The main differences between IAG 2007 and Forefront UAG are the form factors, and operating system requirements. IAG 2007 is available as a hardware appliance, and in addition IAG 2007 with SP2 is available as a virtual machine. The IAG appliance runs on a 32-bit computer running Windows Server 2003. The IAG 2007 SP2 virtual machine runs on a 64-bit edition of Windows Server 2008, and requires Windows Server 2008 Hyper-V. For more information, see IAG Service Pack 2 system requirements. Forefront UAG is available as a software installation and a hardware appliance. Forefront UAG requirements are summarized in the following table.

For more detailed information, see System requirements for Forefront UAG servers.

The following table summarizes feature differences between IAG 2007 SP2 and Forefront UAG.

This section summarizes IAG 2007 features and settings that cannot be migrated to Forefront UAG, either because the feature has been removed, or because the feature is implemented differently.

The following tools are no longer available in Forefront UAG:

• Service Policy Manager
  
  
• User Manager (UserMgrUtil)
  
  
• Session Manager (SessionMgrUtil)— IAG 2007 provided the Session Manager Utility
  
  

The following limitations apply:

1. Configuring Forefront UAG as a domain controller is not supported.
   
   
2. Forefront UAG trunks are limited to listening on ports 80 and 443 only. This is a very important consideration when migrating trunks that use a different port on IAG 2007.
   
   
3. IAG 2007 Webmail trunks and Basic trunks are no longer available in Forefront UAG. In Forefront UAG you must use portal trunks.
   
   
4. Additional websites cannot be configured in the local IIS running on the Forefront UAG server. Additional configured websites for IIS running on the IAG 2007 server cannot be migrated to IIS running on Forefront UAG.
   
   
5. Log in to the Forefront UAG management console is not required. Authentication for Forefront UAG is based on Windows login.
   
   
6. Integrated Windows authentication is not supported in Forefront UAG. In Forefront UAG, you must recreate trunks that used this authentication method in IAG 2007 SP2 to use an alternative form of authentication.
   
   
7. ISA Server 2006 was installed automatically on the IAG server. For Forefront UAG Forefront TMG is installed instead of ISA Server. Direct configuration of Forefront TMG is not supported (with the exception of specific settings described in Support boundaries), and might lead to unexpected behavior if attempted. This includes (but is not limited to) direct configuration of:
   
   
   1. ActiveSync (published by Forefront UAG now)
      
      
   2. RPC over HTTP (published by Forefront UAG now)
      
      
   3. Custom firewall rules
      
      
   4. Custom publishing settings
      
      
      
      
8. Forefront UAG introduces a new trace mechanism that is based on Event Tracing for Windows (ETW). ETW tracing can now be run on the both the Forefront UAG server, and on client endpoint devices connecting to Forefront UAG resources. Files required for converting Forefront UAG binary traces to readable text are available from Forefront UAG Tracing Symbols, at the Microsoft Download Center.
   
   
9. Running third-party Load Balancing software, such as Resonate used in IAG, on the Forefront UAG server is not supported. Forefront UAG provides integrated Windows NLB to balance traffic for an array of up to eight servers. Alternatively you can use hardware load balancing products placed in front of the Forefront UAG servers.
   
   
10. Some features provided by IAG SP2 updates are not included in Forefront UAG RTM. Feature that are included are described in the table in Feature comparison.
    
    

Collect IAG 2007 network configuration information that is required on Forefront UAG server. These settings include:

• Domain membership details if applicable.
  
  
• IP addresses of network adapters
  
  
• Subnet masks
  
  
• Default gateway information
  
  
• Routing table entries
  
  

Where?

Collect network information from the IAG server by clicking Network Configuration in the Admin menu of the IAG Configuration console, and from the operating system properties.

You can gather multiple Forefront UAG servers into an array, where each array member shares the same configuration including trunk and application settings. The legacy IAG 2007 high availability array structure is not supported in Forefront UAG, and a software load balancer cannot be run on the Forefront UAG server. We recommend that you migrate your IAG 2007 array configuration as follows:

• If IAG 2007 high availability array members share the same configuration, manually recreate the array configuration settings on a single Forefront UAG server. This server can then be configured as the Forefront UAG array manager. When you join other Forefront UAG servers to the array by connecting them to the array manager, they automatically receive the configuration and form an array.
  
  
• If IAG 2007 high availability array computers do not share the same configuration, you can do either of the following:
  
  
  1. Migrate the configuration settings of each IAG 2007 server to a separate Forefront UAG server. The result is a group of standalone Forefront UAG servers that each have a different configuration, and are not part of an array.
     
