RE: ISA Server or Firewall Appliance?

From: Jim Harrison (ISA) (Jim.Harrison_at_microsoft.com)
Date: 11/15/05

  • Next message: James Eaton-Lee: "RE: ISA Server or Firewall Appliance?" 
    Date: Tue, 15 Nov 2005 14:49:20 -0800
To: "James Eaton-Lee" <james.mailing@gmail.com>, "Marcos Marrero" <mmarrero@LLOYDSTSB-USA.com>

    This:
    " The only last point I'd make is that I'd be hesitant in deploying ISA
    in an internet facing role (although I do and have done that before) -
    but I don't really have a justification for this aside from "it just
    doesn't feel quite right".
    "

    ..statement is something that is expressed fairly often, but fortunately
    has not a single grain of substance to it. To James' credit, he does
    qualify his hesistation...
    I know it sounds like marketing spew, but the simple fact is; in 5+
    years of service on anything from an SBS server, OEM appliance to HUGE
    enterprise deployments, ISA server has the distinction of not having
    been the recipient of one single exploit in the wild.

    Yes; we've shipped patches for it and the odds are (realistically
    speaking), we may well do so again. So do Cisco, Juniper, et al and we
    don't hear the "just doesn't feel right" when they need patching.

    Contrast this with literally *no other* firewall maker (truthfully)
    making this claim and you have quite a piece of information at your
    disposal when you present your options in CxO-land.

    Jim Harrison
    Security Platform Group (ISA SE)
    If We Can't Fix It - It Ain't Broke!

    -----Original Message-----
    From: James Eaton-Lee [mailto:james.mailing@gmail.com]
    Sent: Tuesday, November 15, 2005 1:28 PM
    To: Marcos Marrero
    Cc: focus-ms@securityfocus.com
    Subject: Re: ISA Server or Firewall Appliance?

    On Tue, 2005-11-15 at 11:58 -0500, Marcos Marrero wrote:
    > Hello to all,
    >
    > I have a question to see what everyone out there thinks. Here it
    goes...
    >
    > Is it better to have a firewall appliance (Checkpoint, Juniper, etc)
    or
    > is ISA server enough to use as a firewall (along with all of the other
    > options it provides)?
    >
    > Of course the ISA server would sit facing the internet, like a
    firewall
    > would and it would have to sit on a hardened machine.
    >
    > Just want to know what everyone out there thinks about this
    > configuration or idea?

    What you have to bear in mind here is that an appliance is, generally, a
    hardware platform fairly similar to that which you might deploy ISA on
    top of, with a proprietary operating system (typically based on freebsd,
    or some other BSD-derived OS). Oftentimes these firewalls will run from
    flash memory rather than hard disks, but that aside there can be very
    few differences - I've seen more than one appliance (checkpoint being
    just one) based around a fairly standard ATX motherboard with an
    AthlonXP chip!

    Appliances have advantages in some instances and not in others.

    Specifically, due to the overhead of running ISA (which is harder to
    chop down to provide a subset of the capabilities of a simpler package)
    and a large, general purpose operating system, you'll almost find that
    an appliance will handle a greater load then ISA on a similar box,
    particularly if you're doing anything remotely intensive (although with
    modern hardware you'll frequently hit hardware limitations first).

    Arguably, due to the dedicated nature of an appliance, it's also securer
    as there are fewer running services, and there's more operating system
    hardening and more functionality gutted out of the operating system -
    less to go wrong, and less to exploit when something does.

    There are also disadvantages to appliances - they're, generally
    speaking, not designed to be administered in as comprehensive-a manner
    as their 'software' counterparts - meaning that when you do need to
    remove or add something it can be harder. This argument applies equally
    to adding NICs and, for instance, adding proxying capability.

    Specific to ISA, ISA is extremely flexible, and you'll probably find is
    far more capable of being deployed in different roles than, for
    instance, checkpoint. This is also a mixed blessing (as you don't
    necessary want ISA providing routing for your internet backbone, even if
    you can use it for this). It also benefits from domain integration, and
    (in my opinion), this is one of the most compelling arguments in its
    favour.

