Deploying a Secure Commerce Server 2002 Site

July 2002

This whitepaper provides detailed instructions for deploying Microsoft® Commerce Server 2002 in a secure configuration. These instructions assume you are performing a new deployment, and therefore instruct you to install and configure each server in this sample deployment. It is recommended that you use these instructions as a guideline for deploying your own secure site.

For this sample secure deployment, you must perform the procedures in the order in which they are listed.

This whitepaper contains:

  • Overview of the Sample Secure Deployment
  • Setting Up Firewalls and Ports for a Secure Deployment
  • Installing the Base Platform
  • Configuring IP Addresses and DNS Entries for a Secure Deployment
  • Configuring the Network Connections
  • Wiring the Network
  • Installing the ISA Servers
  • Configuring the ISA Servers
  • Installing the Domain Controllers
  • Joining the Servers to Domains
  • Configuring the Domain Controllers
  • Installing and Configuring the SQL Servers
  • Installing Commerce Server
  • Configuring the Business Desk Client Computer
  • Configuring the Web Server
  • Installing the Microsoft Security Tools on the Web Server
  • Securing the Commerce Server Components
  • Completing Wiring the Network

Copyright © 2002 Microsoft Corporation.
All rights reserved.


Overview of the Sample Secure Deployment

The following figure shows a sample ten-computer configuration. Nine computers are servers and one computer is a client. The names in parenthesis, such as (ISA1), show the computer names that are used throughout this sample secure deployment. Detailed instructions follow that describe how to install and configure this sample secure deployment.

Note It is recommended that you use a three-tier deployment regardless of whether you are using SQL Authentication or Microsoft® Windows® Authentication to secure your Commerce Server databases.

This sample secure deployment is organized into the following three tiers, each of which uses a Microsoft Internet Security and Acceleration (ISA) Server 2000 server:

  • Presentation Tier. The presentation tier receives all incoming client requests from the Internet. This tier contains your Commerce Server 2002 Solution site, which runs on a Microsoft Internet Information Services (IIS) Web server named Web1. The Windows 2000 domain controller, named DC1, stores user credentials for members of the Adatum.com domain, which is a registered Microsoft domain. An ISA server, named ISA1, is used as a firewall to protect the presentation tier from the Internet.
  • Data Tier. Two Microsoft® SQL Server™ 2000 servers, named SQL1 and SQL2, host the Commerce Server 2002 run-time databases and the Commerce Server Data Warehouse respectively. The server named Commerce1 runs Microsoft Commerce Server 2002 and the Business Desk application. The Windows 2000 domain controller, named DC2, stores user credentials for members of the Contoso.com domain, which is a registered Microsoft domain. An ISA server, named ISA2, is used as a firewall to protect the data tier from the presentation tier.
  • Corporate LAN Tier. This tier contains a client computer on which the Business Desk client application is installed. The Corporate LAN tier is used for accessing Commerce Server 2002 Business Desk. An ISA server, named ISA3, is used as a firewall to protect the data tier from the Corporate LAN tier.

Switches are used in this sample secure deployment to connect the computers and firewalls. These switches do not provide routing and do not have IP addresses. You can use switches or routers in your own secure deployment.

The following table lists each computer shown in the sample secure deployment figure, describes its function, and lists the domain in which the computer is a member.

Computer | Computer name | Description | Domain
ISA Server | ISA1 | Firewall between the Internet and presentation tier. | (See Note)
ISA Server | ISA2 | Firewall between the presentation tier and data tier. | (See Note)
ISA Server | ISA3 | Firewall between the data tier and Corporate LAN tier. | (See Note)
Web server | Web1 | Web server hosting the Commerce Server Solution Site. | Contoso.com
Domain controller | DC1 | Domain controller (Contoso.com) for the presentation tier. | (See Note)
Domain controller | DC2 | Domain controller (Adatum.com) for the data tier. | (See Note)
Commerce Server components and Business Desk application | Commerce1 | Commerce Server 2002 components and the Business Desk application. | Adatum.com
SQL Server | SQL1 | Commerce Server 2002 runtime databases. | Adatum.com
SQL Server | SQL2 | Data Warehouse database. | Adatum.com
Business Desk client | Client1 | Computer with Business Desk client software installed. | Adatum.com
Note Do not join this computer to a domain. This computer should be a member of a workgroup only.


Setting Up Firewalls and Ports for a Secure Deployment

The following table lists the services and ports needed to support this sample secure deployment. The Direction (Inbound or Outbound) is the direction of traffic that you specify in Microsoft Internet Security and Acceleration (ISA) Server 2000. Detailed instructions for configuring the ISA servers are provided in the Configuring the ISA Servers section. Use the following table as a guide for configuring your own secure deployment.

Data Tier - ISA Firewall named ISA2

Note You can configure DTC to communicate through firewalls. When you configure DTC, it is recommended that you open ports 5000 and up, and that you open a minimum of 15 to 20 ports.
Services | Protocol Type | Port(s) | Direction
HTTP | TCP | 80 | Outbound
HTTPS | TCP | 443 | Outbound
RPC port mapper | TCP | 135 | Outbound
RPC port mapper | TCP | 135 | Inbound
DTC | TCP | 5000-5030 | Outbound
DTC | TCP | 53 | Outbound
DTC | TCP | 53 | Inbound
DTC | UDP | 53 | Send–Receive
DTC | TCP | 389 | Outbound
DTC | UDP | 389 | Send–Receive
DTC | UDP | 389 | Receive–Send
DTC | TCP | 445 | Outbound
DTC | TCP | 445 | Inbound
DTC | UDP | 445 | Send–Receive
DTC | UDP | 445 | Receive–Send
DTC | TCP | 65432 | Outbound


Installing the Base Platform

The base platform is installed on all nine servers in this sample secure deployment, and is the same for each server in the deployment. You can install the client computer using Windows 9X, or Windows 2000 or later. However, it is recommended that you use Windows 2000 or later for a more secure deployment.

Note It is recommended that you install the software for your base platform from a CD when possible. This will help you avoid virus attacks and malicious user attacks that may occur before the latest service pack and applicable service roll-up package is installed.
Note Do not connect any computers to the network until instructed. Connecting computers to the network before you finish installing the base platform poses a severe security risk and exposes your computers to virus attacks.

You must install the software for the base platform in the order shown:

  1. Install Windows 2000 Advanced Server using the Default installation. Note the following:

    Use only alphanumeric characters for the computer name. The computer names used in this sample secure deployment are provided in the Computer names column, in the table in Overview of the Sample Secure Deployment.

    • Format the partition with Windows NTFS file system for Windows 2000 installations.
    • Ensure that Internet Information Services (IIS) and Indexing Service are not selected in the Windows 2000 Components screen on all servers except Web1 and Commerce1.
      Important For performance and security reasons, it is recommended that you install Internet Information Services (IIS) 5.0 only on the Web server and Business Desk server.
    • Do not join any computers to a domain at this time.
  2. Install Windows 2000 Service Pack 2 (SP2).

    Windows service packs can be downloaded from the Microsoft Downloads page.

  3. Install the Windows 2000 Security Rollup Package 1 (SRP1)

    Windows 2000 SRP1 includes all security updates that have been delivered since Windows 2000 SP2. You can download SRP1 from Windows 2000 Home. For more information about Windows 2000 SRP1, including a list of security fixes, see Microsoft Product Support Services.


Configuring IP Addresses and DNS Entries for a Secure Deployment

The tables in this section list the IP addresses and Domain Name Service (DNS) entries used in this sample secure deployment. Use static IP addresses, not dynamic IP addresses, for all servers. You do not have to use the same IP addresses in your own secure deployment, however, it is recommended that you use a non-routable IP range for your presentation and data tiers. You define the non-routable IP range when configuring your ISA servers in Configuring the ISA Servers.

In this sample secure deployment, you use the Class A octet as the non-routable IP range. For example, in the IP address 10.20.30.40, 10 is the Class A octet. Any IP address that starts with 10 is considered a private IP address and is not used for Internet routing. If a request penetrates your firewall with a different IP address it will be discarded.

The tables in this section show the default gateway, which is the IP address that your computer uses when a request is submitted. When the sending computer cannot determine where to route a request, it sends the request to the default gateway. The default gateway is either a router or a computer with a routing table, which directs requests to the appropriate subnet, also referred to as a tier.

In this deployment example, the default gateway of a particular server is the IP address of the server that contains the routing table for a particular tier. For example, the default gateway for the Web server, named Web1, is the IP address of the server named ISA2, because the ISA2 server routes requests between the presentation and data tiers.

The tables in this section list the IP addresses used for each server in this sample secure deployment. These IP addresses are used throughout this sample secure deployment.

Presentation Tier

Server | Network Adapter | Connection Name | IP Address | Subnet Mask | Default Gateway | Primary DNS Server | Secondary DNS Server
ISA1 | 1 | ISP | See the following note. | See the following note. | See the following note. | See the following note. | See the following note.
ISA1 | 2 | Switch1 | 10.200.200.98 | 255.255.255.0 | Leave blank | 10.200.200.100 Primary | Leave blank.
Web1 | 1 | Switch1 | 10.200.200.99 | 255.255.255.0 | 10.200.200.97 | 10.200.200.100 | Leave blank.
DC1 | 1 | Switch1 | 10.200.200.100 | 255.255.255.0 | 10.200.200.97 | 10.200.200.100 | Leave blank.
Note Your Internet Service Provider (ISP) provides the IP address information for Network Adapter 1 of the server named ISA1. This IP address must be static, not dynamic.

Data Tier

Server | Network Adapter | Connection Name | IP Address | Subnet Mask | Default Gateway | Primary DNS Server | Secondary DNS Server
ISA2 | 1 | Switch1 | 10.200.200.97 | 255.255.255.0 | Leave blank. | Leave blank. | Leave blank.
ISA2 | 2 | Switch2 | 10.100.100.99 | 255.255.255.0 | Leave blank. | Leave blank. | Leave blank.
DC2 | 1 | Switch2 | 10.100.100.100 | 255.255.255.0 | 10.100.100.99 | 10.100.100.100 | Leave blank.
Commerce1 | 1 | Switch2 | 10.100.100.102 | 255.255.255.0 | Leave blank. | 10.100.100.100 | Leave blank.
SQL1 | 1 | Switch2 | 10.100.100.103 | 255.255.255.0 | 10.100.100.99 | 10.100.100.100 | Leave blank.
SQL2 | 1 | Switch2 | 10.100.100.101 | 255.255.255.0 | 10.100.100.99 | 10.100.100.100 | Leave blank.

Corporate LAN Tier

Server | Network Adapter | Connection Name | IP Address | Subnet Mask | Default Gateway | Primary DNS Server | Secondary DNS Server
ISA3 | 1 | Switch2 | 10.100.100.98 | 255.255.255.0 | Leave blank. | Leave blank. | Leave blank.
ISA3 | 2 | Switch3 | See Note. | See Note. | See Note. | See Note. | See Note.
Client1 | 1 | Switch3 | See Note. | See Note. | See Note. | See Note. | See Note.

Note The system administrator of your Corporate LAN provides the IP address information for Network Adapter 2 in the server named ISA3, and Network Adapter 1 in the server named Client1. These IP addresses must be static IP addresses, not dynamic addresses.


Configuring the Network Connections

After you have installed the base platform, you can configure the network connections for your network adapters. This section describes how to rename your network connection names and how to configure the IP addresses and Domain Name Service (DNS) entries for these connections. The IP addresses and DNS entries used in this sample secure deployment are shown in IP Addresses and DNS Entries for a Secure Deployment.

For detailed instructions about IP addresses and DNS, see "Configure TCP/IP to use DNS" and "Configure TCP/IP to use WINS" in Windows 2000 Server Help. For additional information about networking, see the Microsoft Windows 2000 Server Resource Kit, available at http://go.microsoft.com/fwlink/?LinkId=6684.

This section contains:

  • Configuring the Network Connections for ISA1
  • Configuring the Network Connection for Web1
  • Configuring the Network Connection for DC1
  • Configuring the Network Connections for ISA2
  • Configuring the Network Connection for DC2
  • Configuring the Network Connection for Commerce1
  • Configuring the Network Connection for SQL1
  • Configuring the Network Connection for SQL2
  • Configuring the Network Connections for ISA3
  • Configuring the Network Connection for Client1


Configuring the Network Connections for ISA1

The presentation tier Microsoft Internet Security and Acceleration (ISA) Server, named ISA1, requires two network adapters. These adapters are:

  • A network adapter to communicate with the Internet.
  • A network adapter to communicate with the data tier through switch 1.
Important Do not wire the network adapter 1 from the presentation tier ISA server named ISA1 to the Internet at this time. To prevent Internet users from accessing your network before it is secured, leave this network adapter disconnected from the Internet. If you connect the ISA1 network card to the Internet before your network is secured, it poses a severe security threat to your network. You will connect the ISA1 network card to the Internet (using a network cable) in the last step of deploying your secure site, in the Completing Wiring the Network section.

To ease management tasks, it is recommended that you rename the connection for the network adapters according to their use. In this example, the network adapter that will connect to the Internet is renamed ISP, and the network adapter that will connect to Switch1 is renamed Switch1.

To rename the ISA1 network adapters

To set the ISA1 TCP/IP properties of the ISP network adapter

To set the ISA1 TCP/IP properties of the Switch1 network adapter

To rename the ISA1 network adapters

  1. On the desktop, right-click My Network Places, and then click Properties.
  2. In the Network and Dial-up Connections screen, right-click the network connection that will connect to the Internet, and then click Rename.
  3. Type ISP, and then press ENTER.

    The first network adapter is renamed ISP.

  4. In the Network and Dial-up Connections screen, right-click the network connection that will connect to Switch1, and then click Rename.
  5. Type Switch1, and then press ENTER.

    The second adapter is renamed Switch1.

To set the ISA1 TCP/IP properties of the ISP network adapter

  1. In the Network and Dial-up Connections screen, right-click ISP and then click Properties.
  2. In the ISP Properties dialog box, in the Components checked are used by this connection section, scroll down and select Internet Protocol (TCP/IP), and then click Properties.
  3. In the Internet Protocol (TCP/IP) Properties dialog box, on the General tab, select Use the following IP address, and then do the following:
    Use this | To do this
    IP address | Type the static IP address provided by your ISP.
    Subnet mask | Type the subnet mask provided by your ISP.
    Default gateway | Type the default gateway provided by your ISP.
  4. Select Use the following DNS server addresses, and then do the following:
    Use this | To do this
    Preferred DNS server | Type the preferred DNS server IP address provided by your ISP.
    Alternate DNS server | Type the secondary DNS server IP address provided by your ISP.
  5. To close the Internet Protocol (TCP/IP) Properties dialog box, click OK.
  6. To close the ISP Properties dialog box, click OK.

The ISA1 TCP/IP properties of the network adapter named ISP are set.

To set the TCP/IP properties of the Switch1 network adapter

  1. In the Network and Dial-up Connections screen, right-click Switch1, and then click Properties.
  2. In the Switch1 Properties dialog box, in the Components checked are used by this connection section, select Internet Protocol (TCP/IP), and then click Properties.
  3. In the Internet Protocol (TCP/IP) Properties dialog box, on the General tab, select Use the following IP address, and then do the following:
    Use this | To do this
    IP address | Type 10.200.200.98.
    Subnet mask | Type 255.255.255.0.
    Default gateway | Leave this box blank.
  4. Select Use the following DNS server addresses, and then do the following:
    Use this | To do this
    Preferred DNS server | Type 10.200.200.100.
    Alternate DNS server | Leave this box blank.
  5. To close the Internet Protocol (TCP/IP) Properties dialog box, click OK.
  6. To close the Switch1 Properties dialog box, click OK.
  7. To apply these configuration settings you must restart this computer.

The TCP/IP properties of the network adapter named Switch1 are set.


Configuring the Network Connection for Web1

The presentation tier Web server, named Web1, requires one network adapter for communication with the presentation tier through Switch1.

It is recommended that you rename the connection for the network adapter according to its use. In this example, the network adapter is renamed Switch1.

To rename the Web1 network adapter

To set the Web1 TCP/IP properties of the Switch1 network adapter

To rename the Web1 network adapter

  1. On the desktop, right-click My Network Places, and then click Properties.
  2. In the Network and Dial-up Connections screen, right-click the network connection that will connect to Switch1, and then click Rename.
  3. Type Switch1, and then press ENTER.

The network adapter is renamed Switch1.

To set the Web1 TCP/IP properties of the Switch1 network adapter

  1. In the Network and Dial-up Connections screen, right-click Switch1, and then click Properties.
  2. In the Switch1 Properties dialog box, in the Components checked are used by this connection section, select Internet Protocol (TCP/IP), and then click Properties.
  3. In the Internet Protocol (TCP/IP) Properties dialog box, on the General tab, select Use the following IP address, and then do the following:
    Use this | To do this
    IP address | Type 10.200.200.99.
    Subnet mask | Type 255.255.255.0.
    Default gateway | Type 10.200.200.97.
  4. Select Use the following DNS server addresses, and then do the following:
    Use this | To do this
    Preferred DNS server | Type 10.200.200.100.
    Alternate DNS server | Leave this box blank.
  5. To close the Internet Protocol (TCP/IP) Properties dialog box, click OK.
  6. To close the Switch1 Properties dialog box, click OK.
  7. To apply these configuration settings you must reboot this server.

The TCP/IP properties of the network adapter named Switch1 are set.


Configuring the Network Connection for DC1

The presentation tier domain controller, named DC1, requires one network adapter for communication with the presentation tier through Switch1.

It is recommended that you rename the connection for the network adapter according to its use. In this example, the network adapter is renamed Switch1.

To rename the DC1 network adapter

To set the DC1 TCP/IP properties of the Switch1 network adapter

To rename the DC1 network adapter

  1. On the desktop, right-click My Network Places, and then click Properties.
  2. In the Network and Dial-up Connections screen, right-click the network connection that will connect to Switch1, and then click Rename.
  3. Type Switch1, and then press ENTER.

