Installation of Microsoft Forefront Threat Management Gateway 2010. This looks a bit different compared to what we saw with the ISA firewall and it includes some welcome new options.
On the Welcome to the Preparation Tool for Microsoft Forefront Threat Management Gateway (TMG) page, click Next.
On the License Agreement page, put a checkmark in the I accept the terms of the License Agreements checkbox and click Next. Here you are accepting the license agreements for the Microsoft Chart Controls for Microsoft .NET Framework 3.5 and 3.5 SP1 and Microsoft Windows Installer 4.5.

On the Installation Type page, you have three options:
- Forefront TMG services and Management
- Forefront TMG Management only
- Enterprise Management Server (EMS) for centralized array management
The new TMG makes it easier than ever to work with TMG EE, in contrast to the complexity of EE management with the ISA firewall. That is why we are installing EE in this article series – to show that you can get EE installed easily. Later we’ll create a standalone array and then we will take down the standalone array and create an enterprise array. It’s easy and fun! But first, let’s just handle the basics and select the Forefront TMG services and Management option. Click Next. 
On the Preparing System page, you will see installation progress for the prerequisite software

The Preparation Complete page shows that the prerequisite software was installed successfully.

Now the Welcome to the Installation Wizard for Forefront TMG Enterprise page appears. Click Next to start installing TMG EE.

On the License Agreement page, select the I accept the terms in the license agreement option and click Next.

Enter your customer information (user name, organization name and product serial number) on the Customer Information page and click Next.

On the Installation Path page, you can use the default path or choose your own path in specifying the location where you want to install the TMG firewall’s files. In this example, we’ll use the default path and click Next.

Ah, now here is a blast from the past - the Define Internal Network page. For the TMG firewall, as for the ISA firewall, the default Internal Network is where your core infrastructure services are contained; these include Active Directory, DNS, DHCP and WINS. You can change this definition later if you like, but we need to be able to access these resources during installation, so we have to define the default Internal Network now.
Click the Add button on the Define Internal Network page. This brings up the Addresses dialog box. There are several ways to add the addresses for the default Internal Network, but my preferred method is to use the Add Adapter approach. Click Add Adapter.
On the Select Network Adapters dialog box, select the LAN NIC (or whatever name you have defined for that NIC) and then put a checkmark in the checkbox for that NIC. Make sure the information in the Network adapter details section accurately reflects the details of the NIC you selected. Then click OK.

The addresses associated with the internal NIC now appear in the Addresses text box. These addresses are based on routing table entries on the firewall - if you have not configured routing table entries on the firewall yet, these addressees might not be entirely correct, but it’s something that we can fix later, which you’ll see as we move through the installation process.
Click Next on the Define Internal Network page.

As with the installation of the ISA firewall, a number of services will need to be restarted or disabled when you’re installing the TMG firewall. In this case, these include:
- SNMP service
- IIS Admin service
- WWW Publishing Service
- Microsoft Operations Manager Service
NOTE: TMG is not saying that these are currently installed – it’s just telling you that if they are installed, they’ll be disabled or restarted.
Click Next.
Click Install on the Ready to Install the Program page

A progress bar shows your progress in the installation.

Another dialog box will appear and give you more information about how long things are going to take. Notice that these are estimated figures; despite the numbers you see here, it took almost 30 minutes for installation to complete for me.
Now the Installation Wizard has competed and you might think you’re finished. In the past, with the old ISA firewall, this would have been it. The next step would have been to go into the ISA firewall console and get to configuring Networks, Access Rules, and other components to get the thing working. But with TMG, you’re not quite done yet.
If you select the Launch Forefront TMG Management when the wizard closes, there will be a set of three more wizards that make it possible to get up and running at the end of the installation process.