Service

Sets general configuration options:

In the Service Administrator box, type the name and e-mail address of the person who administers the Catapult service.

In the Maximum Connections box, select the maximum number of clients that can be connected to the Catapult service simultaneously. The practical limit depends upon your Catapult server's memory and configuration. The theoretical range is 1 to 32,767.

Select the CERN Proxy service check box if you want to enable the CERN Proxy feature [not supported for this Beta].

In the Comment box, describe this Catapult service. The text you type in this box appears in the Report view of the Internet Service Manager.

Click Current Sessions to see a list of users currently connected through the Catapult service.


Current Sessions

Lists all the users currently connected through the Catapult service. This screen also shows the IP address of each user's computer and the time the user connected. Click Refresh to update the list.


Permissions

Grants access rights to users and groups. To select a service, click the arrow button on the right side of the drop-down list box, and choose a service. The list box shows users and groups who have the right to access the selected service.

To add a user or a user group, click Add. To remove a user or a group, select the user or group in the list box and click Remove.


Disk Cache

Shows disk cache directories configured to store previously accessed information from WWW, FTP, and Gopher sites. These directories are on the Catapult server. Storing pages on disk significantly improves performance when the same client (or a different one) requests the same page. Rather than get the page from the Internet again, the server quickly sends the page already stored in the cache.

To increase disk space for caching, click Add to add a directory and specify its cache size.

The Catapult server obeys page expiration if specfied in a WWW response. In addtion, pressing the reload button on a client causes the Catapult server to update its cache from the Internet site.


Disk Cache Properties

Adds a directory to the cache. Type the directory name in the Directory box, or click Browse and select a directory on the Catapult server. Set the size in megabytes, and click OK.

Note: This feature does not support Universal Naming Convention (UNC) names.


Logging

Configures how the Catapult server tracks and stores information about activity on the server. All logs are stored in a text file on the Catapult server, or in an ODBC-supported database file.

Enable Logging

Select this check box to turn logging on. Clear the check box if you decide not to log activity on the Catapult server.

Log to File

Select this button if not logging through a SQL/ODBC database. This button is selected by default.

Automatically open new log

Select this check box to close the log file, rename it, and open a new file at the specified interval, Daily, Weekly, Monthly, or when the file size reaches the selected number of megabytes. This option lets you move log records to another volume for offline analysis and to free disk space.

Log file directory

Type the directory or click Browse and select the directory in which you want to store the log files.

Log file name

Displays the name of the log file.

Log to SQL/ODBC database

Stores logs in a database. Make sure that your network has the appropriate ODBC data source (for example, SQL Server) and a correctly formatted table. Also, make sure the Catapult server has a correctly configured Data Source Name (DSN) for Catapult logging. Specify a username and password that is valid on the computer where the database is stored.

For more information about using ODBC resources, see the online help for your ODBC Manager. To access the ODBC Manager, double-click the ODBC icon in the Windows NT Control Panel.


Filters

Limits the Internet sites accessible by users of the Catapult service.

Enable Filtering

Select this check box to turn filtering on. Clear the box to turn filtering off.

Granted

Select this option to allow access to all Internet sites except for those you specify in the list box

Denied

Select this option to deny access to all Internet sites except for those you specify in the list box.

To add a site, make sure Enable Filtering is selected, and click Add.

To modify a site, select the site in the list box, and click Edit.

To remove a site, select the site in the list box, and click Remove.

After making any changes to this property sheet, click Apply or click OK.


Grant/Deny Access

Grants or denies access to a site.

To add a site

1	Make sure Enable Filtering is selected, and on the Filters property page, click Add.

2	If the Granted option is selected, the Deny Access To dialog box appears. If the Denied option is selected, the Grant Access To dialog box appears.