The DC1 network adapter is renamed Switch1.

To set the DC1 TCP/IP properties of the Switch1 network adapter

  1. In the Network and Dial-up Connections screen, right-click Switch1 and then click Properties.
  2. In the Switch1 Properties dialog box, in the Components checked are used by this connection section, select Internet Protocol (TCP/IP), and then click Properties.
  3. In the Internet Protocol (TCP/IP) Properties dialog box, on the General tab, select Use the following IP address, and then do the following:
    Use this | To do this
    IP address | Type 10.200.200.100.
    Subnet mask | Type 255.255.255.0.
    Default gateway | Type 10.200.200.97.
  4. Select Use the following DNS server addresses, and then do the following:
    Use this | To do this
    Preferred DNS server | Type 10.200.200.100.
    Alternate DNS server | Leave this box blank.
    Note You will configure the Preferred DNS server address after this computer is configured as a domain controller.
  5. To close the Internet Protocol (TCP/IP) Properties dialog box, click OK.
  6. To close the Switch1 Properties dialog box, click OK.
  7. To apply these configuration settings you must reboot this server.

The TCP/IP properties of the network adapter named Switch1 are set.


Configuring the Network Connections for ISA2

The data tier Microsoft Internet Security and Acceleration (ISA) Server, named ISA2, requires two network adapters:

  • A network adapter to communicate with the presentation tier through Switch1.
  • A network adapter to communicate with the data tier through Switch2.

It is recommended that you rename the connections for the network adapters according to their use. In this example, the network adapter that will connect to Switch1 is renamed Switch1, and the network adapter that will connect to Switch2 is renamed Switch2.

To rename the ISA2 network adapters

To set the ISA2 TCP/IP properties of the Switch1 network adapter

To set the ISA2 TCP/IP properties of the Switch2 network adapter

To rename the ISA2 network adapters

  1. On the desktop, right-click My Network Places, and then click Properties.
  2. In the Network and Dial-up Connections screen, right-click the network connection that will connect to Switch1, and then click Rename.
  3. Type Switch1, and then press ENTER.

    The ISA2 network adapter that will connect to Switch1 is renamed Switch1.

  4. In the Network and Dial-up Connections screen, right-click the network connection that will connect to Switch2, and then click Rename.
  5. Type Switch2, and then press ENTER.

The ISA2 network adapter that will connect to Switch2 is renamed Switch2.

To set the ISA2 TCP/IP properties of the Switch1 network adapter

  1. In the Network and Dial-up Connections screen, right-click Switch1, and then click Properties.
  2. In the ISP Properties dialog box, in the Components checked are used by this connection section, select Internet Protocol (TCP/IP), and then click Properties.
  3. In the Internet Protocol (TCP/IP) Properties dialog box, on the General tab, select Use the following IP address, and then do the following:
    Use this | To do this
    IP address | Type 10.200.200.97.
    Subnet mask | Type 255.255.255.0.
    Default gateway | Leave this box blank.
  4. Select Use the following DNS server addresses, and then do the following:
    Use this | To do this
    Preferred DNS server | Leave this box blank.
    Alternate DNS server | Leave this box blank.
  5. To close the Internet Protocol (TCP/IP) Properties dialog box, click OK.
  6. To close the Switch1 Properties dialog box, click OK.

The TCP/IP properties of the network adapter named Switch1 are set.

To set the ISA2 TCP/IP properties of the Switch2 network adapter

  1. In the Network and Dial-up Connections screen, right-click Switch2 and then click Properties.
  2. In the Switch2 Properties dialog box, in the Components checked are used by this connection section, select Internet Protocol (TCP/IP), and then click Properties.
  3. In the Internet Protocol (TCP/IP) Properties dialog box, on the General tab, select Use the following IP address, and then do the following:
    Use this | To do this
    IP address | Type 10.100.100.99.
    Subnet mask | Type 255.255.255.0.
    Default gateway | Leave this box blank.
  4. Select Use the following DNS server addresses, and then do the following:
    Use this | To do this
    Preferred DNS server | Leave this box blank.
    Alternate DNS server | Leave this box blank.
  5. To close the Internet Protocol (TCP/IP) Properties dialog box, click OK.
  6. To close the Switch2 Properties dialog box, click OK.
  7. To apply these configuration settings you must restart this computer.

The TCP/IP properties of the network adapter named Switch2 are set.


Configuring the Network Connection for DC2

The data tier domain controller, named DC2, requires one network adapter for communication with the data tier through Switch2.

It is recommended that you rename the connection for the network adapter according to its use. In this example, the network adapter is renamed Switch2.

To rename the DC2 network adapter

To set the DC2 TCP/IP properties of the Switch2 network adapter

To rename the DC2 network adapter

  1. On the desktop, right-click My Network Places, and then click Properties.
  2. In the Network and Dial-up Connections screen, right-click the network connection that will connect to Switch2, and then click Rename.
  3. Type Switch2, and then press ENTER.

The DC2 network adapter is renamed Switch2.

To set the DC2 TCP/IP properties of the Switch2 network adapter

  1. In the Network and Dial-up Connections screen, right-click Switch2, and then click Properties.
  2. In the Switch2 Properties dialog box, in the Components checked are used by this connection section, select Internet Protocol (TCP/IP), and then click Properties.
  3. In the Internet Protocol (TCP/IP) Properties dialog box, on the General tab, select Use the following IP address, and then do the following:
    Use this | To do this
    IP address | Type 10.100.100.100.
    Subnet mask | Type 255.255.255.0.
    Default gateway | Type 10.100.100.99.
  4. Select Use the following DNS server addresses, and then do the following:
    Use this | To do this
    Preferred DNS server | Type 10.100.100.100.
    Alternate DNS server | Leave this box blank.
    Note You will configure the preferred DNS server address after this computer is configured as a domain controller.
  5. To close the Internet Protocol (TCP/IP) Properties dialog box, click OK.
  6. To close the Switch2 Properties dialog box, click OK.
  7. To apply these configuration settings you must reboot this server.

The TCP/IP properties of the network adapter named Switch2 are set.


Configuring the Network Connection for Commerce1

The data tier Commerce Server, named Commerce1, requires one network adapter for communication with the data tier through Switch2.

It is recommended that you rename the connection for the network adapter according to its use. In this example, the network adapter is renamed Switch2.

To rename the Commerce1 network adapter

To set the Commerce1 TCP/IP properties of the Switch2 network adapter

To rename the Commerce1 network adapter

  1. On the desktop, right-click My Network Places, and then click Properties.
  2. In the Network and Dial-up Connections screen, right-click the network connection that will connect to Switch2, and click Rename.
  3. Type Switch2, and then press ENTER.

The network adapter for Commerce1 is renamed Switch2.

To set the Commerce1 TCP/IP properties of the Switch2 network adapter

  1. In the Network and Dial-up Connections screen, right-click Switch2 and then click Properties.
  2. In the Switch2 Properties dialog box, in the Components checked are used by this connection section, select Internet Protocol (TCP/IP), and then click Properties.
  3. In the Internet Protocol (TCP/IP) Properties dialog box, on the General tab, select Use the following IP address, and then do the following:
    Use this | To do this
    IP address | Type 10.100.100.102.
    Subnet mask | Type 255.255.255.0.
    Default gateway | Leave this box blank.
  4. Select Use the following DNS server addresses, and then do the following:
    Use this | To do this
    Preferred DNS server | Type 10.100.100.100.
    Alternate DNS server | Leave this box blank.
  5. To close the Internet Protocol (TCP/IP) Properties dialog box, click OK.
  6. To close the Switch2 Properties dialog box, click OK.
  7. To apply these configuration settings you must reboot this server.

The TCP/IP properties of the network adapter name Switch2 are set.


Configuring the Network Connection for SQL1

The data tier SQL server, named SQL1, requires one network adapter for communication with the data tier through Switch2.

It is recommended that you rename the connection for the network adapter according to its use. In this example, the network adapter is renamed Switch2.

To rename the SQL1 network adapter

To set the SQL1 TCP/IP properties of the Switch2 network adapter

To rename the SQL1 network adapter

  1. On the desktop, right-click My Network Places, and then click Properties.
  2. In the Network and Dial-up Connections screen, right-click the network connection that will connect to Switch2, and click Rename.
  3. Type Switch2, and then press ENTER.

The SQL1 network adapter is renamed Switch2.

To set the SQL1 TCP/IP properties of the Switch2 network adapter

  1. In the Network and Dial-up Connections screen, right-click Switch2, and then click Properties.
  2. In the Switch2 Properties dialog box, in the Components checked are used by this connection section, select Internet Protocol (TCP/IP), and then click Properties.
  3. In the Internet Protocol (TCP/IP) Properties dialog box, on the General tab, select Use the following IP address, and then do the following:
    Use this | To do this
    IP address | Type 10.100.100.103.
    Subnet mask | Type 255.255.255.0.
    Default gateway | Type 10.100.100.99.
  4. Select Use the following DNS server addresses, and then do the following:
    Use this | To do this
    Preferred DNS server | Type 10.100.100.100.
    Alternate DNS server | Leave this box blank.
  5. To close the Internet Protocol (TCP/IP) Properties dialog box, click OK.
  6. To close the Switch2 Properties dialog box, click OK.
  7. To apply these configuration settings you must reboot this server.

The TCP/IP properties are set for the network adapter named Switch2.


Configuring the Network Connection for SQL2

The data tier SQL server, named SQL2, requires one network adapter for communication with the data tier through Switch2.

It is recommended that you rename the connection for the network adapter according to its use. In this example, the network adapter is renamed Switch2.

To rename the SQL2 network adapter

To set the SQL2 TCP/IP properties of the Switch2 network adapter

To rename the SQL2 network adapter

  1. On the desktop, right-click My Network Places, and then click Properties.
  2. In the Network and Dial-up Connections screen, right-click the network connection that will connect to Switch2, and click Rename.
  3. Type Switch2, and then press ENTER.

The SQL2 network adapter is renamed Switch2.

To set the SQL2 TCP/IP properties of the Switch2 network adapter

  1. In the Network and Dial-up Connections screen, right-click Switch2, and then click Properties.
  2. In the Switch2 Properties dialog box, in the Components checked are used by this connection section, select Internet Protocol (TCP/IP), and then click Properties.
  3. In the Internet Protocol (TCP/IP) Properties dialog box, on the General tab, select Use the following IP address, and then do the following:
    Use this | To do this
    IP address | Type 10.100.100.101.
    Subnet mask | Type 255.255.255.0.
    Default gateway | Type 10.100.100.99.
  4. Select Use the following DNS server addresses, and then do the following:
    Use this | To do this
    Preferred DNS server | Type 10.100.100.100.
    Alternate DNS server | Leave this box blank.
  5. To close the Internet Protocol (TCP/IP) Properties dialog box, click OK.
  6. To close the Switch2 Properties dialog box, click OK.
  7. To apply these configuration settings you must reboot this server.

The TCP/IP properties are set for the network adapter named Switch2.


Configuring the Network Connections for ISA3

The Corporate LAN tier Microsoft Internet Security and Acceleration (ISA) Server, named ISA3, requires two network adapters:

  • A network adapter to communicate with the data tier through Switch2.
  • A network adapter to communicate with the Corporate LAN tier through Switch3.

It is recommended that you rename the connection for the network adapters according to their use. In this example, the network adapter that will connect to Switch2 is renamed Switch2, and the network adapter that will connect to Switch3 is renamed Switch3.

To rename the ISA3 network adapters

To set the ISA3 TCP/IP properties of the Switch2 network adapter

To set the ISA3 TCP/IP properties of the Switch3 network adapter

To rename the ISA3 network adapters

  1. On the desktop, right-click My Network Places, and then click Properties.
  2. In the Network and Dial-up Connections screen, right-click the network connection that will connect to Switch2, and then click Rename.
  3. Type Switch2, and then press ENTER.

    The ISA3 network adapter that will connect to Switch2 is renamed Switch2.

  4. In the Network and Dial-up Connections screen, right-click the network connection that will connect to Switch3, and then click Rename.
  5. Type Switch3, and then press ENTER.

The ISA3 network adapter that will connect to Switch3 is renamed Switch3.

To set the ISA3 TCP/IP properties of the Switch2 network adapter

  1. In the Network and Dial-up Connections screen, right-click Switch2, and then click Properties.
  2. In the ISP Properties dialog box, in the Components checked are used by this connection section, select Internet Protocol (TCP/IP), and then click Properties.
  3. In the Internet Protocol (TCP/IP) Properties dialog box, on the General tab, select Use the following IP address, and then do the following:
    Use this | To do this
    IP address | Type 10.100.100.98.
    Subnet mask | Type 255.255.255.0.
    Default gateway | Leave this box blank.
  4. Select Use the following DNS server addresses, and then do the following:
    Use this | To do this
    Preferred DNS server | Leave this box blank.
    Alternate DNS server | Leave this box blank.
  5. To close the Internet Protocol (TCP/IP) Properties dialog box, click OK.
  6. To close the Switch2 Properties dialog box, click OK.

The TCP/IP properties are set for the network adapter named Switch2.

To set the ISA3 TCP/IP properties of the Switch3 network adapter

  1. In the Network and Dial-up Connections screen, right-click Switch3, and then click Properties.
  2. In the Switch3 Properties dialog box, in the Components checked are used by this connection section, select Internet Protocol (TCP/IP), and then click Properties.
  3. In the Internet Protocol (TCP/IP) Properties dialog box, on the General tab, select Use the following IP address, and then type the IP addresses provided by the system administrator of your Corporate LAN tier.
    Note The IP addresses must be static, not dynamic.
  4. To close the Internet Protocol (TCP/IP) Properties dialog box, click OK.
  5. To close the Switch3 Properties dialog box, click OK.
  6. To apply these configuration settings you must restart this computer.

The TCP/IP properties are set for the Switch3 network adapter.


Configuring the Network Connection for Client1

The Corporate LAN tier client computer, named Client1, requires one network adapter for communication with the Corporate LAN tier through Switch3.

It is recommended that you rename the connection for the network adapter according to its use. In this example, the network adapter is renamed Switch3.

To rename the Client1 network adapter

To set the Client1 TCP/IP properties of the Switch3 network adapter

To rename the Client1 network adapter

  1. On the desktop, right-click My Network Places, and then click Properties.
  2. In the Network and Dial-up Connections screen, right-click the network connection that will connect to Switch3, and then click Rename.
  3. Type Switch3, and then press ENTER.

The Client1 network adapter is renamed Switch3.

To set the Client1 TCP/IP properties of the Switch3 network adapter

  1. In the Network and Dial-up Connections screen, right-click Switch3 and then click Properties.
  2. In the Switch3 Properties dialog box, in the Components checked are used by this connection section, select Internet Protocol (TCP/IP), and then click Properties.
  3. In the Internet Protocol (TCP/IP) Properties dialog box, on the General tab, select Use the following IP address, and then type the IP addresses provided by the system administrator of your Corporate LAN tier.
    Note The IP addresses must be static, not dynamic.
  4. To close the Internet Protocol (TCP/IP) Properties dialog box, click OK.
  5. To close the Switch3 Properties dialog box, click OK.
  6. To apply these configuration settings you must reboot this server.

The TCP/IP properties are set for the Switch3 network adapter.


Wiring the Network

With the exception of network adapter 1 in the server named ISA1 (network connection named ISP), use network cables to connect all of the network adapters to the appropriate switches. You will connect the network connection named ISP to the Internet in the last step of installing and configuring your secure deployment.

Use the tables in Configuring IP Addresses and DNS Entries for a Secure Deployment to determine the appropriate switches in which to connect your network adapters. The connection name for a particular network adapter denotes the appropriate switch in which to connect a particular network adapter.


Installing the ISA Servers

The following procedures apply to all three Microsoft Internet Security and Acceleration (ISA) Server 2000 servers in the sample secure deployment.

Important Before installing the ISA server, you must ensure that Internet Information Services (IIS) is not installed on the ISA servers. If IIS is installed, you must remove IIS before you proceed with the installation of the ISA server.
Note You must install and configure ISA server on the data tier computer (ISA2) before you can install the Web server (Web1) for your site, because the Web server must have access to the Commerce Server runtime databases.
Note Do not join the ISA servers to a domain. ISA servers should be configured in its own workgroup. Do not add Domain Name Service (DNS).

To configure each ISA server to be a member of its own workgroup

To install the ISA servers

You perform the following procedures separately for each ISA server.

To configure each ISA server to be a member of its own workgroup

  1. On the desktop, right-click My Computer, and then click Properties.
  2. In the System Properties dialog box, on the Network Identification tab, click Properties.
  3. In the Identification Changes dialog box, in the Member of section, select Workgroup, type the name of the ISA server, and then click OK.
  4. In the System Properties dialog box, click OK.
  5. In the System Settings Change dialog box, click Yes to restart the server.

    The ISA server is configured to be a member of its own workgroup.

  6. Repeat steps 1 through 5 for each ISA server.
    Note It is recommended that each ISA server use integrated security. For more information about ISA, see the Microsoft Internet Security and Acceleration Server 2000 documentation.