     
  2. Select a single common configuration for all the IAG 2007 array servers, and manually recreate this configuration on a Forefront UAG server. Then create a new array by configuring this server as the Forefront UAG array manager, and joining other Forefront UAG servers to it to form an array. Note that each Forefront UAG array member will have the same configuration as the array manager.
     
     

In order for client endpoint devices to access some internal resources, both IAG 2007 and Forefront UAG install client components on connecting devices. In both IAG 2007 and Forefront UAG components are installed using the same methods—online mode; using the Client Components installer; or offline administrator installation. Although there are no changes in endpoint deployment methods, there are a number of changes in client endpoint requirements, including application and browser support. Ensure that you understand the impact of these changes before migrating from IAG to Forefront UAG. For a list of Forefront UAG features that require client components, see Introduction to endpoint component deployment design. For a comparison of requirements, see IAG client endpoint system requirements, and System requirements for Forefront UAG client devices.

Collect the settings for each trunk currently configured in IAG 2007.

Where?

In IAG 2007 collect the trunk properties as follows:

• Click the IAG console tree, click the HTTP or HTTPS trunk.
  
  
• Note the settings on all property pages and tabs. For more information about the settings, see Managing IAG portals and published applications.
  
  

For each trunk, collect information about the applications published via the trunk.

Where?

In IAG console tree, click the HTTP or HTTPS trunk.

• In the Applications list, select the application, and then click Edit.
  
  
• Note the application settings on all tabs. For more information about the settings, see Configuring the properties of applications published by IAG.
  
  

IAG 2007 provides full remote access to the internal network with Network Connector. Forefront UAG also provides Network Connector support, with the addition of Network Connector access support for endpoint devices running 64-bit client operating systems. Collect Network Connector information.

Where?

In IAG 2007 collect the Network Connector information as follows:

1. On the Admin menu, click Network Connector Server.
   
   
2. On the Network Segment tab, collect network adapter settings.
   
   
3. On the IP Provisioning tab, note the static address pool range of IP addresses assigned to remote clients connecting with Network Connector.
   
   
4. On the Access Control tab, collect information about how VPN clients connected with Network Connector access the Internet. Note whether clients have Internet access, and whether requests are routed through the client's original Internet connection, or through the IAG 2007 server.
   
   
5. On the Additional networks tab, note the additional network destinations that are available to VPN clients connecting with Network Connector. This is applicable if your internal network has multiple subnets, and you want to allow VPN client access those subnets.
   
   

Collect certificate information.

Where?

1. You recorded the names of the server certificates used for each HTTPS trunk when you noted the settings on the General tab of each trunk,
   
   
2. If you want to reuse the IAG 2007 certificates, and the certificates were created with the option to export the private key, run the Certificates MMC on the IAG server, and export the certificates to a location that will be accessible from the Forefront UAG server.
   
   
3. If you are using the Certified Endpoints feature on IAG 2007 and have deployed a certification authority (CA) on the IAG server, note details of the CA configuration so that you can recreate it on the Forefront UAG server, or on an alternate server.
   
   

Collect information for each authentication server configured in IAG 2007.

Where?

1. Collect authentication server settings—Note the properties for each authentication server. To do this, on the Admin menu, click Authentication and User/Group Servers. Select the required authentication server in the list, and then click Add.
   
   Note the setting for each authentication server.
   
   
2. Collect trunk authentication and authorization settings—Ensure that you recorded the authentication servers used for session authentication and authorized access to portal applications. To access authentication server properties in IAG 2007, for each trunk, click the Authentication tab, and note the listed servers.
   
   
3. Collect application single sign-on authentication settings—Note information about the authentication servers used to authenticate session credentials that are forwarded to backend published servers. These servers are listed on the Web Settings tab in the properties of each published application
   
   

This can be very complex as there are many possible customizations that can be applied to IAG 2007. This section provides information only about collecting settings that are fully documented in the Customizing Forefront UAG (other customizations might be possible but are outside the scope of this guide).

Where?

Collect application-specific customizations as follows:

• Custom authentication settings—Stored in the \Whale-Com\e-Gap\von\InternalSite\inc\CustomUpdate folder.
  
  
• FormLogin customizations—Stored in the \Whale-Com\e-Gap\von\Conf\WizardDefaults\FormLogin\CustomUpdate\FormLogin.xml file.
  
  
• AppWrap and SRA customizations—Stored in \Whale-Com\e-Gap\von\Conf\Websites\<Trunk_Name>\Conf\CustomUpdate\WhlFiltAppWrap_HTTP.xml for HTTP trunks. For HTTPS trunks, information is stored in the WhlFiltAppWrap_HTTPS.xml file in the same location.
  