3	Select whether you want to grant or deny access to a Single Computer, a Group of Computers, or a Domain.

If you are granting or denying access to a single computer or group of computers, type the IP address of the site. If you are granting or denying access to a group of computers, you must also type the subnet mask. If you are granting or denying access a domain, type the domain name. For example, if you type microsoft.com, you will grant or deny access to all sites on the microsoft.com domain. It you just want to grant or deny access to a site on a domain, type the site name. For example, to grant or deny access to the FTP site on the Microsoft.com domain, type

FTP.microsoft com

To grant or deny access to the entire domain, type

microsoft.com

4	Click OK.


Important Security and Configuration Information

Before using the Catapult gateway service:

Disable IP routing. If your internal network runs TCP/IP, make sure that the Enable IP Routing check box is cleared to disable IP routing to prevent unauthorized Internet packets from infiltrating your network. (The Enable IP Routing check box is located in the Advanced Microsoft TCP/IP Configuration dialog box. Access this through the Network applet in Control Panel.)

At the client computers, specify the Catapult servers to be used. To specify a different server from the one specified during Setup, use the Internet Access applet in Control Panel. If more than one Catapult server is specified, they can be listed in any order; the client selects a server at random. If the client computer has a direct Internet connection, you can use this applet to disable the Catapult gateway service for that client.

Use Internet Service Manager to configure the Catapult gateway service. In the list of computers on the Internet Service Manager, double-click the computer running the Catapult gateway service to display its property sheets. Click the appropriate tab to configure any part of the Catatpult service. For example, to change permissions, click the Permissions tab to display the property sheet. On this property sheet, you can change permissions for a group of users, or a single user.


The Microsoft Catapult Gateway Service

The Microsoft Catapult gateway service provides a gateway between the Internet and your intranet so that your users can safely browse the Internet's World Wide Web, Gopher, and FTP servers.


Security

The Catapult gateway service is installed on a computer running Windows NT Server version 3.51. This computer must have at least two network adapter cards: one for your network and the other for the Internet. It acts as a selective application-layer gateway between the two network adapter cards. Client requests and Internet responses are processed by the gateway, but unrequested packets from the Internet are not allowed access to your network. For more information about security, see the security checklist in the release notes.


Application-Layer Filtering

The Catapult gateway offers security at the application level. The Catapult service establishes TCP/IP connections to specific sites on the Internet on behalf of WWW, Gopher, and FTP requests from your corporate network. The service listens for and accepts only those WWW, Gopher, and FTP responses from the Internet that answer these requests. If a spontaneous packet received from the Internet is addressed to the Catapult gateway service on your network, the packet will not be routed to your network (because IP routing is disabled on your server). IP addresses are not used for selective filtering, so a hacker cannot use an IP address to infiltrate your network by impersonating an authorized user.


Domain Name Filtering
Domain-Name Filtering

The Catapult gateway service provides policy control in the form of domain-name filtering. Network administrators can use domain-name filtering to determine which Internet servers can be accessed by their network clients. Administrators can accomplish  this either by listing the domains for which access is granted, or by listing the domains for which access is denied. These policies affect all users connecting to Internet resources through the Catapult gateway service.


User-Level Permissions

Network administrators can use user-level permissions to control which users have access to Internet servers by setting user-level and group-evel permissions for the WWW, Gopher, and FTP services. The user-level control is fully integrated with the Windows NT domains and username accounts.


Transport Independence

The Catapult gateway service is transport independent, supporting major transport protocols such as TCP/IP, SPX/IPX, and NetBEUI. The Internet uses the TCP/IP transport protocol, but many corporate networks use others. With the Catapult gateway service, client computers do not need to use TCP/IP in order to access the Internet. The Catapult gateway service acts as a protocol converter, converting requests received from your network into the Internet's TCP/IP protocol.


Caching

The caching feature offers a more efficient way to provide access to frequently used Internet pages. Internet pages requested by a client can be cached, or held on the server's hard disk so that when another client requests the same page it is simply retrieved from the hard disk and sent to the requester. Caching reduces Internet traffic and responds more quickly to requests for pages that have been cached. Network administrators can control how much disk space should be used for caching. A cached page is updated whenever a selects the refresh or reload option in a browser.