To install the ISA servers

  1. Insert the ISA Server 2000 CD into the CD-ROM drive.
  2. In the Microsoft ISA Server Setup screen, click Install ISA Server.
  3. In the Microsoft ISA Server (<VersionName> Edition) Setup dialog box, click Continue.
  4. In the Microsoft ISA Server Setup dialog box, click I Agree to accept the licensing agreement.
  5. In the Microsoft ISA Server (<VersionName> Edition) Setup dialog box, click Full Installation.
  6. In the Microsoft ISA Server Setup dialog box, click Yes to install ISA as a stand-alone server.
  7. In the Microsoft ISA Server Setup dialog box, select Firewall mode, and then click Continue.
    Note Only the ISA2 server, which is used as a firewall to protect the data tier from the presentation tier, can be set up as a firewall-only server.
  8. In the Microsoft Internet Security and Acceleration Server Setup dialog box, in the From and To boxes, type the appropriate IP address ranges for the servers you are configuring. The following table lists the IP addresses used in this sample secure deployment.
    For this Server | From box | To box
    ISA1 | Type 10.100.100.1. | Type 10.100.100.255.
    ISA2 | Type 10.200.200.1. | Type 10.200.200.255.
    ISA3 | Use the IP address range of the Corporate LAN tier network segment. | Use the IP address range of the Corporate LAN tier network segment.
  9. Click Add, and then click Construct Table.
  10. In the Local Address Table dialog box, clear the Add the following private ranges: 10.x.x.x, 192.168.x.x, 172.16.x.x, 172.31.x.x, and 169.254.x.x check box.
  11. In the Add ranges based on the Windows 2000 routing table section, select the check box for the IP address of the network adapter that is connected to the tier that this server protects. The following table lists the IP addresses used in this sample secure deployment.
    For this Server | Do this
    ISA1 | Select the 10.200.200.98 check box.
    ISA2 | Select the 10.100.100.99 check box.
    ISA3 | Use the IP address of the network adapter that is connected to Switch 3.
  12. To close the Local Address Table dialog box, click OK.
  13. To close the Setup Message dialog box, click OK.
  14. To close the Microsoft Internet Security and Acceleration Server Setup dialog box, click OK.
    Note If a message appears that requests that you install SMTP, ignore the message, and click OK to close the message.
  15. In the Launch ISA Management Tool dialog box, clear the Start ISA Server Getting Started Wizard check box, and then click OK.
  16. In the Microsoft Internet Security and Acceleration Server Setup dialog box, click OK.
  17. Repeat steps 1 through 16 for each ISA server.

After you install ISA on each server, install ISA Server Service Pack 1, which is available from http://www.microsoft.com/ISAServer/.


Configuring the ISA Servers

This section provides detailed instructions about configuring Microsoft Internet Security and Acceleration (ISA) Servers.

This section contains:

  • Configuring the Presentation Tier ISA1 Server
  • Configuring the Data Tier ISA2 Server
  • Configuring the Corporate LAN Tier ISA Server


Configuring the Presentation Tier ISA1 Server

In this section, you create a destination set for the domain name (for example, contoso.com or adatum.com), and then create a new Web publishing rule using the domain name.

To create a destination set for the domain name

To create a Web publishing rule for the contoso.com domain

To create a destination set for the domain name

  1. Click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  2. In the ISA Management screen, in the tree structure, expand Servers and Arrays, expand ISA1, expand Policy Elements, right-click Destination Sets, point to New, and then click Set.
  3. In the New Destination Set dialog box, in the Name box, type www.contoso.com, and then click Add.
  4. In the Add/Edit Destination dialog box, select Destination, and then type www.contoso.com.
  5. In the Path box, type /retail/*.
  6. To close the Add/Edit Destination dialog box, click OK.
  7. To close the New Destination Set dialog box, click OK.

A destination set is created for the contoso.com domain.

To create a Web publishing rule for the contoso.com domain

  1. Click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  2. In the ISA Management screen, expand Servers and Arrays, expand ISA1, expand Publishing, right-click Web Publishing Rules, point to New, and then click Rule.
  3. In the Welcome to the New Web Publishing Rule Wizard dialog box, type a name for the rule (for example, ISA1-Web1), and then click Next.
  4. In the Destination Sets dialog box, select Specified destination set from the drop-down list.
  5. Select contoso.com from the Name drop-down list, and then click Next.
  6. In the Client Type dialog box, select Any request, and then click Next.
  7. In the Rule Action dialog box, select Redirect the request to this internal Web server (name or IP address), and then type the IP address of the Web server. In this sample secure deployment, the IP address is 10.200.200.99.
  8. Click Next, and then click Finish.

A Web publishing rule is created for the domain.


Configuring the Data Tier ISA2 Server

This section contains:

  • Creating Registry Keys for the Data Tier ISA Server
  • Creating the Data Tier ISA Server Protocol Definitions for DTC
  • Creating Data Tier ISA Server Protocol Definitions to Allow Trust Relationships Between Domains
  • Creating Data Tier ISA Server Protocol Rules to Allow Trust Relationships Between Domains
  • Creating Data Tier ISA Protocol and Web Publishing Rules
  • Configuring the Data Tier Incoming and Outgoing Web Request Traffic
  • Creating the Data Tier ISA2 Server Publishing Rules
  • Updating the HOSTS File for ISA2


Creating Registry Keys for the Data Tier ISA Server

You must create two registry keys on the data tier server named ISA2. These keys allow Microsoft Distributed Transaction Coordinator (DTC) to work through a firewall.

To create the first registry key on ISA2

To create the second registry key on ISA2

To create the first registry key on ISA2

  1. Click Start, click Run, in the Open box, type %windir%\system32\regedt32, and then click OK.
  2. In the Registry Editor, in the HKEY_LOCAL_MACHINE on Local Machine window, expand SYSTEM, expand Services, expand Fwsrv, and then expand Parameters.
  3. On the Edit menu, click Add Value.
  4. In the Add Value dialog box, do the following:
    Use this | To do this
    Value Name Type UseISAAddressInPublishing.
    Note The value name is case-sensitive.
    Data Type | Select REG_DWORD from the drop-down list.
  5. Click OK.
  6. In the DWORD Editor dialog box, in the Data box, type 1, and then click OK.

The first registry key is created on the ISA2 server.

To create the second registry key on ISA2

  1. In the Registry Editor, in the HKEY_LOCAL_MACHINE on Local Machine window, expand SYSTEM, expand CurrentControlSet, expand Services, expand NetBT, and then expand Parameters.
  2. On the Edit menu, click Add Value.
  3. In the Add Value dialog box, do the following:
    Use this | To do this
    Value Name Type SMBDeviceEnabled.
    Note The value name is case-sensitive.
    Data Type | Select REG_DWORD from the drop-down list.
  4. Click OK.
  5. In the DWORD Editor dialog box, in the Data box, type 0, and then click OK.
  6. To close the Registry Editor, on the Registry menu, click Exit.

The second registry key is created on the ISA2 server.


Creating the Data Tier ISA Server Protocol Definitions for DTC

In this step you create a protocol definition for port 135, and a separate protocol definition for ports 5000 to 5030. Port 135 is the RPC port mapper. The design-time control (DTC) uses the RPC port for communication. These definitions are configured on the data tier Microsoft Internet Security and Acceleration (ISA) Server named ISA2.

To create a protocol definition for DTC-outbound traffic for port 135 on the data tier ISA server

To create separate protocol definitions for DTC-outbound traffic ports 5000 through 5030 on the data tier ISA server

To create a protocol definition for DTC-outbound traffic for port 135 on the data tier ISA server

  1. Click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  2. In the ISA Management screen, in the tree structure, expand Servers and Arrays, expand ISA2, expand Policy Elements, right-click Protocol Definitions, point to New, and then click Definition.

    The New Server Protocol Definition Wizard starts.

  3. In the Welcome to the New Protocol Definition Wizard dialog box, type DTCoutbound135, and then click Next.
  4. In the Primary Connection Information dialog box, do the following:
    Use this | To do this
    Port number | Type 135.
    Protocol type | Select TCP from the drop-down list.
    Direction | Select Outbound from the drop-down list.
  5. Click Next.
  6. In the Secondary Connections dialog box, select Yes, and then click New.
  7. In the New/Edit Secondary Connection dialog box, do the following:
    Use this | To do this
    From | Type the start of the port range. In this sample secure deployment, it is 5000.
    To | Type the end of the port range. In this sample secure deployment, it is 5030.
    Protocol type | Select TCP from the drop-down list.
    Direction | Select Outbound from the down-down list.
  8. Click OK.
  9. In the Secondary Connections dialog box, click Next.
  10. In the Completing the New Protocol Definition Wizard dialog box, click Finish.

The protocol definition for DTC-outbound traffic is created for port 135 on the data tier ISA server.

You must perform the following procedure separately for each definition name listed in the table in step 3.

To create separate protocol definitions for DTC-outbound traffic ports 5000 through 5030 on the data tier ISA server

  1. Click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  2. In the ISA Management screen, in the tree structure, expand Servers and Arrays, expand ISA2, expand Policy Elements, right-click Protocol Definitions, point to New, and then click Definition.

    The New Server Protocol Definition Wizard starts.

  3. In the Welcome to the New Protocol Definition Wizard dialog box, type the name for your DTC definition, and then click Next.

    The definition names used in this sample secure deployment are DTCoutbound<primary connection port number>, where the primary connection port numbers are 5000 through 5030. For example, the definition name for the primary connection port number 5000 is DTCoutbound5000.

  4. In the Primary Connection Information dialog box, do the following:
    Use this | To do this
    Port number Type the port number for your DTC definition.
    Note The port numbers used in this sample secure deployment are listed in the Primary connection port number column in the table in step 3.
    Protocol type | Select TCP from the drop-down list.
    Direction | Select Outbound from the down-down list.
  5. Click Next.
  6. In the Secondary Connections dialog box, click Next.
  7. In the Completing the New Protocol Definition Wizard dialog box, click Finish.
  8. Repeat steps 1 through 7 for each protocol definition listed in the Definition name column in the table in step 3.

The separate protocol definitions are created for DTC-outbound traffic ports 5000 through 5030 on the data tier ISA server.


Creating Data Tier ISA Server Protocol Definitions to Allow Trust Relationships Between Domains

Before you can configure trust relationships between domain controllers across a firewall, you must create protocol definitions that allow access through the necessary ports. The following table lists these ports.

Protocol Definition | Port number | Protocol | Direction
DNS Query1 | 53 | TCP | Outbound
DNS Zone Transfer1 | 53 | UDP | Send–Receive
RPC Endpoint Mapper | 135 | TCP | Outbound
LDAP1 | 389 | TCP | Outbound
LDAP2 | 389 | UDP | Send–Receive
SMB1 | 445 | TCP | Outbound
SMB2 | 445 | UDP | Send–Receive
AD Replication | (See Note) | TCP | Outbound
DNS Server Zone Transfer | 53 | TCP | Inbound
DNS Query Server | 53 | UDP | Receive–Send
Any RPC Server | 135 | TCP | Inbound
LDAP Server | 389 | UDP | Receive–Send
SMB Server TCP | 445 | TCP | Inbound
SMB Server UDP | 445 | UDP | Receive–Send
Note For the AD Replication protocol definition, you must select an IP port number between 49152 and 65535. In this secure sample deployment, use port 65432. You will use this port number later when configuring the registry on the domain controllers in Configuring the Registry on the Domain Controllers.

You must perform the following procedure separately for each protocol definition listed in the preceding ports table.

To create the protocol definitions

  1. Click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  2. In the ISA Management screen, expand Servers and Arrays, expand ISA2, expand Policy Elements, right-click Protocol Definitions, point to New, and then click Definition.

    The New Server Protocol Definition Wizard starts.

  3. In the Welcome to the New Protocol Definition Wizard dialog box, type the name for your definition from the Protocol Definition column in the preceding ports table, and then click Next.
  4. In the Primary Connection Information dialog box, do the following:
    Use this | To do this
    Port number | Type the port number from the Port Number column in the preceding ports table.
    Protocol type Select the appropriate protocol from the drop-down list.
    Note The appropriate protocol is listed in the Protocol column in the preceding ports table.
    Direction Select the appropriate direction from the drop-down list.
    Note The appropriate direction is listed in the Direction column in the preceding ports table.
  5. Click Next.
  6. In the Secondary Connections dialog box, select No, and then click Next.
  7. In the Completing the New Protocol Definition Wizard dialog box, click Finish.
  8. Repeat steps 2 through 7 for each protocol definition listed in the in the Protocol Definition column in the preceding ports table.


Creating Data Tier ISA Server Protocol Rules to Allow Trust Relationships Between Domains

You must create protocol and publishing rules to allow your domain controllers to create a trust relationship through the data tier Microsoft Internet Security and Acceleration (ISA) Server firewall. The following rules are created on the server named ISA2.

Settings to use to create protocol rules

Creating publishing rules

Settings to use to create protocol rules

The following table summarizes the settings for the rules that you must create to allow trust relationships between domains through a firewall. Following the table are detailed instructions to create the protocol rules.

Protocol rule name | Protocols
DNS Query1 | DNS Query1
DNS Zone Transfer1 | DNS Zone Transfer1
RPC Endpoint Mapper | RPC Endpoint Mapper
LDAP TCP | LDAP1
LDAP UDP | LDAP2
SMB TCP | SMB1
SMB UDP | SMB2
AD Replication | AD Replication
Any RPC | DTCoutbound135
DTC | The DTC name used in this sample secure deployment are DTCoutbound<primary connection port number>, where the primary connection port numbers are 5000 through 5030. For example, the DTC name for the primary connection port number 5000 is DTCoutbound5000.

You must perform the following procedure separately for each protocol rule listed in the preceding table.

To create the protocol rules

  1. Click Start, click Programs, click Microsoft ISA Server, and then click ISA Management.
  2. In the ISA Management screen, expand Servers and Arrays, expand ISA2, expand Access Policy, right-click Protocol Rules, point to New, and then click Rule.

    The New Server Protocol Rule Wizard starts.

  3. In the Welcome to the New Protocol Rule Wizard dialog box, in the Protocol rule name box, type the name of the protocol rule, and then click Next.
    Note The protocol rule names for this sample secure deployment are listed in the Protocol rule name column in the preceding table.
  4. In the Rule Action dialog box, select Allow, and then click Next.
  5. In the Protocols dialog box, select Selected protocols from the Apply this rule to drop-down list.
  6. In the Protocols box, select the check boxes for the protocol(s) that you want to include with this rule and then click Next.
    Note The protocols configured in this sample secure deployment are listed in the Protocols column in the preceding table.
  7. In the Schedule dialog box, accept the default (Always), and then click Next.
  8. In the Client Type dialog box, select Any request, and then click Next.
  9. In the Completing the New Protocol Rule Wizard dialog box, click Finish.
  10. Repeat steps 2 through 9 for each protocol definition listed in the Protocol rule name column in the preceding table.

You have created the protocol rules for the data tier domain.

Creating publishing rules

A server publishing rule maps incoming requests to the appropriate internal server. In this step, you create server publishing rules to support the DNS server trust relationship, and a SQL Server publishing rule that maps incoming requests to the SQL Server hosting the Commerce Server runtime databases.

Use the following procedure to create a server publishing rule for each server publishing rules name listed in the following table.

Server publishing rules name | Protocol definition name | Internal IP address | External IP address
DNS Server Zone Transfer | DNS Server Zone Transfer | 10.100.100.100 | 10.200.200.97
DNS Query Server | DNS Query Server | 10.100.100.100 | 10.200.200.97
Any RPC Server | Any RPC Server | 10.100.100.100 | 10.200.200.97
LDAP Server | LDAP Server | 10.100.100.100 | 10.200.200.97
SMB Server TCP | SMB Server TCP | 10.100.100.100 | 10.200.200.97
SMB Server UDP | SMB Server UDP | 10.100.100.100 | 10.200.200.97
RPC for DTC | Any RPC Server | 10.100.100.103 | 10.200.200.97
Note For a list of tables that show the IP addresses that are used for each server, see IP Addresses and DNS Entries for a Secure Deployment.

You perform the following procedure on the server named ISA2.

To create publishing rules to allow trust relationships between domains

  1. Click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  2. In the ISA Management screen, expand Servers and Arrays, expand ISA2, expand Publishing, right-click Server Publishing Rules, point to New, and then click Rule.

    The New Server Publishing Rule Wizard starts.

  3. In the Welcome to the New Server Publishing Rule Wizard dialog box, type the name from the Server publishing rules name column in the preceding table, and then click Next.
  4. In the Address Mapping dialog box, do the following:
    Use this | To do this
    IP address of internal server | Type the IP address listed in the Internal IP address column of the preceding table.
    External IP address on ISA Server | Type the IP address listed in the External IP address column of the preceding table.
  5. Click Next.
  6. In the Protocol Settings dialog box, in the Apply the rule to this protocol drop-down list, select the protocol definition listed in the Protocol definition name column in the preceding table, and then click Next.
  7. In the Client Type dialog box, click Any request, and then click Next.
  8. In the Complete the New Server Publishing Rule Wizard screen, click Finish.

The publishing rules are created to allow trust relationships between domains.


Creating Data Tier ISA Protocol and Web Publishing Rules

A server protocol rule indicates which protocols can be used to access a specific destination. On the data tier ISA server, you must create four protocol rules.

Creating the data tier ISA server SQL Server protocol rule

Creating the data tier ISA server DTC protocol rules

Creating the data tier ISA server Web publishing rule

Creating the data tier ISA server SQL Server protocol rule

In this step, you create a protocol rule, which indicates that incoming requests must use the Microsoft SQL Server protocol to access the SQL Server hosting the Commerce Server runtime databases. This configuration is performed on SQL1.

The following table summarizes the settings for this rule. Following the table are detailed instructions to create the SQL Server protocol rule.

Rule property | Value
Rule Action | Allow
Select protocol | Microsoft SQL Server
Schedule | Always
Applies to | Any request

To create the SQL Server protocol rule

  1. Log on as administrator to the server named ISA2.
  2. Click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  3. In the ISA Management screen, in the tree structure, expand Servers and Arrays, expand ISA2, expand Access Policy, right-click Protocol Rules, point to New, and then click Rule.

    The New Server Protocol Rule Wizard starts.

  4. In the Welcome to the New Server Protocol Rule Wizard dialog box, in the Server protocol rule name box, type SQL, and then click Next.
  5. In the Rule Action dialog box, select Allow, and then click Next.
  6. In the Protocols dialog box, select Selected protocols from the drop-down list.
  7. In the Protocols list box, select Microsoft SQL Server, and then click Next.

    Do not select any other protocols.

