resolution
By default, these new features are not enabled. To enable these features, follow the steps that are described in the "More Information" section.
Update information
To install the features, install the software update that is described in the following Microsoft Knowledge Base (KB) article:
2498770 Software Update 1 rollup 3 for Forefront Threat Management Gateway (TMG) 2010 Service Pack 1
Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
More Information
For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:
824684 Description of the standard terminology that is used to describe Microsoft software updates
How to enable the features
To enable the new features, follow these steps:
-
Enable HTTPS inspection on the Forefront TMG 2010 arrays.
-
Enable cache on the Forefront TMG 2010 arrays.
-
Create a DomainNameSet variable for inspection and caching on the Forefront TMG 2010 arrays.
-
Create a cache rule that contains this DomainNameSet variable on the Forefront TMG 2010 arrays.
-
Start any text editor program, such as Notepad.
-
Paste the following script into the text editor window.If WScript.Arguments.Count = 0 or WScript.Arguments.Count > 2 Then
WScript.Echo "Usage:" & vbCRLF & _
" ConfigureHTTPSiCaching.vbs <RuleName> <Value> - set value for HTTPS inspection caching VPS on rule" & vbCRLF & _
" ConfigureHTTPSiCaching.vbs <RuleName> - delete HTTPS inspection caching VPS on rule" & vbCRLF
WScript.Quit(1)
End If
GUID = "{864eb995-5315-40d2-934f-6a160dfb3a63}"
Attribute = "CacheHTTPSInspectionContent"
Set Arr = CreateObject("FPC.Root").GetContainingArray()
RuleName = WScript.Arguments(0)
On Error Resume Next
Set CacheRule = Arr.Cache.CacheConfiguration.CacheRules.Item(RuleName)
If Err.Number <> 0 Then
WScript.Echo "Rule " & RuleName & " doesn't exist"
WScript.Quit(1)
End If
Set VendorSets = CacheRule.VendorParametersSets
Set VendorSet = VendorSets.Item( GUID)
If Err.Number <> 0 Then
Err.Clear
Set VendorSet = VendorSets.Add( GUID )
CheckError
WScript.Echo "No existing VendorSet."
Else
WScript.Echo "Existing VendorSet found. Values in it:"
for each name in VendorSet.allNames
WScript.Echo " ", name, "=", VendorSet.Value(name)
next
WScript.Echo "-------------------------------------"
End If
If WScript.Arguments.Count > 1 Then
Val = CInt(WScript.Arguments(1))
WScript.Echo "Setting ", Attribute, " = ", Val
VendorSet.Value(Attribute) = Val
Else
WScript.Echo "Deleting", Attribute
VendorSet.RemoveValue(Attribute)
End If
Arr.Save
Sub CheckError()
If Err.Number <> 0 Then
WScript.Echo "An error occurred: 0x" & Hex(Err.Number) & " " & Err.Description
Err.Clear
End If
End Sub -
Save the file as a Microsoft Visual Basic script file by using the .vbs file name extension. For example, save the file as ConfigureHTTPSiCaching.vbs.
-
Click Start, click Run, type cmd, and then click OK.
-
Use the cd <DirectoryPath> command to change to the directory to where you saved the .vbs file in step 7.
-
Type the following command, and then press ENTER:
ConfigureHTTPSiCaching.vbs <RuleName> -1Note The ConfigureHTTPSiCaching.vbs <RuleName> -1 command enables caching of HTTPS inspection content on an existing cache rule. This command does not create a cache rule or enable the cache.
-
Start any text editor program, such as Notepad.
-
Paste the following script into the text editor window.If WScript.Arguments.Count > 1 Then
WScript.Echo "Usage:" & vbCRLF & _
" ConfigureHTTPSiInclusionList <DomainNameSetName> - add DomainNameSet to HTTPS Inspection inclusion list" & vbCRLF & _
" ConfigureHTTPSiInclusionList - remove DomainnameSet VPS" & vbCRLF
WScript.Quit(1)
End If
GUID = "{da361caa-f5ed-461a-ac23-13a02eec9867}"
Attribute = "InclusionDomainNameSetGUID"
Set Arr = CreateObject("FPC.Root").GetContainingArray()
Set VendorSets = Arr.ArrayPolicy.WebProxy.OutboundHTTPSInspectionConfiguration.VendorParametersSets
On Error Resume Next
if WScript.Arguments.Count > 0 Then
DomainNameSetName = WScript.Arguments(0)
Set DomainNameSet = Arr.RuleElements.DomainNameSets.Item(DomainNameSetName)
If Err.Number <> 0 Then
WScript.Echo "DomainNameSet " & DomainNameSetName & " doesn't exist"
WScript.Quit(1)
End If
End If
Set VendorSet = VendorSets.Item( GUID)
If Err.Number <> 0 Then
Err.Clear
Set VendorSet = VendorSets.Add( GUID )
CheckError
WScript.Echo "No existing VendorSet."
Else
WScript.Echo "Existing VendorSet found. Values in it:"
for each name in VendorSet.allNames
WScript.Echo " ", name, "=", VendorSet.Value(name)
next
WScript.Echo "-------------------------------------"
End If
If WScript.Arguments.Count > 0 Then
Val = DomainNameSet.PersistentName
WScript.Echo "Setting ", Attribute, " = ", Val
VendorSet.Value(Attribute) = Val
Else
WScript.Echo "Deleting", Attribute
VendorSet.RemoveValue(Attribute)
End If
Arr.Save
Sub CheckError()
If Err.Number <> 0 Then
WScript.Echo "An error occurred: 0x" & Hex(Err.Number) & " " & Err.Description
Err.Clear
End If
End Sub -
Save the file as a Microsoft Visual Basic script file by using the .vbs file name extension. For example, save the file as ConfigureHTTPSiInclusionList.vbs.
-
Click Start, click Run, type cmd, and then click OK.
-
Use the cd <DirectoryPath> command to change to the directory to where you saved the .vbs file in step 13.
-
Type the following command, and then press ENTER:
ConfigureHTTPSiInclusionList.vbs <DomainNameSet>Notes
-
The ConfigureHTTPSiInclusionList.vbs <DomainNameSet> command sets the DomainNameSet variable to be in the inclusion list of HTTPS inspection. This command does not create the DomainNameSet variable if the DomainNameSet variable does not exist.
-
Only one DomainNameSet variable is enabled in the inclusion list.
-
This script does not enable HTTPS inspection.
-