CERN-Compatible Proxy Gateway

The Catapult gateway service includes a CERN-compatible proxy gateway for UNIX and Macintosh clients. Clients using this feature must be running TCP/IP, and are all subject to a single user policy. That is, such clients cannot have different levels of access. The CERN proxy gateway also supports domain-name filtering.


Catapult Gateway Service Architecture

The following illustration shows how the Catapult gateway service works:

The Windows NT Server-based computer running the Catapult gateway service has at least two network adapter cards: one for your network and the other for the Internet. The card connected to your network uses Remote Procedure Calls (RPC) and at least one transport protocol, such as TCP/IP, IPX/SPX, or NetBEUI. The card connected to the Internet should be bound to TCP/IP only.

Client requests and responses are transported between clients and the Catapult gateway service by using RPC, which provides transport-protocol independence and user-level authentication. The Catapult gateway service acts as a policy manager and protocol translator. Converting the application requests received from your Windows client into the Internet's TCP/IP protocol, it establishes a TCP/IP connection to the specified Internet server and sends the client's request. The Catapult gateway service accepts only those incoming Internet packets received through such a connection. It ignores all other incoming Internet IP packets.

To use the available Internet resources effectively and enhance the client Internet access performance, the gateway server caches the Internet pages on a hard disk. If another client requests a page that is already in the cache, it is retrieved from there and returned to the client. Caching reduces the Internet traffic and allows for quicker response time for clients that request a page that has been cached. Caching is particularly useful for small organizations that have slower links to the Internet and whose clients require access to the same Internet resources repeatedly.

The following illustration shows the Catapult gateway service in greater detail:

The client labeled C1 uses the CERN-compatible proxy gateway feature of the Catapult gateway service to access the Internet. The advantage of the CERN-compatible proxy gateway feature is that you can access the Internet from any client running a browser application that provides CERN-compatible proxy support. However, the CERN-compatible proxy gateway supports the TCP/IP protocol only, and it does not provide per-user rights policy control.

The client labeled C2 is a Win32 (or Win32s) client that uses the advanced features of the Catapult gateway service to access the Internet. This client can be running any RPC-compatible transport protocol, such as IPX/SPX, TCP/IP, or NetBEUI. The client communicates with the Catapult gateway service by using the transport-independent RPC mechanism. The CERN-compatible proxy support built into the client's browser is used to redirect the browser's Windows Sockets requests to the Catapult Access Gateway Provider. The Catapult Provider then translates these requests into Internet Extensions for Win32 API calls. The Internet Extensions for Win32 APIs on the client computer are configured to forward the requests to the Catapult gateway service by using RPC. The Catapult gateway service processes the client requests by calling the Internet Extensions for Win32 APIs. On the Catapult computer, the Internet Extensions for Win32 use Windows Sockets over TCP/IP to communicate directly on the Internet. This mechanism offers advanced security features such as per-user rights policy control and Windows NT security integration. This client can be running Windows NT Workstation, Windows 95, Windows for Workgroups, or Windows version 3.1.

The client labeled C3 is also a Win32 (or Win32S) client that uses the advanced features of the Catapult gateway service to access the Internet. However, this client runs a browser application that supports the Internet Extensions for Win32 APIs directly, and therefore does not require the Catapult Access Gateway Provider component.


Using Internet Server Manager to Configure the Gateway Service
Using Internet Service Manager to Configure the Catapult Gateway Service

After installing the Catapult gateway service, the Internet Service Manager can configure it for your network. Double-click the computer name in  Internet Service Manager to display its property sheets, where you can configure the Catapult gateway service.

After you have typed in your changes to a property sheet, click Apply. to record the changes and retain the property-page display. That way, you can make changes to other property pages.

Click OK on any page to record the changes you've made on all pages. The property sheets close and you are returned to the list of servers on the Internet Service Manager.