  8. In the Schedule dialog box, accept the default (Always), and then click Next.
  9. In the Action dialog box, select Allow, and then click Next.
  10. In the Client Type dialog box, select Any request, and then click Next.
  11. In the Protocol Settings dialog box, from the drop-down list, select Microsoft SQL Server, and then click Next.
  12. Click Finish.

Creating the data tier ISA server DTC protocol rules

The following table summarizes the settings for this rule. Following the table are detailed instructions to create the design-time control (DTC) protocol rule.

Rule Property | Value
Rule Action | Allow
Select protocol | DTCoutbound135
Schedule | Always
Applies To | Any request

To create the DTC protocol rule for port 135

To create the DTC protocol rule for ports 5000 through 5030

To create the DTC protocol rule for port 135

  1. Click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  2. In the ISA Management screen, in the tree structure, expand Servers and Arrays, expand the server name, expand Access Policy, right-click Protocol Rules, point to New, and then click Rule.

    The New Server Protocol Rule Wizard starts.

  3. In the Welcome to the New Server Protocol Rule Wizard dialog box, in the Server protocol rule name box, type a name for the rule. For this sample secure deployment type DTC, and then click Next.
  4. In the Rule Action dialog box, select Allow, and then click Next.
  5. In the Protocols dialog box, select Selected protocols from the drop-down list.
  6. In the Protocols box, select only DTCoutbound135, and then click Next.

    Do not select any other protocol definitions.

  7. In the Schedule dialog box, accept the default (Always), and then click Next.
  8. In the Action dialog box, select Allow, and then click Next.
  9. In the Client Type dialog box, select Any requests, and then click Next.
    Note You can optionally restrict access to the server named Web1.
  10. In the Protocol Settings dialog box, from the drop-down list, select Microsoft SQL Server, and then click Next.
  11. Click Finish.

To create the DTC protocol rule for ports 5000 through 5030

  1. Click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  2. In the ISA Management screen, in the tree structure, expand Servers and Arrays, expand ISA2, expand Access Policy, right-click Protocol Rules, point to New, and then click Rule.

    The New Server Protocol Rule Wizard starts.

  3. In the Welcome to the New Server Protocol Rule Wizard dialog box, type the name for this rule. For this sample secure deployment type DTCoutbound5000to5030, and then click Next.
  4. In the Rule Action dialog box, select Allow, and then click Next.
  5. In the Protocols dialog box, select Selected protocols from the Apply this rule to drop-down list.
  6. In the Protocols box, select the appropriate check boxes for the protocols that you want, and then click Next.
    Note The appropriate check boxes are listed in the Definition name column in the following table. The definition names used in this sample secure deployment are DTCoutbound<primary connection port number>, where the primary connection port numbers are 5000 through 5030. For example, the definition name for the primary connection port number 5000 is DTCoutbound5000.
  7. In the Schedule dialog box, accept the default (Always), and then click Next.
  8. In the Action dialog box, select Allow, and then click Next.
  9. In the Client Type dialog box, select Any requests, and then click Next.
  10. In the Completing the New Protocol Rule Wizard dialog box, click Finish.

Creating the data tier ISA server Web publishing rule

The data tier ISA server Web publishing rule enables the Business Desk server to publish to the Web server. For example, the Business Desk server publishes campaigns, profiles, and catalogs.

The following table summarizes the settings for this rule. Following the table are detailed instructions to create the data tier ISA server Web publishing rule.

Rule Property | Value
Rule Action | Allow
Select protocol | HTTP HTTPS
Schedule | Always
Applies to | Client Set: All destinations

You perform the following procedure on the server named ISA2.

To create the data tier ISA server Web publishing rule

  1. Click Start, click Programs, click Microsoft ISA Server, and then click ISA Management.
  2. In the ISA Management screen, in the tree structure, expand Servers and Arrays, expand ISA2, expand Publishing, right-click Web Publishing Rules, point to New, and then click Rule.

    The New Web Publishing Rule Wizard starts.

  3. In the Welcome to the New Web Publishing Rule Wizard dialog box, type RetailDB, and then click Next.
  4. In the Destination Sets dialog box, select All destinations from the Apply this rule to drop-down list, and then click Next.
  5. In the Client Type dialog box, select Any request, and then click Next.
  6. In the Rule Action dialog box, select Redirect the request to this internal Web server (name or IP address).
  7. In the box to the left of the Browse button, type 10.100.100.102.
    Note This is the IP address of the server named Commerce1.
  8. Select the Send the original host header to the publishing server instead of the actual one (specified above) check box, and then do the following:
    Use this | To do this
    Connect to this port when bridging request as HTTP | Type 80.
    Connect to this port when bridging request as SSL | Type 443.
    Connect to this port when bridging request as FTP. | Type 21.
  9. Click Next.
  10. In the Completing the New Web Publishing Rule Wizard dialog box, click Finish.


Configuring the Data Tier Incoming and Outgoing Web Request Traffic

In this step you configure the data tier Microsoft Internet Security and Acceleration (ISA) Server (ISA2) to process outgoing Web request traffic. You perform this step to enable Commerce Server Business Desk to publish to the Web server.

To configure the data tier ISA server for outgoing Web traffic

  1. On the data tier ISA server, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  2. In the ISA Management screen, in the tree structure, expand Servers and Arrays, right-click ISA2, and then click Properties.
  3. In the ISA2 Properties dialog box, on the Outgoing Web Requests tab, in the Identification section, select Use the same listener configuration for all internal IP addresses.
  4. In the Server column, select ISA2, and then click Edit.
  5. In the Add/Edit Listeners dialog box, in the Authentication section, select the Basic with this domain check box.
  6. In the ISA Server Configuration dialog box, click Yes to continue.
  7. Ensure that the Integrated check box is selected, and then click OK.
  8. In the ISA2 Properties dialog box, on the Incoming Web Requests tab, in the Identification section, click Configure listeners individually per IP address, and then click Add.
  9. In the Add/Edit Listeners dialog box, select ISA2 from the Server drop-down list.
  10. In the IP Address drop-down list, select the static IP address provided by your corporate system administrator.
    Note This is the static IP address for the network connection from ISA3 to Switch3.
  11. In the Authentication section, select the Basic with this domain check box.
  12. In the ISA Server Configuration dialog box, click Yes to continue.
  13. Ensure that the Integrated check box is selected, and then click OK.
  14. To close the Add/Edit Listeners dialog box, click OK.
  15. In the ISA2 Properties dialog box, on the Incoming Web Requests tab, in the TCP Port box, type 80.

    Port 80 is required for Web publishing.

  16. Select the Enable SSL listeners check box.
  17. In the SSL Listeners dialog box, click OK to continue.
  18. In the SSL port box, type 443, and then click OK.

    Port 443 is the default port for SSL/HTTPS.

  19. To close the ISA2 Properties dialog box, click OK.
  20. In the ISA Server Warning dialog box, select Save the changes and restart the service(s), and then click OK.


Creating the Data Tier ISA2 Server Publishing Rules

A server publishing rule maps incoming requests to the appropriate internal server. In this step, you create a SQL server publishing rule that maps incoming requests to the SQL Server hosting the Commerce Server runtime databases.

To create the SQL1 publishing rule

  1. Click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  2. In the ISA Management screen, in the tree structure pane, expand Servers and Arrays, expand ISA2, expand Publishing, right-click Server Publishing Rules, point to New, and then click Rule.

    The New Server Publishing Rule Wizard starts.

  3. In the Welcome to the New Server Publishing Rule Wizard dialog box, type SQL1, and then click Next.
  4. In the Address Mapping dialog box, do the following:
    Use this | To do this
    IP address of internal server | Type 10.100.100.103.
    External IP address on ISA Server | Type 10.200.200.97.
    Note To view a list of tables that show the IP addresses that are used for each server, see IP Addresses and DNS Entries for a Secure Deployment.
  5. Click Next.
  6. In the Protocol Settings dialog box, in the Apply the rule to this protocol drop-down list, select Microsoft SQL Server, and then click Next.
  7. In the Client Type dialog box, click Any request, and then click Next.
  8. In the Complete the New Server Publishing Rule Wizard screen, click Finish.


Updating the HOSTS File for ISA2

In this step, you add entries to the hosts file on the server named ISA2 to allow the NetBIOS name of the Web server (Web1) to resolve the IP address of Web1. The HOSTS file is used to look up IP addresses in the event that the Domain Name System (DNS) service running on the domain controller fails.

To update the HOSTS file on ISA2

  1. On the Business Desk server, navigate to the HOSTS file, for example, %systemroot%\system32\drivers\etc\HOSTS.
  2. Open the HOSTS file using a text editor such as Notepad.
  3. Search for the following line in the HOSTS file:

    127.0.0.1 localhost

  4. Add the following line below the line from step 3:

    10.200.200.99 Web1

  5. Save the HOSTS file and close the text editor.

The HOSTS file is updated on the ISA2 server.


Configuring the Corporate LAN Tier ISA Server

Before you configure the Corporate LAN tier ISA server, you must install ISA Server on the Corporate LAN computer. For instructions, see Installing the ISA Servers.

This section contains:

  • Creating Two Destination Sets on the Corporate ISA3 Server
  • Creating the Web Publishing Rule


Creating Two Destination Sets on the Corporate ISA3 Server

In this step you create two destination sets for the Business Desk users on the Corporate ISA server:

  • A destination set for the Business Desk application, for example, /retailbizdesk/default.asp.
  • A destination set for the Business Desk application widgets, for example, /widgets/default.asp.
    Note If you use a wildcard character (*), the firewall permits every request through the firewall. For example /retailbizdesk/* allows all requests to access the retailbizdesk virtual directory.

To create a destination set for the Business Desk application

  1. On the Corporate ISA Server (ISA3), click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  2. In the ISA Management screen, in the tree structure, expand Servers and Arrays, expand ISA3, expand Policy Elements, right-click Destination Sets, point to New, and then click Set.
  3. In the New Destination Set dialog box, type a name for the destination set. For this sample secure deployment, type RetailBD, and then click Add.
  4. In the Add/Edit Destination dialog box, select IP addresses, and then do the following:
    Use this | To do this
    From Type the IP address of the start range of the Corporate LAN tier.

    The system administrator of your Corporate LAN provides this IP address information.
    To Type IP address of the end range of the Corporate LAN tier.

    The system administrator of your Corporate LAN provides this IP address information.
    Path | Type the path to the Business Desk application. For this example type/retailbizdesk/default.asp.
  5. Click OK.

In the New Destination Set dialog box, the Name/IP Range and path that you typed are listed.

To create a destination set for the widgets

  1. In the New Destination Set dialog box, click Add.
  2. In the Add/Edit Destination dialog box, select IP addresses, and then do the following:
    Use this | To do this
    From Type the IP address of the start range of the Corporate LAN tier.

    The system administrator of your Corporate LAN provides this IP address information.
    To Type IP address of the end range of the Corporate LAN tier.

    The system administrator of your Corporate LAN provides this IP address information.
    Path | Type the path to the widgets. For this sample secure deployment, type /widgets/*.
  3. To close the Add/Edit Destination dialog box, click OK.
  4. To close the New Destination Set dialog box, click OK.

The destination set for the widgets is created.


Creating the Web Publishing Rule

In this step, you create a Web publishing rule on the Corporate ISA server that routes requests from the Business Desk client to the Business Desk application. You must create this rule so Business Desk users can publish profiles, campaigns, catalogs, and order codes to your Web site.

The following table summarizes the settings for this rule. Following the table are detailed instructions to create the Web publishing rule.

Rule Property | Value
Name | RetailBD
Action | Route to specified site
Applies to | Any request
Destination | RetailBD (the destination set created in Creating Two Destination Sets on the Corporate ISA3 Server)

To create a Web publishing rule on the Corporate ISA server

  1. On the Corporate ISA server, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  2. In the ISA Management screen, expand Servers and Arrays, expand ISA3, expand Publishing, right-click Web Publishing Rules, click New, and then click Rule.
  3. In the Welcome to the New Web Publishing Rule Wizard dialog box, type a name for the rule, and then click Next.
  4. In the Destination Sets dialog box, select Specified destination set from the drop-down list.
  5. In the Name box, select the name of the Business Desk destination set from the drop-down list. For this example select RetailBD, and then click Next.
  6. In the Client Type dialog box, select Any request, and then click Next.
  7. In the Rule Action dialog box, select Redirect the request to this internal Web server (name or IP address), and then specify the IP address of the Business Desk server. In this sample secure deployment, the IP address is 10.100.100.102.
    Note If you use Secure Sockets Layer (SSL), you must use the fully qualified domain name (FQDN) of the adatum domain. If you use the fully qualified domain name, type www.adatum.com.
  8. In the Rule Action dialog box, select Send the original host header to the publishing server instead of the one.
  9. Accept the default ports, and then click Next.
  10. In the Completing the New Web Publishing Rule Wizard dialog box, click Finish.

The Web publishing rule is created on the Corporate ISA server


Installing the Domain Controllers

You use the instructions in this section to install your security domain structure and the Domain Name Server (DNS) service on your domain controllers. The domain controllers authenticate users, and the DNS service running on the domain controllers resolve computer names to IP addresses. For example, the DNS service resolves the domain name www.contoso.com to the IP address for the Web server, 10.200.200.99.

This section contains:

  • Installing Active Directory and DNS on the Domain Controllers
  • Configuring the Preferred DNS Server Setting for DC1
  • Configuring the Preferred DNS Server Setting for DC2


Installing Active Directory and DNS on the Domain Controllers

To install Microsoft® Active Directory® directory service and domain name server (DNS) on the domain controllers, you use the Active Directory Installation Wizard "dcpromo" separately on each domain controller. The following table lists the NetBIOS and fully qualified domain names for both domain controllers used in this sample secure deployment.

NetBIOS Name (computer) | Fully Qualified Domain Name | NetBIOS Domain Name
DC1 | Contoso.com | Contoso
DC2 | Adatum.com | Adatum

You perform the following procedure on the DC1 and DC2 servers.

To run dcpromo and install Active Directory directory service

  1. Click Start, and then click Run.
  2. In the Run dialog box, in the Open box, type dcpromo, and then click OK.
  3. In the Active Directory Installation Wizard, click Next.
  4. In the Domain Controller Type dialog box, select Domain controller for a new domain, and then click Next.
  5. In the Create Tree or Child Domain dialog box, select Create a new domain tree, and then click Next.
  6. In the Create or Join Forest dialog box, select Create a new forest of domain trees and then click Next.
  7. In the New Domain Name dialog box, in the Full DNS name for new domain box, type the name in the Fully Qualified Domain Name column in the table in this section.
  8. In the NetBIOS Domain Name dialog box, in the Domain NetBIOS name box, type the name that users of earlier versions of Windows will use to identify the domain. It is recommended that you accept the default, which is a shortened version of the full DNS name, and then click Next. This name is listed in the NetBIOS Domain Name column in the table in this section.
  9. In the Database and Log Locations dialog box, select the location where you want to store your log files.
  10. In the Shared System Volume dialog box, accept the defaults settings, unless you have a specific reason to change them.
  11. Because DNS is not installed on this server, you are prompted to install it. In the Configure DNS dialog box, click OK, select Yes, install and configure DNS on this computer, and then click Next.
  12. In the Permissions dialog box, select Permissions compatible only with Windows 2000 servers, and then click Next.
    Note This option is also called "native mode." Selecting native mode ensures that support for Windows authentication is fully installed.
  13. In the Directory Services Restore Mode Administrator Password dialog box, do the following:
    Use this | To do this
    Password | Type the password you want to assign to the Administrator account for this server. It is recommended that you use a strong password that is different from the Administrator password for this computer.
    Confirm password | Type the password again to confirm it.
  14. Click Next.
  15. In the Summary dialog box, review the options you selected to ensure your Active Directory configuration is correct. To start the installation process, click Next, or to reconfigure your selections, click Back.

    During the installation process, you may be required to insert the Windows 2000 CD into the CD-ROM drive. Do not skip the DNS installation step of this process. Allow the wizard to install DNS.

    Note If you have already installed a service pack, you will need to have the files from the service pack available on the CD or on a share so that the installation will complete. The installation program will tell you that it needs the SP(x) version of the file.
  16. In the Completing the Active Directory Installation Wizard dialog box, click Finish.
  17. Restart the server.
  18. Repeat this procedure for the other domain controller.

Active Directory and DNS are installed on the domain controllers.

Note If you use domain name service (DNS) forward lookup in your deployment, then you must remove the root DNS forward lookup on your domain controllers. For more information about DNS, see Windows 2000 Help.


Configuring the Preferred DNS Server Setting for DC1

You perform the following procedure on the DC1 server to configure the Preferred DNS Server setting.

To configure the Preferred DNS Server setting for DC1

  1. On the desktop, right-click My Network Places, and then click Properties.
  2. In the Network and Dial-up Connections screen, right-click Switch1, and then click Properties.
  3. In the Switch1 Properties dialog box, in the Components checked are used by this connection section, select Internet Protocol (TCP/IP), and then click Properties.
  4. Select Use the following DNS server addresses, and then do the following:
    Use this | To do this
    Preferred DNS server | Type 10.200.200.100.
    Alternate DNS server | Leave this box blank.
  5. To close the Internet Protocol (TCP/IP) Properties dialog box, click OK.
  6. To close the Switch1 Properties dialog box, click OK.
  7. To apply these configuration settings you must reboot this server.

The Preferred DNS Server IP address of the network adapter named Switch1 is set.


Configuring the Preferred DNS Server Setting for DC2

You perform the following procedure on the DC2 server to configure the Preferred DNS Server setting.

To configure the Preferred DNS Server setting for DC2

  1. On the desktop, right-click My Network Places, and then click Properties.
  2. In the Network and Dial-up Connections screen, right-click Switch2, and then click Properties.
  3. In the Switch2 Properties dialog box, in the Components checked are used by this connection section, select Internet Protocol (TCP/IP), and then click Properties.
  4. Select Use the following DNS server addresses, and then do the following:
    Use this | To do this
    Preferred DNS server | Type 10.100.100.100.
    Alternate DNS server | Leave this box blank.
  5. To close the Internet Protocol (TCP/IP) Properties dialog box, click OK.
  6. To close the Switch2 Properties dialog box, click OK.
  7. To apply these configuration settings you must reboot this server.