  
• Custom Application templates (for example, SSLVPNTemplates.xml and WizardDefaultParam.ini)—Stored in the \Whale-Com\e-Gap\von\Conf \CustomUpdate folder, or in the \Whale-Com\e-Gap\von\Conf\WizardDefaults\CustomUpdate folder.
  
  
• File Access shares specific customization (for example, ShareAccessCfg.xml)—Stored in the \Whale-Com\e-Gap\von\FileAccess folder.
  
  

Collect InternalSite customizations as follows:

• Image files
  
  
• INC files
  
  
• CSS files
  
  
• ASP, HTML files
  
  
• Languages XML files
  
  

Files are located in CustomUpdate folders, located in subfolders in the \Whale-Com\e-Gap \von\InternalSite folder. For example InternalSite\Images\CustomUpdate.

Collect portal customizations as follows:

• Image files
  
  
• INC files
  
  
• CSS files
  
  
• ASP, HTML files
  
  
• Languages XML files
  
  

Files are located in CustomUpdate folders, located in subfolders in the \Whale-Com\e-Gap \von\InternalSite folder. For example InternalSite\Images\CustomUpdate.

Topology options you need to consider when deploying Forefront UAG include:

• Deployment scope—Consider your fault tolerance and failover requirements. You can deploy a single Forefront UAG server, or an array of multiple Forefront UAG servers that share the same configuration. For more information, see Identifying your array deployment goals.
  
  
• Network requirements for Forefront UAG application publishing, and Forefront UAG DirectAccess—You can use Forefront UAG to publish internal applications via Forefront UAG trunks, and in addition you can set up the Forefront UAG server to act as a DirectAccess server. For more information about infrastructure requirements when setting up Forefront UAG as a publishing server, see the Infrastructure planning guide. For information about Forefront UAG DirectAccess topology requirements, see Forefront UAG DirectAccess prerequisites.
  
  
• Network location—Decide where you want to place the Forefront UAG server. For example, will it be placed behind a firewall? For considerations, see the section Networking and routing requirements in Identifying your infrastructure deployment goals.
  
  
• Domain and workgroup requirements—Forefront UAG can be deployed as a domain member or in workgroup mode. Domain deployment is required for the following scenarios:
  
  
  • Deploy the server as part of a Forefront UAG array.
    
    
  • Deploy Forefront UAG as a DirectAccess server.
    
    
  • Publish the Forefront UAG File Access application via a Forefront UAG trunk
    
    
  • Provide full VPN access to the internal network by publishing SSTP via a Forefront UAG portal.
    
    
  • Forward trunk session credentials to backend published servers using Kerberos constrained delegation.
    
    
  For more information, see the section Domain and workgroup requirements in Identifying your infrastructure deployment goals.
  
  
• Network adapter and IP address requirements—There are a number of requirements depending on your deployment scenarios. For more information, see the section Network topology requirements in Identifying your infrastructure deployment goals.
  
  
• DNS requirements—There are specific DNS requirements for Forefront UAG publishing, and Forefront UAG DirectAccess. For more information, see the section DNS requirements in Identifying your infrastructure deployment goals, and Forefront UAG DirectAccess prerequisites.
  
  

Ensure that the computers on which you want to install Forefront UAG meet the hardware and software requirements, and that network adapters are installed and configured as required. For more information, see System requirements for Forefront UAG servers. Windows Server 2008 R2 (Standard or Enterprise Edition) should be installed on each computer. Install and initially configure Forefront UAG as follows:

1. Join the Forefront UAG computer to a domain (if required) before installing Forefront UAG.
   
   
2. Configure network adapters, and routing table entries in the operating system properties.
   
   
3. Install Forefront UAG as a software application according to the instructions in Installing the Forefront UAG application.
   
   
4. The first time you open the Forefront UAG Management console, the Getting Started Wizard runs automatically. Use the wizard to associate network adapters with internal and external networks, and to configure Microsoft Update settings. After running the Getting Started Wizard, you can set up the Forefront UAG computer as a DirectAccess server if required, and configure the Forefront UAG server to publish internal applications for remote access.
   
   

You can configure Forefront UAG in a number of deployment scenarios. Some scenarios were available in IAG 2007. Others are new to Forefront UAG. Scenarios include:

• Deploying an array
  
  
• Deploying DirectAccess
  
  
• Deploying application publishing
  
  
• Customizing Forefront UAG
  
  

Deploying an array

Deploying DirectAccess

Deploying application publishing

Deploying authentication servers for publishing

Deploying access policies

Creating trunks

Publishing applications via a trunk

Publishing Exchange

Publishing SharePoint

Publishing full remote access to internal networks

Publishing Remote Desktop Services (RDS

Publishing File Access

Configuring event logging and monitoring

Customizing Forefront UAG