    You could also argue that if you want separation between different
    segments of your security strategy, this is a bad thing when compared to
    a set of checkpoint firewalls.

    You'll get a different argument on this from everyone (everyone has
    their favourite firewall), but hopefully that's outlined some of the
    broader arguments in favour of appliances vs. software firewalls.

    It's also worth looking (shudder the thought) at 'free' alternatives, if
    you're doing a comparison - and there are just as many different options
    here as there are in the commercial world, from the use of an operating
    system which provides routing/firewalling capability through
    kernel&userspace tools generally bundled with the OS (such as openbsd
    with pf, freebsd with ipfw, or linux with iproute2/netfilter) to an
    'appliance' based on BSD or linux.

    The latter choice starts to become more appealing when you bear in mind
    that plenty of vendors (checkpoint, juniper and borderware being just a
    few) base their network devices on BSD (and some on linux, like
    linksys). It's another debate entirely what they add to bog-standard
    BSD, but the comparison is worth making.

    m0n0wall, ipcop, smoothwall and redwall are all worth looking at in
    these situations - m0n0wall being perhaps the most appropriate for
    deployments you may be looking at. They are worth at least looking at
    when in the commercial world, license fees are such a large
    consideration!

    The only last point I'd make is that I'd be hesitant in deploying ISA in
    an internet facing role (although I do and have done that before) - but
    I don't really have a justification for this aside from "it just doesn't
    feel quite right".

    Hope that helps! :)

     - James.

    > Regards
    > Marcos Marrero * Banking Officer * Data Security
    > Lloyds TSB Bank * US Information Technology
    > _________________________________
    > Tel: (305) 347-6421 * Fax (305) 371-8607
    >
    >
    >
    > **********************************************************************
    > This Email is intended for the exclusive use of the addressee only.
    > If you are not the intended recipient, you should not use the
    > contents nor disclose them to any other person and you should
    > immediately notify the sender and delete the Email.
    >
    > Lloyds TSB Bank plc is registered in England and Wales Number: 2065.
    > Registered office: 25 Gresham Street, London EC2V 7HN.
    >
    > **********************************************************************
    >
    >
    > This email has been scanned for all viruses by the MessageLabs SkyScan
    > service.
    >
    >
    ------------------------------------------------------------------------ 

    ---
>
------------------------------------------------------------------------
---
> 
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: James Eaton-Lee: "RE: ISA Server or Firewall Appliance?"

    Relevant Pages

    • Re: Firewall Appliance Needed?
      ... a hardware firewall is used in front of your ISA server there are a number ... firewall appliance has arisen. ...
      (microsoft.public.windows.server.sbs)
    • Re: ISA Server or Firewall Appliance?
      ... > is ISA server enough to use as a firewall (along with all of the other ... > Of course the ISA server would sit facing the internet, ... What you have to bear in mind here is that an appliance is, generally, a ... top of, with a proprietary operating system (typically based on freebsd, ...
      (Focus-Microsoft)
    • Re: Firewall Appliance Needed?
      ... I feel that ISA is a very secure Firewall and an additional Firewall ... > firewall appliance has arisen. ... > retrieved via the POP3 Connector. ...
      (microsoft.public.windows.server.sbs)
    • RE: ISA Server or Firewall Appliance?
      ... I've been using ISA 2004 on a box that's been facing the internet since it's ... I've run other firewall "appliances" as well ... ISA Server or Firewall Appliance? ...
      (Focus-Microsoft)
    • RE: ISA Server or Firewall Appliance?
      ... > " The only last point I'd make is that I'd be hesitant in deploying ISA ... same about ISA Server, and I put a lot of faith in the product working ... scale, and I very much think that it's a capable firewall, proxy server, ...
      (Focus-Microsoft)
    • Quantcast