The Preferred DNS server IP address of the network adapter named Switch2 is set.


Joining the Servers to Domains

After you have connected each server to the appropriate network and configured the domain controllers for the two domains, you are ready to join each server to their appropriate domain.

Important Do not join the ISA servers to a domain. These servers should remain in their own workgroup in this sample secure deployment.

This section contains:

  • Joining the SQL1 and SQL2 Servers to the Data Tier Domain
  • Joining the Business Desk Server to the Data Tier Domain
  • Joining the Web Server to the Presentation Tier Domain


Joining the SQL1 and SQL2 Servers to the Data Tier Domain

In this step you join the servers named SQL1 and SQL2 to the adatum.com domain.

To join the SQL1 and SQL2 servers to the data tier domain

To verify that the SQL1 and SQL2 servers have been added to the data tier domain

To join the SQL1 and SQL2 servers to the data tier domain

  1. On the desktop, right-click My Computer, and then click Properties.
  2. In the System Properties dialog box, on the Network Identification tab, click Properties.
  3. In the Identification Changes dialog box, in the Member of section, select Domain, type adatum, and then click OK.
  4. In the Domain Username And Password dialog box, type DC2\administrator and the administrator password for the server named DC2, and then click OK.
  5. In the Network Identification dialog box that welcomes you to the domain, click OK.
  6. In the Network Identification dialog box that advises you to restart the computer, click OK.
  7. To close the System Properties dialog box, click OK.
  8. In the System Settings Change dialog box, click Yes to restart the computer.
  9. Repeat steps 1 through 8 to join the second SQL server to the data tier domain.

The SQL servers SQL1 and SQL2 are joined to the adatum.com domain.

You perform the following procedure on the server named DC2.

To verify that the SQL1 and SQL2 servers have been added to the data tier domain

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  2. In the Active Directory Users and Computers screen, in the tree structure, expand adatum.com, and then click Computers.

The names of the computers that are joined to the adatum.com domain are listed in the display pane.


Joining the Business Desk Server to the Data Tier Domain

In this step, you join the Business Desk server, named Commerce1, to the adatum.com domain.

To join the Business Desk server to the data tier domain

To verify that the Business Desk server has been added to the adatum domain

To join the Business Desk server, named Commerce1, to the data tier domain

  1. On the desktop, right-click My Computer, and then click Properties.
  2. In the System Properties dialog box, on the Network Identification tab, click Properties.
  3. In the Identification Changes dialog box, in the Member of section, select Domain, type adatum, and then click OK.
  4. In the Domain Username And Password dialog box, type DC2\administrator and the administrator password for the server named DC2, and then click OK.
  5. In the Network Identification dialog box that welcomes you to the domain, click OK.
  6. In the Network Identification dialog box that advises you to restart the computer, click OK.
  7. In the System Properties dialog box, click OK.
  8. In the System Settings Change dialog box, click Yes to restart the computer.

The Business Desk server is joined to the adatum.com domain.

You perform the following procedure on the server named DC2.

To verify that the Business Desk server has been added to the adatum domain

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  2. In the Active Directory Users and Computers screen, in the tree structure, expand adatum.com, and then click Computers.

The names of the computers that are joined to the adatum.com domain are listed in the display pane.


Joining the Web Server to the Presentation Tier Domain

In this step, you join the Web server, named Web1, to the contoso.com domain.

Note The Web server named Web1 only has the base platform installed on it. You have not yet unpacked the Web site application onto the Web server.

To join the Web server to the presentation tier domain

To verify that the Web server has been added to the presentation tier domain

To join the Web server to the presentation tier domain

  1. On the desktop, right-click My Computer, and then click Properties.
  2. In the System Properties dialog box, on the Network Identification tab, click Properties.
  3. In the Identification Changes dialog box, in the Member of section, select Domain, type contoso, and then click OK.
  4. In the Domain Username And Password dialog box, type contoso\administrator, and the administrator password for the server named DC1, and then click OK.
  5. In the Network Identification dialog box that welcomes you to the domain, click OK.
  6. In the Network Identification dialog box that advises you to restart the computer, click OK.
  7. In the System Properties dialog box, click OK.
  8. In the System Settings Change dialog box, click Yes to restart the computer.

The Web1 Web server is joined to the presentation tier domain.

You perform the following procedure on the computer named DC1.

To verify that the Web server has been added to the presentation tier domain

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  2. In the Active Directory Users and Computers screen, in the tree structure, expand contoso.com, and then click Computers.

The names of the computers that are joined to the adatum.com domain are listed in the display pane.


Configuring the Domain Controllers

In this section you configure two domain controllers, one as the contoso.com domain controller and one as the adatum.com domain controller.

This section contains:

  • Enabling Delegation for SQL1
  • Configuring the Service Principal Name
  • Creating Required Accounts on the Data Tier Domain Controller
  • Creating Required Accounts on the Presentation Tier Domain Controller
  • Creating a Trust Relationship Between Domains


Enabling Delegation for SQL1

You must enable the server named SQL1 for delegation.

You perform the following procedure on the server named DC2.

To enable delegation for the SQL1 server

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  2. In the Active Directory Users and Computers screen, in the tree structure, expand adatum.com, and then click Computers.
  3. In the Computers pane, right-click SQL1, and then click Properties.
  4. In the SQL1 Properties dialog box, on the General tab, select Trust computer for delegation, and then click OK.

Delegation for the SQL1 server is enabled.


Configuring the Service Principal Name

Note You must use the setspn.exe command-line utility that is provided with the Microsoft Windows 2000 Resource Kit Utility to set Service Principle Name (SPN).

You set the SPN on the computer named DC2.

To set the Service Principal Name

To verify that SPN is set on Commerce1

To set the Service Principal Name

  1. Click Start, and then click Run.
  2. In the Run dialog box, in the Open box, type cmd, and then click OK.
  3. In the command prompt window, type the following:

    <path> setspn.exe -A MSSQLSvc/SQL1.adatum.com:1433 cslm

    where <path> is the drive and folder path to the file named setspn.exe.

  4. To verify that the SPN has been set, type the following in the command prompt window:

    setspn –L SQL1

You perform the following procedure on the server named Commerce1 to verify that host/WebServerNetBIOS and host/WebServerDNSName exists.

To verify that SPN is set on Commerce1

  1. Click Start, and then click Run.
  2. In the Run dialog box, in the Open box, type cmd, and then click OK.
  3. In the command prompt window, type the following:

    Run setspn –L Commerce1

For more information about the setspn.exe command line utility, see the Microsoft Windows 2000 Resource Kit Utility help.


Creating Required Accounts on the Data Tier Domain Controller

After you have configured the data tier domain controller, you create user accounts on the computer for Business Desk users (a group account) and the following services: List Manager, Predictor, and Direct Mailer. This topic describes how to create the necessary accounts listed in the following table for this sample secure deployment.

User or group account | Description
CSCOMPlus | User account for the Config COM+ application.
CSDM | User account for the Direct Mailer service.
CSLM | User account for the List Manager service.
CSPred | User account for the Predictor service.
BDGroup | Group account for Business Desk users.
ReportAdvanced | Group account for Business Desk users who must save dynamic reports, modify reports, and delete reports.
SegmentViewerGroup | Group account for Business Desk users who work with the Segment Viewer module.
DTSImport | Group account for system administrators who run the Data Transformation Services (DTS) tasks to import and extend the Data Warehouse.

No accounts are required for the Retail Solution Site on the presentation tier domain controller.

In this example, the computer name of the data tier domain controller is DC2, which is the adatum.com domain.

You perform the following procedure on the server named DC2.

To create accounts on the data tier domain controller

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  2. In the Active Directory Users and Computers screen, expand adatum.com, right-click Users, point to New, and then click User.
  3. In the New Object - User dialog box, type the first name, last name, and user logon name for the user account.
    Note Refer to the User or group account column in the table in this topic for a list of the user logon names to create.
  4. Click Next.
  5. In the Password box, type a password for this user account, in the confirm password box, retype the password, and then click Next.
    Note You should chose a strong password and each user account should have a different password.
  6. Click Finish.
  7. Perform steps 2 through 6 for each name listed in the User or group account column in the table in this topic.
  8. Close the Active Directory Users and Computers screen.

You have created the new user accounts on the data tier DC2 domain controller.


Creating Required Accounts on the Presentation Tier Domain Controller

Because you are using Windows Authentication to authenticate users, you must create a domain account on the contoso.com domain to which you can re-map the IUSR_DC1 user account on the server named Web1.

You perform the following procedure on the server named DC1.

To create accounts on the presentation tier domain controller

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  2. In the Active Directory Users and Computers screen, expand contoso.com, right-click Users, point to New, and then click User.
  3. In the New Object - User dialog box, type the first name, last name, and user logon name for the user account.

    For this sample secure deployment, type Anonymous for the user logon name.

  4. Click Next.
  5. In the Password box, type a password for this user account, in the Confirm password box, retype the password, and then click Next.
    Note You should chose a strong password and each user account should be a different password.
  6. Click Finish.
  7. Close the Active Directory Users and Computers screen.

A new domain account is created on the contoso.com domain controller.


Creating a Trust Relationship Between Domains

To allow the domain controller in the presentation tier (Contoso.com) to authenticate users that are stored in the data tier domain (Adatum.com) you must configure a trust relationship between these domains. In this trust relationship, the Contoso.com domain trusts the Adatum.com domain, but the Adatum.com domain does not trust the Contoso.com domain.

Before you configure the trust relationship, you must first configure the Windows registry and create a secondary zone on both domain controllers.

This section contains:

  • Configuring the Registry on the Domain Controllers
  • Configuring a Secondary DNS Zone on the Domain Controllers
  • Adding the Published IP Address to DNS
  • Configuring the Trust Relationship


Configuring the Registry on the Domain Controllers

You must perform the following procedure separately on the servers named DC1 and DC2.

To configure the registry on the domain controllers

  1. Click Start, click Run
  2. In the Run dialog box, in the Open box, type %windir%\system32\regedt32, and then click OK.
  3. In the Registry Editor, in the HKEY_LOCAL_MACHINE on Local Machine window, expand SYSTEM, expand CurrentControlSet, expand Services, expand NTDS, and then expand Parameters.
  4. On the Edit menu, click Add Value.
  5. In the Add Value dialog box, do the following:
    Use this | To do this
    Value Name Type TCP/IP Port.

    Note This value name is case-sensitive.
    Data Type | Select REG_DWORD from the drop-down list.
  6. Click OK.
  7. In the DWORD Editor dialog box, in the Data box, type 65432, and then click OK.
    Note This is the same port number that you used to create the AD Replication protocol definition. For more information, see Creating Data Tier ISA Server Protocol Definitions to Allow Trust Relationships Between Domains.
    Note You must use the same port number when configuring both domain controllers.
  8. To close the Registry Editor, on the Registry menu, click Exit.
  9. Repeat steps 1 through 7 to configure the registry for the other domain controller.

The registries have been configured on the domain controllers named DC1 and DC2.


Configuring a Secondary DNS Zone on the Domain Controllers

Before configuring a trust relationship between your domain controllers, you must first create a secondary domain name server (DNS) zone on both domain controllers using the following procedure. In this sample secure deployment, the domain controllers are the servers named DC1 and DC2.

To add a secondary DNS zone for the server named DC1

To add a secondary DNS zone for the server named DC2

You perform the following procedure on the server named DC1.

To add a secondary DNS zone for the server named DC1

  1. Click Start, point to Programs, point to Administrative Tools, and then click DNS.
  2. In the DNS screen, in the tree structure, expand DC1, right-click Forward Lookup Zones, and then click New Zone.
  3. In the Welcome to the New Zone Wizard dialog box, click Next.
  4. In the New Zone Wizard dialog box, select Standard secondary, and then click Next.
  5. In the Zone Name dialog box, in the Name box, type Adatum.com, and then click Next.
    Note The name adatum.com is the name of the secondary DNS zone used in this sample secure deployment.
  6. In the Master DNS Servers dialog box, in the IP address box, type 10.100.100.100, click Add, and then click Next.
    Note If the "Zone not loaded by DNS Server" message appears, you must restart the DNS service.
  7. In the Completing the New Zone Wizard dialog box, click Finish.

A secondary DNS zone for the DC1 server is added.

You perform the following procedure on the server named DC2.

To add a secondary DNS zone for the server named DC2

  1. Click Start, click Programs, click Administrative Tools, and then click DNS.
  2. In the DNS screen, in the tree structure, expand DC2, right-click Forward Lookup Zones, and then click New Zone.
  3. In the Welcome to the New Zone Wizard dialog box, click Next.
  4. In the New Zone Wizard dialog box, select Standard secondary, and then click Next.
  5. In the Zone Name dialog box, in the Name box, type Contoso.com and then click Next.
    Note The name data.com is the name of the secondary DNS zone used in this sample secure deployment.
  6. In the Master DNS Servers dialog box, in the IP address box, type 10.200.200.100, click Add, and then click Next.
    Note If the "Zone not loaded by DNS Server" message appears, you must restart the DNS service.
  7. In the Completing the New Zone Wizard dialog box, click Finish.

A secondary DNS zone for the DC2 server DC2 is added.


Adding the Published IP Address to DNS

You perform the following procedure on the server named DC2.

To add the published IP address to DNS

  1. Click Start, point to Programs, point to Administrative Tools, and then click DNS.
  2. In the DNS screen, in the tree structure, expand DC2, expand Forward Lookup Zones, right-click Adatum.com, and then select Properties.
  3. In the Adatum.com Properties dialog box, on the Name Servers tab, in the Server Name column, select DC2.Adatum.com, and then click Edit.
  4. In the Edit Record dialog box, in the IP address box, type 10.200.200.97, click Add, and then click OK.
    Note The IP Address column should display the 10.100.100.100 and 10.200.200.97 IP addresses.
  5. To close the Adatum.com Properties dialog box, click OK.
  6. To close the DNS screen, from the Console menu, click Exit.

The published IP address is added to domain name server (DNS).


Configuring the Trust Relationship

A trust relationship between Windows 2000 domains requires configuration on both domain controllers that are included in the trust relationship. You must first configure the trust relationship for the DC2 server, and then configure the trust relationship for the DC1 server.

You perform the following procedures to configure a one-way trust relationship for the DC2 server, which stores user credentials for members of the Adatum.com domain, and the DC1 server, which stores user credentials for members of the contoso.com domain.

To configure DC2 for a trust relationship

To configure DC1 for a trust relationship

To configure the DC2 server for a trust relationship

  1. Log on to the DC2 server as an administrator.
  2. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Domains and Trusts.
  3. Right click adatum.com, and then click Properties.
  4. In the adatum.com Properties dialog box, on the Trusts tab, in the Domains trusted by this domain section, click Add.
  5. In the Add Trusted Domain dialog box, do the following:
    Use this | To do this
    Trusted domain | Type contoso.
    Password | Type a strong password.
    Confirm password | Type a strong password.
    Note You must use the same password when completing this trust relationship on the other domain controller later in this topic.
  6. Click OK.
  7. In the Active Directory dialog box, click No.

The DC2 server is configured for a trust relationship.

To configure DC1 for a trust relationship

  1. Log on to the DC1 server as an administrator.
  2. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Domains and Trusts.
  3. Right click contoso.com, and then click Properties.
  4. In the contoso.com Properties dialog box, on the Trusts tab, in the Domains that trust this domain section, click Add.
  5. In the Add Trusted Domain dialog box, do the following:
    Use this | To do this
    Trusted domain | Type adatum.
    Password | Type a strong password.
    Confirm password | Type a strong password.
    Note You must use the same password that you used in step 5 of To configure DC2 for trust relationship
  6. Click OK.
  7. In the Active Directory dialog box, click OK.

The DC1 server is configured for a trust relationship.


Installing and Configuring the SQL Servers

In this sample secure deployment, you install and configure two SQL Server computers: one for the Commerce Server runtime databases, and another for the Data Warehouse.

This section contains:

  • Installing SQL Server 2000
  • Installing SQL Server 2000 Analysis Services
  • Installing SQL Server 2000 Service Packs
  • Configuring SQL Server 2000


Installing SQL Server 2000

You must perform this procedure separately on the SQL1 and SQL2 Servers. In this sample secure deployment, the Server named SQL1 hosts the Commerce Server runtime databases, and the server named SQL2 hosts the Data Warehouse.

Note If you want to use the Commerce Server Data Warehouse Import Wizard, you must also install SQL Server 2000 on the server named Commerce1.

To install SQL Server 2000

  1. Insert the SQL 2000 CD into the CD-ROM drive.
  2. Click SQL Server 2000 Components.
  3. Click Install Database Server.
  4. In the Welcome screen, click Next.
  5. In the Computer Name screen, select Local Computer, and then click Next.
  6. In the Installation Selection screen, select Create a new instance of SQL Server, or install Client Tools, and then click Next.
  7. In the User Information screen, do the following:
    Use this | To do this
    Name | Type the name of the server on which you are installing SQL server. For example, if you are installing on the server named SQL1, then type SQL1.
    Company | Leave this box blank.
  8. Click Next.
  9. In the Software License Agreement screen, click Yes to proceed.
  10. In the CD-Key screen, type your 25-digit CD-Key, and then click Next.
  11. In the Installation Definition screen, select Server and Client Tools, and then click Next.
  12. In the Instance Name screen, click Next.
  13. In the Setup Type screen, select Custom, and then click Next.
  14. In the Select Components screen, in the Sub-Components box, ensure that the Full-Text Search check box is selected, and then click Next.
  15. In the Services Accounts screen, in the Service Settings section, select Use the Local System account, and then click Next.
  16. In the Authentication Mode screen, select Mixed Mode (Windows Authentication and SQL Server Authentication), and then do the following:
    Use this | To do this
    Password | Type a strong password for the sa login.
    Confirm password | Re-type the password for the sa login.
    Important Do not select the Blank Password check box. Doing so poses a severe security risk to your SQL Server.
  17. Click Next.
  18. In the Collation Settings screen, select SQL Collations, ensure that Dictionary order, case-insensitive, for use with 1252 character set is selected, and then click Next.
    Note When SQL Server Setup detects that a computer is running the U.S. English locale, SQL Server Setup automatically selects the following SQL collation: Dictionary order, case-insensitive, for use with 1252 character set. Do not change this to case-sensitive. Commerce Server Setup will complete if you are using accent-sensitive, but will fail if the collation is binary or case-sensitive.
  19. In the Network Libraries screen, clear the Named Pipes check box, verify that the TCP/IP Sockets check box is selected and that the port number is 1433, and then click Next.
  20. In the Start Copying Files screen, click Next.
  21. In the Choose Licensing Mode screen, select the appropriate licensing mode, select the appropriate number of devices or processors as applicable, and then click Continue.
  22. In the Setup Complete screen, click Finish.
  23. Repeat steps 1 through 22 on the other SQL Server.

SQL Server 2000 is installed on the SQL1 and SQL2 servers.


Installing SQL Server 2000 Analysis Services

You perform the following procedure separately on the SQL2 and Commerce1 servers.

To install SQL Server 2000 Analysis Services

  1. Insert the SQL 2000 CD.
  2. Select SQL Server 2000 Components.
  3. Select Install Analysis Services.
  4. In the Welcome screen, click Next.
  5. In the Software License Agreement screen, click Yes to continue.
  6. In the Select Components screen, click Next.
  7. In the Data Folder Location screen, click Next.
  8. In the Select Program Folder screen, click Next.
  9. In the Setup Complete screen, click Finish.
  10. Repeat steps 1 through 9 for the other servers.

SQL Server 2000 Analysis Services is installed on the SQL2 and Commerce1 servers.


Installing SQL Server 2000 Service Packs

You must install SQL Server 2000 Service Pack 2 on both SQL servers. If you installed SQL Server 2000 (optional) on the Commerce1 server, then you must install SQL Server 2000 Service Pack 2 on the Commerce1 server. Additionally, you must install SQL Server 2000 Analysis Services Service Pack 2 on the computers on which you installed SQL Server 2000 Analysis Services, which are named SQL1, SQL2 and Commerce1.

For information about installing SQL Server 2000 Service Pack 2, and SQL Server 2000 Analysis Services Service Pack 2, see the Commerce Server 2002 Installation Guide at http://go.microsoft.com/fwlink/?LinkId=6125.


Configuring SQL Server 2000

In this section, you configure the distributed transaction coordinator (DTC) communication on both SQL Server computers to use the default gateway of the data tier Microsoft Internet Security and Acceleration (ISA) Server (ISA2). You configure the SQL server that hosts the Commerce Server runtime databases, and then you configure the SQL server that hosts the Data Warehouse.

This section contains:

  • Creating Registry Keys for SQL1
  • Configuring the HOSTS File on SQL1
  • Verifying that the Named Pipes are Disabled on the SQL Servers
  • Configuring DTC Communication on the SQL Servers
  • Creating SQL Login Accounts for Each Required Account
  • Mapping the User Login Account to the Database Owner User
  • Configuring SQL Server 2000 Analysis Services
  • Enabling Delegation for the CSSQL User Account
  • Configuring SQL Server to Run as the CSSQL Account
  • Creating a Link Between SQL Servers


Creating Registry Keys for SQL1

You must create a registry key on the data tier SQL server named SQL1. This registry key specifies ports to open that allow distributed transaction coordinator (DTC) to work through a firewall. You perform the following procedure on SQL1 to create the registry key, specify that the ports are to be made Internet-available, and to dynamically assign these ports.

To create the registry key on SQL1

To specify that the ports be made Internet-available

To dynamically assign the ports

To create the registry key on SQL1

  1. Click Start, and then click Run
  2. In the Run dialog box, in the Open box, type %windir%\system32\regedt32, and then click OK.
    Note You must use Regedt32.exe, rather than Regedit.exe. Regedit.exe does not support the REG_MULTI_SZ data type that is required for the Ports value.
  3. In the Registry Editor, on the Window menu, select HKEY_LOCAL_MACHINE on Local Machine.
  4. In the HKEY_LOCAL_MACHINE on Local Machine window, expand SOFTWARE, expand Microsoft, and then expand Rpc.
  5. Click the Rpc folder, and then on the Edit menu, click Add Key.
  6. In the Add Key dialog box, in the Key Name box, type Internet, and then click OK.
  7. Click the Internet folder, and then on the Edit menu, click Add Value.
  8. In the Add Value dialog box, do the following:
    Use this | To do this
    Value Name Type Ports.
    Note This value name is case-sensitive.
    Data Type | Select REG_MULTI_SZ from the drop-down list.
  9. Click OK.
  10. In the Multi_String Editor dialog box, in the Data box, type 5000-5030, and then click OK.
Note This string value specifies the inclusive range of ports to open.

The registry key on the SQL1 server is created. Do not close the Registry Editor. You must specify that the ports be made Internet-available.

To specify that the ports be made Internet-available

  1. Click the Internet folder, and then on the Edit menu, click Add Value.
  2. In the Add Value dialog box, do the following:
    Use this | To do this
    Value Name Type PortsInternetAvailable.
    Note This value name is case-sensitive.
    Data Type | Select REG_SZ from the drop-down list.
  3. Click OK.
  4. In the String Editor dialog box, in the String box, type Y, and then click OK.

The ports listed under the Ports value are Internet-available. Do not close the Registry Editor. You must dynamically assign the ports.

To dynamically assign the ports

  1. Click the Internet folder, and then on the Edit menu click Add Value.
  2. In the Add Value dialog box, do the following:
    Use this | To do this
    Value Name Type UseInternetPorts.
    Note This value name is case-sensitive.
    Data Type | Select REG_SZ from the drop-down list.
  3. Click OK.
  4. In the String Editor dialog box, in the String box, type Y, and then click OK.
  5. To close the Registry Editor, on the Registry menu, click Exit.
  6. To allow remote procedure calls (RPCs) to use the registry settings, you must restart the computer.

The RPC will dynamically assign ports from the list of Internet ports.


Configuring the HOSTS File on SQL1

In this topic, you add entries to the HOSTS file on the SQL1 server to allow the NetBIOS name of the Web server (Web1) to resolve the IP address of Web1. The HOSTS file is used to look up IP addresses in the event that the domain name server (DNS) service running on the domain controller fails.

To configure the HOSTS file on SQL1

  1. On the Business Desk server, navigate to the HOSTS file, for example, %systemroot%\system32\drivers\etc\HOSTS.
  2. Open the HOSTS file using a text editor such as Notepad.
  3. Search for the following line in the HOSTS file:

    127.0.0.1 localhost

  4. Add the following line below the line from step 3:

    10.200.200.99 Web1

  5. Save the HOSTS file and close the text editor.

The HOSTS file is configured on SQL1.


Verifying the Named Pipes are Disabled on the SQL Servers

You perform this procedure on the SQL1 and SQL2 servers.

To verify the Named Pipes are disabled on the SQL1 and SQL2 servers

  1. Click Start, point to Programs, point to Microsoft SQL Server, and then click Server Network Utility.
  2. In the SQL Server Network Utility dialog box, on the General tab, verify that Named Pipes is disabled.
  3. On the General tab, select TCP/IP, and then click Properties. Verify the port is 1433.


Configuring DTC Communication on the SQL Servers

You perform this procedure on the SQL1 and SQL2 servers.

To configure DTC communication on the SQL1 and SQL2 servers

  1. Click Start, point to Programs, point to Administrative Tools, and then click Component Services.
  2. In Component Services, expand Component Services, and then expand Computers.
  3. Right-click My Computer, and then click Properties.
  4. On the Default Protocols tab, select Connection-oriented TCP/IP, and then click Properties.
  5. In the Properties for COM Internet Services dialog box, click Add.
  6. In the Add port range dialog box, type the secondary port range (for example, 5000-5030), and then click OK.

The DTC communication on the SQL1 and SQL2 servers is configured.


Creating SQL Login Accounts for Each Required Account

In this procedure, you create SQL login accounts on the SQL Servers. The following table lists the accounts you will create and the SQL Server(s) on which to create them.

Account | Account name | Domain | SQL Server
Run-time users | Contoso\Anonymous | Contoso.com | SQL1
MSSQLSERVER service | Adatum\CSSQL | Adatum.com | SQL1
Direct Mailer service | Adatum\CSDM | Adatum.com | SQL1
List Manager service | Adatum\CSLM | Adatum.com | SQL1 and SQL2
Predictor service | Adatum\CSPred | Adatum.com | SQL1 and SQL2
Business Desk group | Adatum\BDGroup | Adatum.com | SQL1 and SQL2
Advanced Report group | Adatum\ReportAdvanced | Adatum.com | SQL2
Segment Viewer group | Adatum\SegmentViewer | Adatum.com | SQL2
DTS Task Import group | Adatum\DTSImport | Adatum.com | SQL1 and SQL2 See note below.
Config COM+ application | Adatum\CSCOMPlus | Adatum.com | SQL2
Note If you want to use the Commerce Server Data Warehouse Import Wizard, you must also create the DTSImport account on the server named Commerce1.

You perform the following procedure on the SQL1 and SQL2 servers.

To create a SQL login account

  1. Click Start, point to Programs, point to Microsoft SQL Server, and then click Enterprise Manager.
  2. In SQL Server Enterprise Manager, expand the nodes to the following path: Microsoft SQL Servers/SQL Server Group/<computer name>/Security.
  3. Right-click Login, and then click New Login.
  4. In the SQL Server Login Properties - New Login screen, on the General tab, do the following:
    Use this | To do this
    Name | Type the name of the domain user account listed in the Account name column of the preceding accounts table.
    Windows Authentication | Verify that this option is selected.
    Domain Select the domain for this account from the drop-down list.
    Note The domain is listed in the Domain column of the preceding accounts table.
    Grant access | Verify that this option is selected for security access.
    Database | Select master as the database for this login from the drop-down list.
    Language | Select the default language for this login from the drop-down list.
  5. Click OK.
  6. Repeat steps 1 through 5 until you have created a SQL Server login account for each of the domain accounts listed in the preceding accounts table.


Mapping the User Login Account to the Database Owner User

You perform the following procedure for users who will run the Commerce Server Data Transformation Services (DTS) tasks, and for the List Manager service account. After you map the user login account to the Database Owner (dbo) user, any objects that are created by the DTS tasks will be owned by the dbo user.

For example, if you log on as "joeuser," and are not mapped to the dbo user, when you run the DTS tasks, the extended Data Warehouse table names will be owned by "joeuser" and will be qualified incorrectly as "joeuser.<table>."

By performing this procedure, you ensure that the table names will be correctly qualified as "dbo.<table>."

For information about database owner (dbo), and about using sp_addalias, see SQL Server Books Online.

To map the user login account to dbo user

  1. Click Start, point to Programs, point to Microsoft SQL Server, and then click SQL Query Analyzer.
  2. In the Connect to SQL Server dialog box, specify the appropriate SQL server.
  3. In Query Analyzer, in the database drop-down box, select the Data Warehouse database.
  4. In the Query Analyzer window, type exec sp_addalias 'domain\login_name','dbo'.
    Note This step must be performed separately for each user added to the Adatum\DTSimport group.

    For example, to map joeuser to dbo user, you type Exec sp_addalias '<domain>\joeuser','dbo' in the Query Analyzer window.

    • This code can only be applied to a user, not a user group.
  5. To run the query, click [image] on the toolbar.

    The user account you specified is now mapped to the database owner (dbo) user.

  6. Repeat this step to assign the dbo alias to the List Manager user to Data Warehouse.

    For example, type Exec sp_addalias '<domain>\CSLM','dbo' in the Query Analyzer window.


Configuring SQL Server 2000 Analysis Services

In this step, you migrate the OLAP repository so it resides on the SQL2 server. You do this to improve the security of your OLAP repository. Then you assign the appropriate permissions to the DTS_Import user account to access the repository.

To create the OLAPRepository database

To migrate the OLAP repository to the SQL2 server

To assign the DTS_Import user account appropriate permissions

To provide Full Control to the bin directory

You perform the following procedure on the SQL1 server.

To create the OLAPRepository database

  1. Click Start, point to Programs, point to Microsoft SQL Server, and then click Enterprise Manager.
  2. In the SQL Server Enterprise Manager screen, in the tree structure, expand Microsoft SQL Servers, expand SQL Server Group, expand SQL1 (Windows NT), right-click Databases, and then click New Database.
  3. In the Database Properties dialog box, in the Name box, type OLAPRepository, and then click OK.

    The OLAPRepository database appears in the Databases pane.

  4. Close SQL Server Enterprise Manager.

To migrate the OLAP repository to the SQL2 server

  1. Click Start, point to Programs, point to Microsoft SQL Server, click Analysis Services, and then click Analysis Manager.
  2. In Analysis Manager, in the tree structure, expand Analysis Servers, right-click SQL1, and then click Migrate Repository.
  3. In the Migrate Repository Wizard:SQL1 screen, select SQL Server 7.0 OLAP Services format, and then click Next.
  4. Select the SQL Server name where the OLAP repository database will reside, and then click Next. In this sample secure deployment, select SQL2.
  5. Select Windows authentication using the network login ID, and then click Next.
  6. Select OLAPRepository from the Database drop-down list, and then click Finish.

You assign the DTS_Import account to the OLAP Administrator group for both the OLAP server and the SQL Server. You perform the following procedure on the servers named SQL1 and SQL2.

To assign the DTS_Import user account appropriate permissions

  1. Log on as administrator to the SQL server.
  2. Click Start, point to Programs, point to Administrative Tools, and then click Computer Management.
  3. In the Computer Management screen, in the tree structure, expand System Tools, expand Local Users and Groups, and then click Groups.
  4. In the right pane, in the Name column, right-click OLAP Administrators, and then click Properties.
  5. In the OLAP Administrators Properties property sheet, click Add.
  6. In the Select Users or Groups dialog box, type adatum\DTSImport, and then click OK.

    This step adds the DTSImport group as a member of the OLAP Administrators group.

  7. To close the OLAP Administrators Properties property sheet, click OK.
  8. Close the Computer Management screen.

To provide Full Control to the bin directory

  1. On the OLAP server, navigate to the <olap_server_root>\bin directory, for example, \Program Files\Microsoft Analysis Services\Bin.
  2. Right-click Bin, and then click Properties.
  3. In the Bin Properties property sheet, on the Security tab, click ADD.
  4. In the box, type ADATUM\DTSimport and then click OK.
  5. In the Bin Properties property sheet, select ADATUM\DTSimport.
  6. In the Permissions section, in the Full Control row, select Allow, and then click OK.
Note In this security context, the debug messages generated by this task will not be shown. This is documented in Microsoft Knowledge Base article Q274559. The workaround is to have this user use the local Administrator account.


Enabling Delegation for the CSSQL User Account

You must enable the adatum\CSSQL user account for delegation. You perform the following procedure on the computer named DC2.

To enable delegation for the CSSQL user account

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  2. In the Active Directory Users and Computers screen, in the tree structure, expand adatum.com, and then click Users.
  3. In the Users pane, right-click cssql, and then click Properties.
  4. In the cssql Properties dialog box, in the Account pane, in the Account options section, scroll down and select Account is trusted for delegation, and then click OK.
  5. Close the Active Directory Users and Computers screen.

Delegation for the CSSQL user account is enabled.


Configuring SQL Server to Run as the CSSQL Account

In this topic, you configure the MSSQLSERVER service to run as the Adatum\CSSQL user account, which you created in Creating SQL Login Accounts for Each Required Account. After you configure the MSSQLSERVER service, you must restart the service for the changes to take effect.

To configure SQL server to run as the CSSQL account

To restart the MSSQLSERVER service

To configure the SQL1 server to run as the CSSQL account

  1. Click Start, point to Programs, point to Administrative Tools, and then click Services.
  2. In the right pane, scroll down and right-click MSSQLSERVER, and then click Properties.
  3. In the MSSQLSERVER Properties (Local Computer) property sheet, on the LogOn tab, select This account, and then do the following:
    Use this | To do this
    This Account | Type adatum\CSSQL.
    Password | Use the strong password that you used when you created the adatum\CSSQL account in Creating Required Accounts on the Data Tier Domain Controller.
    Confirm password | Use the strong password that you used when you created the adatum\CSSQL account in Creating Required Accounts on the Data Tier Domain Controller.
  4. Click OK.

SQL Server is configured to run as the Adatum\CSSQL user account.

To restart the MSSQLSERVER service

  1. In the Services screen, in the Name column, right-click MSSQLSERVER, and then click Restart.
  2. Close the Services screen.

The MSSQLSERVER service is restarted.


Creating a Link Between SQL Servers

To allow your SQL Server to query another SQL Server, you must create a link between the SQL Servers. To create a link between the SQL1 and SQL2 servers, perform the following procedure on the SQL1 server.

To create a link between the SQL1 and SQL2 servers

  1. Click Start, point to Programs, point to Microsoft SQL Server, and then click Enterprise Manager.
  2. In the SQL Server Enterprise Manager screen, in the tree structure, expand Microsoft SQL Servers, expand SQL1 (Windows NT), expand Security, right-click Linked Servers, and then click New Linked Server.
  3. In the Linked Server Properties - New Linked Server dialog box, in the Linked server box, type SQL2.
  4. In the Server type section, select SQL Server.
  5. On the Security tab, in the Local Login column, type adatum\cslm, and then select Impersonate.
  6. Select Be made using the login's current security context, and then click OK.
  7. Close the SQL Server Enterprise Manager screen.

A link is created between the SQL1 and SQL2 servers.


Installing Commerce Server

This section contains:

  • Installing Prerequisite Components
  • Installing Commerce Server 2002 on the Business Desk Server
  • Unpacking the Business Desk Application
  • Configuring the Business Desk Server
  • Enabling Users to Run the Model Builder DTS Task
  • Enabling the Business Desk Server for Delegation


Installing Prerequisite Components

Before installing Commerce Server 2002, you must install the following prerequisite components on the Commerce1 server:

  • Office Web Components
  • MSXML 3.0 SP2
  • MSXML 4.0
  • MDAC 2.7
  • MDAC 2.7 Hotfix Rollup
  • Internet Explorer 5.5 or higher

For instructions about installing the prerequisite components, see Installing Commerce Server 2002.


Installing Commerce Server 2002 on the Business Desk Server

You must install Commerce Server 2002 on the server named Commerce1. Follow the instructions in the topic "Installing Commerce Server 2002 on One Computer" in Installing Commerce Server 2002.

Note the following:

  • In the Setup Type screen, select Complete.
  • In the Administration Database Configuration screen, in the SQL Server Computer box, type SQL1. Select Use Windows Integrated Security.
  • In the Direct Mailer Database Configuration screen, in the SQL Server Computer box, type SQL1. Select Use Windows Integrated Security.

To configure the Service Accounts screen

  1. In the Service Accounts screen, clear the Use the same account for each service and set all to auto start check box.
  2. In the Services section, click Direct Mailer.
  3. In the Service Settings section, do the following:
    Use this | To do this
    Username | Type CSDM.
    Password | Type the password that you assigned to the adatum\CSDM user account when you created this account in Creating Required Accounts on the Data Tier Domain Controller.
    Domain | Type adatum.
  4. In the Services section, click List Manager.
  5. In the Service Settings section, do the following:
    Use this | To do this
    Username | Type CSLM.
    Password | Type the password that you assigned to the adatum\CSLM user account when you created this account in Creating Required Accounts on the Data Tier Domain Controller.
    Domain | Type adatum.
  6. In the Services section, click Predictor.
  7. In the Service Settings section, do the following:
    Use this | To do this
    Username | Type CSPRED.
    Password | Type the password that you assigned to the adatum\CSPRED user account when you created this account in Creating Required Accounts on the Data Tier Domain Controller.
    Domain | Type adatum.
  8. In the Services section, click COM+ Identities.
  9. In the Service Settings section, do the following:
    Use this | To do this
    Username | Type CSCOMPLUS.
    Password | Type the password that you assigned to the adatum\CSCOMPLUS user account when you created this account in Creating Required Accounts on the Data Tier Domain Controller.
    Domain | Type adatum.


Unpacking the Business Desk Application

You must install only the Business Desk application on the server named Commerce1. Follow the instructions in "Unpacking a Site to a Remote Web Server" in Commerce Server 2002 Help.

Note the following:

  • In the Global Resource Pointers dialog box, accept the default settings.
  • In the Database Connection Strings dialog box, install all resources to the SQL1 server except for the Data Warehouse resource. Install the Data Warehouse resource on the SQL2 server.
  • In the Commerce Server Site Packager dialog box, select Use Windows Integrated Security.
  • In the Select Applications dialog box, clear the retail check box. Select only the retailbizdesk check box.
  • In the Select IIS Computers, Web Sites and Paths dialog box, in the Application column, select retailbizdesk. In the IIS computer name box, type Commerce1.


Configuring the Business Desk Server

If you want to run the Commerce Server Business Desk on the Client1 computer, then you must install and configure Internet Explorer on Commerce1. Running the Business Desk application from the Commerce1 computer is optional because you use the Client1 computer to access Business Desk. You must update the HOSTS file and create a static route for Commerce1.

This section contains:

  • Installing and Configuring Internet Explorer for Commerce1
  • Updating the HOSTS File for Commerce1
  • Creating a Static Route for Commerce1


Installing and Configuring Internet Explorer for Commerce1

If you want to access Commerce Server Business Desk on the Commerce1 computer, then you must install and configure Internet Explorer 5.5 or later on Commerce1. Running the Business Desk application from the Commerce1 computer is optional because you use the Client1 computer to access Business Desk. If you do not want to access Business Desk on the Commerce1 computer, then proceed to Updating the HOSTS File for Commerce1.

To install Internet Explorer on Commerce1

To configure proxy server settings for Commerce1

To enable Internet Explorer for Integrated Windows Authentication

To install Internet Explorer on Commerce1

  • You install Internet Explorer 5.5 or later on the Commerce1 server using the default settings. You will configure settings that are specific to this sample secure deployment later in this section. You can download Internet Explorer from the Microsoft Downloads page.
    Note If you installed Internet Explorer (optional) on Commerce1, then you must configure the proxy server settings in Internet Explorer on the server named Commerce1. This enables the Commerce1 server to direct network traffic to the Microsoft Internet Security and Acceleration (ISA) Server in the data tier, which is named ISA2.

To configure proxy server settings for Commerce1

  1. On the Business Desk server, on the desktop, right-click Internet Explorer, and then click Properties.
  2. In the Internet Properties dialog box, on the Connections tab, click LAN settings.
  3. In the Local Area Network (LAN) Settings dialog box, select Use a proxy server for your LAN.
  4. In the Address box, type 10.100.100.99 and accept the default port number.

    This is the IP address of the network adapter, which is on the data tier for the server named ISA2.

    Important Verify that the Bypass proxy server for local addresses is not selected.
  5. Click OK.

The proxy server settings are configured for the Commerce1 server.

If you installed Internet Explorer 6.0, then you must perform the following procedure on the server named Commerce1. Otherwise, proceed to Updating the HOSTS File for Commerce1.

To enable Internet Explorer for Integrated Windows Authentication

  1. On the desktop, double-click Internet Explorer.
  2. In Internet Explorer, on theTools menu, click Internet Options.
  3. In the Internet Options dialog box, on the Advanced tab, scroll to the Security section, and then selectEnable Integrated Windows Authentication
  4. To close theInternet Options dialog box, click OK.
  5. Restart the client computer.

Integrated Windows Authentication is enabled.


Updating the HOSTS File for Commerce1

In this step, you add entries to the hosts file on the Business Desk server, which allow the NetBIOS name and fully qualified domain name (www.contoso.com) of the Web server (Web1) to resolve the IP address of Web1. The HOSTS file is used to look up IP addresses in the event that the domain name server (DNS) service running on the domain controller fails.

To add the domain IP address to the HOSTS file on the Business Desk server

  1. On the Business Desk server, navigate to the HOSTS file, for example, %systemroot%\system32\drivers\etc\HOSTS.
  2. Open the HOSTS file using a text editor such as Notepad.
  3. Search for the following line in the HOSTS file:

    127.0.0.1 localhost

  4. Add the following line below the line from step 3:

    10.200.200.99 Web1

  5. Save the HOSTS file and close the text editor.

The HOSTS file is updated for the Commerce1 server.


Creating a Static Route for Commerce1

If you are not using routers in your deployment, then you must configure a static route on the server named Commerce1 to ensure that traffic is routed from the Commerce1 server to the Web server.

You perform the following procedure on the Commerce1 server.

Creating a static route for Commerce1

  1. Click Start, and then click Run.
  2. In the Run dialog box, in the Open box, type cmd, and then click OK.
  3. In the command prompt window, type Route add -p 10.200.200.99 255.255.255.255 10.100.100.99, and then press ENTER.
  4. Close the command prompt window.

A static route for the Commerce1 server is created.


Enabling Users to Run the Model Builder DTS Task

Before you can run the Model Builder Data Transformation Services (DTS) task, you must first add your account to the security context of the Predictor service component, that is, to a list of user accounts that have permission to call the Predictor service.

If you are setting up the Model Builder task to run on a scheduled basis, you must also add the account for SQL Agent to list the users that have permission to call the Predictor service.

You perform the following procedure on the Commerce1 server.

To add your account to the Predictor security context

  1. Log on to the Commerce1 server as an administrator.
  2. Click Start, and then click Run.
  3. In the Run dialog box, in the Open box, type Dcomcnfg, and then click OK.
  4. On the Applications tab, select Microsoft Commerce Server Predictor Service, and then click Properties.
  5. On the Security tab, select Use custom access permissions, and then click Edit.
  6. In the Registry Value Permissions dialog box, click Add.
  7. To run the Model Builder task, in the Type of Access box, add the Adatum\CSPRED user account, and then select Allow Access.
    Note The Administrators group must have the Log on as a service right.
  8. Click OK to save your the changes, click OK to exit the Properties dialog box, and then click OK to exit Dcomcnfg.
  9. Restart the Predictor service.

    For information about restarting the Predictor service, see "Restarting CS Services" in Commerce Server 2002 Help.

The administrator account is added to the Predictor security context.


Enabling the Business Desk Server for Delegation

You perform the following procedure on the server named DC2.

To configure a trusted connection for Commerce1

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  2. In the Active Directory Users and Computers screen, right-click the computer name, (Commerce1), and then click Properties.
  3. In the <computer name> Properties dialog box, on the General tab, select Trust computer for delegation, and then click OK.

A trusted connection is configured for the Commerce1 server.


Configuring the Business Desk Client Computer

This section contains:

  • Installing Internet Explorer on Client1
  • Enabling Integrated Windows Authentication in Internet Explorer
  • Assigning the Business Desk User to the Power Users Group
Note If you want to access Commerce Server Business Desk from the Client1 computer without receiving a login prompt, you must join the computer named Client1 to the adatum.com domain. Optionally, Client1 can be joined to a domain that is trusted by the adatum.com domain. Otherwise, when you access Business Desk from Client1, you will receive a login prompt. The computer on which the Business Desk client is installed must be a member of the same domain (forest) as the data tier computers, or in a trusted domain.


Installing Internet Explorer on Client1

You install Internet Explorer 5.5 or later on the Client1 computer using the default settings. You will configure settings that are specific to this sample secure deployment later in this section. You can download Internet Explorer from Microsoft Downloads page.


Enabling Integrated Windows Authentication in Internet Explorer

If you installed Internet Explorer 6.0, you perform this procedure on the Client1 computer. If you installed Internet Explorer E 5.5, proceed to Assigning the Business Desk User to the Power Users Group.

To enable Integrated Windows Authentication on the Client1 computer

  1. Click Start, point to Programs, and then click Internet Explorer.
  2. On theTools menu, click Internet Options.
  3. In the Internet Options dialog box, on the Advanced tab, scroll to the Security section, and then selectEnable Integrated Windows Authentication
  4. To close theInternet Options dialog box, click OK.
  5. Restart the client computer.

Integrated Windows Authentication is enabled on the Client 1 computer.


Assigning the Business Desk User to the Power Users Group

You perform the following procedure on the Commerce Server Business Desk computer named Client1, only if you installed Microsoft Windows 2000 on Client1. If you installed Microsoft Windows 9x on Client1, proceed to Configuring the Web Server.

To assign the Business Desk user to the Power Users group

  1. On the Business Desk client computer, click Start, point to Programs, point to Administrative Tools, and then click Computer Management.
  2. Expand Users and Groups, and then click Groups.
  3. Right-click Power Users, and then click Properties.
  4. In the Power Users Properties dialog box, add the Business Desk group account, and then click OK.

The Business Desk user is assigned to the Power Users group.


Configuring the Web Server

This section contains:

  • Mapping the Anonymous Account of the Web Site to the Anonymous Domain Account
  • Creating Registry Keys for Web1
  • Installing Commerce Server on Web1
  • Unpacking the Solution Site
  • Configuring the Default Protocols on the Web Server


Mapping the Anonymous Account of the Web Site to the Anonymous Domain Account

You perform the following procedure on the Web1 server. You must map the anonymous user account of the Web1 server (IUSR_Web1) to the anonymous domain account (Contoso\Anonymous) that you created in Creating Required Accounts on the Presentation Tier Domain Controller.

To change the anonymous account of the site to a domain account

  1. Log on to the Web1 server as an administrator.
  2. Click Start, point to Programs, point to Administrative Tools, and then click Internet Services Manager.
  3. In Internet Services Manager, navigate to your application (for example, Retail_Site).
  4. Right-click your application (for example, Retail_Site), and then click Properties.
  5. In the Properties dialog box, on the Directory Security tab, in the Anonymous access and authentication control section, click Edit.
  6. In the Authentication Methods dialog box, in the Anonymous access section, click Edit.
  7. In the Anonymous User Account dialog box, in the Username box, type the name of the anonymous domain account (for example, Contoso\Anonymous), and then type the password of the Contoso\Anonymous account.
  8. Click OK in all of the open dialog boxes to close each dialog box.
  9. Restart Internet Information Services (IIS) by running iisreset at the command prompt.

A command box appears while IIS is being reset. IIS is reset when the command box closes. The anonymous account of the site is changed to a domain account.


Creating Registry Keys for Web1

You must create a registry key on the Web1 server. This registry key enables distributed transaction coordinator (DTC) to work through a firewall.

To create the registry key on Web1

  1. Click Start, and then click Run.
  2. In the Run dialog box, in the Open box, type %windir%\system32\regedt32, and then click OK.
    Note You must use Regedt32.exe, rather than Regedit.exe. Regedit.exe does not support the REG_MULTI_SZ data type that is required for the Ports value.
  3. In the Registry Editor, from the Window menu, select HKEY_LOCAL_MACHINE on Local Machine.
  4. In the HKEY_LOCAL_MACHINE on Local Machine window, expand SOFTWARE, expand Microsoft, and then expand Rpc.
  5. Click the Rpc folder, and then on the Edit menu, click Add Key.
  6. In the Add Key dialog box, in the Key Name box, type Internet, and then click OK.
  7. Click the Internet folder, and then on the Edit menu, click Add Value.
  8. In the Add Value dialog box, do the following:
    Use this | To do this
    Value Name Type Ports.
    Note This value name is case-sensitive.
    Data Type | Select REG_MULTI_SZ from the drop-down list.
  9. Click OK.
  10. In the Multi_String Editor dialog box, in the Data box, type 5000-5030, and then click OK.
    Note This string value specifies the inclusive range of ports to open.

The registry key is created on the Web1 server. Do not close the Registry Editor. You now need to specify that these ports be made Internet-available.

To specify that these ports be made Internet-available

  1. Click the Internet folder, and then on the Edit menu, click Add Value.
  2. In the Add Value dialog box, do the following:
    Use this | To do this
    Value Name Type PortsInternetAvailable.
    Note This value name is case-sensitive.
    Data Type | Select REG_SZ from the drop-down list.
  3. Click OK.
  4. In the String Editor dialog box, in the String box, type Y, and then click OK.

This signifies that the ports listed under the Ports value are Internet-available. Do not close the Registry Editor. You now need to dynamically assign the ports.

To dynamically assign the ports

  1. Click the Internet folder, and then on the Edit menu, click Add Value.
  2. In the Add Value dialog box, do the following:
    Use this | To do this
    Value Name Type UseInternetPorts.
    Note This value name is case-sensitive.
    Data Type | Select REG_SZ from the drop-down list.
  3. Click OK.
  4. In the String Editor dialog box, in the String box type Y, and then click OK.
This signifies that RPC will dynamically assign ports from the list of Internet ports.
  1. To close the Registry Editor, on the Registry menu, click Exit.
  2. To allow RPC to use the registry settings, you must restart the computer.


Installing Commerce Server on Web1

You must install Commerce Server 2002 on the Web1 server. Follow the instructions in the "Installing Commerce Server 2002 on One Computer" section in Installing Commerce Server 2002.

Note the following:

  • In the Setup Type screen, select Web Server.


Unpacking the Solution Site

In this sample secure deployment, you unpack the Retail Solution Site on the server named Web1, and then rename the non-secure host name to the fully qualified domain name (FQDN).

To unpack the Retail Solution Site

To rename the non-secure host name

To unpack the Retail Solution Site

  • To unpack the Retail Solution Site, follow the detailed instructions in "Unpacking a Site to a Remote Web Server" in Commerce Server 2002 Help.

    Note the following:

    • In the Unpack Method screen, select Add an application in the package to an existing site.
    • In the Select Site screen, in the Existing sites section, select Retail and then click Next.
    • In the Select Applications screen, select the retail check box, and then clear the retailbizdesk check box.
    • In the Commerce Server Site Packager dialog box, select Windows Integrated Security.
    • In the Select IIS Computers, Web Sites and Paths dialog box, in the IIS computer name box, type Web1.

You perform the following procedure on the server named Commerce1.

To rename the non-secure host name

  1. Click Start, point to Programs, point to Microsoft Commerce Server 2002, and then click Commerce Server Manager.
  2. In the Commerce Server Manager screen, in the tree structure, expand Commerce Server Manager, expand Commerce Sites, expand Retail, expand Applications, right-click COMMERCE1/retail, and then click Properties.
  3. In the COMMERCE1/retail Properties property sheet, in the Nonsecure host name box, type www.contoso.com, and then click OK.
  4. Close Commerce Server Manager.

You have renamed the non-secure host name to the fully qualified domain name of the presentation tier domain.


Configuring the Default Protocols on the Web Server

You perform this step on the Web1 server. You do not need to perform this step on the Business Desk server that hosts the Business Desk application.

To configure the default protocols on the Web1 server

  1. Log on to the Web1 server as administrator.
  2. Click Start, point to Programs, point to Administrative Tools, and then click Component Services.
  3. In Component Services, expand Component Services, and then expand Computers.
  4. Right-click My Computer, and then click Properties.
  5. In the My Computer Properties dialog box, on the Default Protocols tab, select Connection-oriented TCP/IP, and then click Properties.
  6. In the Properties for COM Internet Services dialog box, click Add.
  7. In the Add port range dialog box, type the secondary port range (for example, 5000-5030), and then click OK.
  8. To close the Properties for COM Internet Services dialog box, click OK.
  9. To close the My Computer Properties dialog box, click OK.
  10. Reboot the server.


Installing the Microsoft Security Tools on the Web Server

It is recommended that you install and run the following security tools from http://go.microsoft.com/fwlink?LinkId=6689:

  • IIS Lockdown Tool
  • URLScan Security tool
  • HFNetChk security tool

IIS Lockdown Tool

Use the IIS Lockdown tool to remove all unneeded features from Internet Services Manager (for example, scripts, images, iishelp, iisadmin, and msadc). Use the Commerce Server 2000 template included with this tool.

URLScan Security Tool

Use the URLScan tool to ensure that your Web servers only respond to legitimate requests.

HFNetChk Security Tool

Use the HFNetCheck tool to scan your local and remote servers to ensure that they are up-to-date on all security patches available for Windows 2000, IIS 5.0, Internet Explorer, and SQL Server.


Securing the Commerce Server Components

This section contains:

  • Running the Commerce Server Database Security Scripts
  • Creating the DirectMailerSPexec Role
  • Adding the Required Accounts to the Database Roles
  • Securing the MSCS_Admin Tables
  • Adding the Service Accounts to the Config COM+ Application Role
  • Granting Users Business Desk Permissions


Running the Commerce Server Database Security Scripts

You run the Commerce Server security scripts to automatically create security roles for the required accounts, and assign the appropriate database permissions. These scripts are located in the Program Files\Microsoft Commerce Server\Support folder on the server where Commerce Server is installed.

To run the scripts and create the security roles

  1. Click Start, point to Programs, point to Microsoft SQL Server, and then click SQL Query Analyzer.
  2. In the Connect to SQL Server dialog box, specify the appropriate SQL Server.

    The appropriate server is listed in the Run on this SQL Server column in the table below.

  3. In Query Analyzer, in the database drop-down box, select the database you want to run the script against.

    Choose the database listed in the Run against this database column in the following table.

  4. Click File, and then click Open.
  5. Navigate to the scripts folder located in the Program Files\Microsoft Commerce Server\Support folder, and select the script you want to run.

    The script opens and the code appears in the Query Analyzer window.

  6. Click [image] on the toolbar to run the script against the selected database.
  7. Repeat steps 1 through 6 to run all the scripts against the databases listed in the following table.
Note You must run the ReportViewer.sql script before you run the ReportAdvanced.sql script.

Security Scripts for the Commerce Server Run-Time Databases

Script name | Run against this database | Run on this SQL Server
BDReaderRole and BDWriterRole | Business Desk Permissions | SQL1
CampaignReaderRole and CampaignWriterRole | Campaigns | SQL1
CatalogSecurityRoles | Product Catalog | SQL1
ProfileReaderRole and ProfileWriterRole | Profiles | SQL1
TransactionConfigReaderRole and TransactionConfigWriterRole | TransactionConfig | SQL1
TransactionReaderRole and TransactionWriterRole | Transactions | SQL1

Security Scripts for Analysis and Data Warehouse

Script | Run against this database | Run on this SQL Server
ReportViewer.sql | Data Warehouse | SQL2
ReportAdvanced.sql
Note Before running this script, you must first run the ReportViewer.sql script.
 Data Warehouse SQL2
SegmentViewer | Data Warehouse | SQL2
Dts_AdminDB_SecurityRole.sql | Administration (MSCS_Admin) | SQL1
Dts_CommerceDB_Campaign_SecurityRole.sql | Campaigns | SQL1
Dts_CommerceDB_Catalog_SecurityRole.sql | Product Catalog | SQL1
Dts_CommerceDB_Transaction_SecurityRole.sql | Transactions | SQL1
Dts_CommerceDB_UPM_SecurityRole.sql | Profiles | SQL1
Note Rerun the CatalogSecurityRoles script and the Dts_CommerceDB_Catalog_SecurityRole script after you do any of the following tasks:
  • Create new catalogs
  • Add languages to a catalog
  • Rebuild virtual catalogs
    Note Rerun the Dts_CommerceDB_Campaign_SecurityRole script after you create new campaigns.
    Note When you extend the Profiles database (create new profile definitions), manually assign permissions to the DTSImport account.
    Note The Commerce Server run-time database tables can reside in one database, or each resource can have tables in its own database.
    Note These scripts are designed to work with SQL Server, and with data stored in the Commerce Server run-time databases and the Administration database. They are not designed for use with Active Directory or Oracle databases.


Creating the DirectMailerSPexec Role

You must perform following procedure on the SQL1 server.

  1. Click Start, point to Programs, point to Microsoft SQL Server, and then click Enterprise Manager.
  2. In the SQL Server Enterprise Manager screen, in the tree structure, expand Microsoft SQL Servers, expand SQL Server Group, expand SQL1 (Windows NT), expand Databases, expand MSCS_Admin, right-click Roles, and then click New Database Role.
  3. In the Database Role Properties - New Role dialog box, in the Name box, type DirectMailerSPexec.
  4. In the Database role type section, select Standard role, and then click OK.

    The standard role you created and named DirectMailerSPexec appears in the Roles pane on the SQL Server Enterprise Manager screen.

  5. In the Roles pane, right-click DirectMailerSPexec, and then click Properties.
  6. In the Database Role Properties - DirectMailerSPexec dialog box, click Permissions.
  7. In the Database Role Properties - DirectMailer dialog box, in the EXEC column, select xp_create_dml_sqlagent_job, and then click OK.
  8. On the Database Role Properties - DirectMailerSPexec dialog box, click OK.

You have created the DirectMailerSPexec role. Proceed to Adding the Required Accounts to the Database Roles, where you will add the required user accounts to this role.


Adding the Required Accounts to the Database Roles

After you run all of the scripts in Running the Commerce Server Database Security Scripts, you add the required accounts to the newly created roles.

You perform the following procedure on the SQL1 server.

To add a required account to a database role

  1. Click Start, point to Programs, point to Microsoft SQL Server, and then click Enterprise Manager.
  2. In the SQL Server Enterprise Manager screen, in the tree structure, expand Microsoft SQL Servers, expand SQL Server Group, expand <computerName> (Windows NT), expand Security, and then click Logins.
  3. In the Logins pane, right-click a SQL login account, and then click Properties.

    The SQL login accounts are listed in parenthesis in the Account (sample account name) column in the following table.

  4. In the SQL Server Login Properties - <serviceName> dialog box, on the Database Access tab, in the top box, select a database.

    The databases are listed in the For this database column, in the table in this section.

  5. In the bottom box, specify the role for the account, and then click OK.

    The roles are listed in the Assign to this database role column in the table in this section.

  6. Repeat steps 3 through 5 until all the required accounts are assigned membership to the required database roles, and then click OK.

    The table in this section lists the accounts, the databases, and the roles to which the accounts must be assigned.

    Note To access all modules in Commerce Server Business Desk, you must be a member of the following groups: Business Desk group, Advanced Report group, and Segment Viewer group. The names used for these groups in this sample secure deployment are BDGroup, ReportAdvanced, and SegmentViewerGroup respectively.
Account
(sample account name) 		Server For this database Assign to this database role
*Run-time users
(contoso\Anonymous) 		SQL1 Administration (MSCS_Admin) For information, see Securing the MSCS_Admin Tables.
SQL1 | MSCS_CatalogScratch | db_owner
SQL1 | Catalog | ctlg_CatalogReaderRole
SQL1 | Business Desk Permissions | BDReaderRole
SQL1 | Profiles | ProfileReaderRole
SQL1 | Campaigns | CampaignReaderRole
SQL1 | Transaction Configuration | TransactionConfigReaderRole
SQL1 | Transactions | TransactionReaderRole
Business Desk group
(adatum\BDGroup) 		SQL1 Administration (MSCS_Admin) db_datareader
SQL1 | MSCS_CatalogScratch | db_owner
SQL1 | Catalog | db_owner
SQL1 | Business Desk Permissions | BDWriterRole
SQL1 | Profiles | ProfileWriterRole
SQL1 Campaigns CampaignWriterRole
db_datareader
SQL1 | Transaction Configuration | TransactionConfigWriterRole
SQL1 | Transactions | TransactionWriterRole
SQL2 | Data Warehouse | ReportViewerRole
SQL1 Direct Mailer Public

DirectMailerSPexec
Advanced Report group
(adatum\ReportAdvanced) 		SQL2 Data Warehouse ReportAdvancedRole
Segment Viewer group
(adatum\SegmentViewerGroup) 		SQL1 Data Warehouse SegmentViewer
Direct Mailer service
(adatum\CSDM) 		SQL1 Administration (MSCS_Admin) db_datareader
SQL1 | Campaigns | db_datareader
SQL1 | Direct Mailer | db_owner
List Manager service account
(adatum\CSLM)

See note below.

 SQL1 Administration (MSCS_Admin) db_datareader
SQL1 | Direct Mailer | db_owner
SQL1 | Campaigns | db_owner
Predictor service account
(adatum\CSPred) 		SQL1 Administration (MSCS_Admin) db_datareader
SQL2 Data Warehouse SQL Server db_datareader
db_datawriter
db_ddladmin
SQL1 Campaigns db_ddladmin

db_datareader

db_datawriter
DTS Task Import group
(adatum\DTSImport) 		SQL1 Administration (MSCS_Admin) DTS_ImportRole
SQL1 | Catalog | DTS_ImportRole
SQL1 | Profiles | DTS_ImportRole
SQL1 | Campaigns | DTS_ImportRole
SQL1 | Transaction Configuration | DTS_ImportRole
SQL1 | Transactions | DTS_ImportRole
SQL2 Data Warehouse SQL Server Run sp_addalias to assign to the dbo of Data Warehouse.

For information about database owner (dbo), and about using sp_addalias, see SQL Server Books Online.
SQL2 Data Warehouse OLAP database Add to the OLAP Administrators group.
Note The DTSImport account must be a part of the OLAP Administrators group for both the OLAP database computer, and the computer on which you are going to run the Report preparation DTS task. This is required to run the Report preparation DTS task and the Report Caching DTS task.
N/A | Computer from which you run the DTS tasks | Power Users group
N/A | Config COM+ Application | Administrators (see "Adding the Service Accounts to the Config COM+ Application Role" in Commerce Server 2002 Help)
  1. Config COM+ application
  2. (Adatum\CSCOMPlus)
 SQL2 Data Warehouse SQL Server db_owner
Note If you want to use the Commerce Server Business Desk List Manager module to import a SQL table, then you must ensure that the Adatum\CSLM account has been granted read access to the data source from which you are importing.
Note To enable Business Desk users to edit catalogs (for example, edit the catalog definition, rebuild the catalog, refresh the full-text index, and publish the catalog), you must assign them to the db_owner role.
Note It is recommended that you create a group account specifically for Business Desk users who will edit catalogs.
Important Carefully consider the trustworthiness of the Business Desk user to whom you assign the db_owner role. A Business Desk user assigned to the db_owner role could potentially delete a catalog database. To mitigate this risk, a firewall should be used to disallow direct connection from the Business Desk client to the SQL Server database that contains the catalogs. You created this firewall, named ISA3, in Configuring the Corporate LAN ISA Server.


Securing the MSCS_Admin Tables

The following table lists the permissions for the Contoso\Anonymous account in the MSCS_Admin tables. You use SQL Server Enterprise Manager on the SQL1 server to set these permissions. These tables are created by the Commerce Server 2002 setup application.

Table name | IUSR or ASPNET
ExtendedProps | No access.
pupdbscripts | No access.
ResourceProps | Select the permissions in the following procedures.
Resources | Select the permissions in the following procedures.
SiteResources | Select the permissions in the following procedures.
Sites | Select the permissions in the following procedures.

You perform the following procedure on the SQL1 server.

To secure your MSCS_Admin Tables

  1. Click Start, point to Programs, point to Microsoft SQL Server, and then click Enterprise Manager.
  2. In the SQL Server Enterprise Manager screen, in the tree structure, expand Microsoft SQL Servers, expand SQL Server Group, expand SQL1 (Windows NT), expand Databases, expand MSCS_Admin, right-click Roles, and then click New Database Role.
  3. In the Database Role Properties - New Role dialog box, in the Name box, type Anonymous_IIS_Role.
  4. In the Database role type section, select Standard role, and then click OK.

    The standard role you created and named Anonymous_IIS_Role appears in the Roles pane on the SQL Server Enterprise Manager screen.

  5. In the Roles pane, right-click Anonymous_IIS_Role, and then click Properties.
  6. In the Database Role Properties - Anonymous_IIS_Role dialog box, click Permissions.
  7. In the Database Role Properties - MSCS_Admin dialog box, in the SELECT column, select the ResourceProps, Resources, SiteResources, and Sites check boxes, and then click OK.
  8. In the SQL Server Enterprise Manager screen, in the tree structure, expand Microsoft SQL Servers, expand SQL Server Group, expand SQL1 (Windows NT), expand Security, and then click Logins.
  9. In the SQL Server Enterprise Manager screen, in the Logins pane, right-click Contoso\Anonymous, and then click Properties.
  10. In the SQL Server Login Properties - Contoso\Anonymous dialog box, select MSCS_Admin.
  11. In the Database roles for MSCS_Admin section, select the Anonymous_IIS_Role check box, and then click OK.

The MSCS_Admin tables are secured on SQL1 server.


Adding the Service Accounts to the Config COM+ Application Role

The Config COM+ application has an Administrators role. Accounts in this role use objects for writing to the Administration database. By default, the user logged on during Commerce Server setup is added to this role, and the local Administrators group is added.

You must perform the following procedure on the Commerce1 server to add the accounts listed in the following table.

Service Account description | Service account name
Direct Mailer service | Adatum\CSDM
List Manager service account | Adatum\CSLM
Predictor service account | Adatum\CSPRED
DTS Import account | Adatum\DTSImport

To add the service accounts to the Administrators role

  1. Click Start, point to Programs, point to Administrative Tools, and then click Component Services.
  2. In the Component Services screen, in the tree structure, expand Component Services, expand Computers, expand My Computer, expand COM+ Applications, expand Commerce Server Config, expand Roles, and then expand Administrators.
  3. Right-click Users, point to New, and then select User.
  4. In the Select Users or Groups dialog box, in the box, type the name of the account listed in the Service account name column in the table in this section, and then click OK.
  5. Repeat steps 3 through 4 to add the other accounts listed in the Service account name column in the table in this section.

The service accounts are added to the Administrators role.

Adding Individual User Accounts to the Group Domain Accounts

For each Commerce Server Business Desk user, you create a Windows user account on the DC2 domain controller. After you create the Windows user account, you assign those Windows accounts to the appropriate group accounts as follows:

Account name | Description
BDGroup | Assign all Business Desk users to this account.
ReportAdvanced | Assign users who will save, modify, and delete dynamic reports.
SegmentViewerGroup | Assign users who will use the Segment Viewer module.
Note Members of the ReportAdvanced group and the SegmentViewer group should also be added to the BDGroup.

You perform the following procedure on the DC2 domain controller.

To assign individual Business Desk users accounts to the group accounts

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  2. In Active Directory Users and Computers, right-click the group account to which you want to add the user, and then click Properties.
    Note See group accounts listed in the preceding table.
  3. On the Members tab, click Add.
  4. Type the Windows accounts of the appropriate users, and then click OK.
  5. Repeat steps 2 through 4 to add the user accounts to the group accounts as needed.

You assign the appropriate individual Business Desk users accounts to the group accounts according to your business needs.


Granting Users Business Desk Permissions

Using the Business Desk Permissions module in Commerce Server Business Desk, you add the Business Desk domain group account to the Permissions module, and then grant members of the domain permission to use Business Desk.

Note If a Windows account is not in the Permissions module account list, or does not have any "allow" option assigned to it, then users assigned to that account cannot access Business Desk.
Note If the Permissions module account list contains a Windows account that no longer exists, users assigned to that account are denied access to all of the Business Desk categories and modules.

You use the Business Desk Security module listed in the Account name column of the following table to add the Windows accounts to the Permissions module account list.

Account name | Description
BDGroup | Assign all Business Desk users to this account.
ReportAdvanced | Assign users who will save, modify, and delete dynamic reports.
SegmentViewerGroup | Assign users who will use the Segment Viewer module.

To add Windows accounts to the Permissions module account list

To set permissions for a Windows account

To add Windows accounts to the Permissions module account list

  1. In Business Desk, in the Security module, click Permissions.
  2. In the Security Permissions screen, in the Windows Account section, click Add to List.
  3. In the Add Account dialog box, type the Windows account from the Account name column in the preceding table, and then click Add.
  4. To return to the Business Desk Welcome screen, click [image] on the toolbar.

    The Windows account has been added to the Permissions module account list.

  5. Repeat steps 2 through 4 to add the remaining account names listed in the Account name column in the preceding table.

To set permissions for a Windows account

  1. In Business Desk, in the Security module, click Permissions.
  2. In the Security Permissions screen, in the Windows Account drop-down box, select the Windows account in the Permissions module account list for which you want to add permissions.
  3. In the Security Permissions screen, in the Securable Entities section, grant the following accounts the following permissions:
    • BDGroup – Allow All
    • ReportAdvanced – Allow All
    • SegmentViewer – Allow All

    For more information, see "Setting Business Desk Permissions for Windows Accounts" in Commerce Server 2002 Help.

  4. To save changes and return to the Business Desk Welcome screen, click [image] on the toolbar.
    Important After permissions are changed for a Business Desk user, that user must close the Business Desk client, and then restart it for the new settings to take effect.
    If the Windows identity (groups membership, rights, ACLs, and so on) has changed for that user, the user must log off and then log on for new settings to take effect on the server. (Otherwise, the client will work correctly, but the server will not.)


Completing Wiring the Network

To complete the sample secure deployment, you must connect Network Adapter 1 (connection name ISP) for the Microsoft Internet Security and Acceleration (ISA) Server named ISA1 to the Internet.

You have now completed the sample secure deployment.


Copyright

The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication.

This White Paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT.

Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or should be inferred.

© 2002 Microsoft Corporation. All rights reserved.

Microsoft, Active Directory, Windows, and Windows NT are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.