Re: ISA Server or Firewall Appliance?

From: Abe Getchell (mailing.list.spooler_at_gmail.com)
Date: 11/16/05

  • Next message: Laura A. Robinson: "RE: Renaming Administrator account" 
    Date: Wed, 16 Nov 2005 12:37:01 -0500
To: "Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@pacbell.net>

    Susan,

    ISA is a very flexible piece of software, as mentioned previously in
    this conversation. In technology, flexibility usually implies
    complexity. In this case, that implication is very true, as both ISA and
    Windows are extremely complex pieces of software. Complexity is not
    something you want in a firewall, under any circumstances, but
    especially not on the perimeter (given a "buffer" which usually exists
    in regards to an internal firewall). Complexity means more moving parts,
    more things to break, more things to misconfigure, more things to
    manage... With an appliance (or appliance-like) solution, the vast
    majority of that complexity doesn't exist. This theory is a simple "best
    practice" which many organizations follow, or should, if they don't.

    Another problem I have, personally, with ISA is the fact that it's
    (usually) tied into the same directory which an organization uses to
    manage the rest of their business systems. This functionality should be
    completely separate in theory (in accordance with "best practices" as
    well as what Microsoft has stated in numerous whitepapers), but in
    practice, it usually is not. Managing your perimeter firewall via the
    same directory you use to manage the print server which is on your
    internal network is NOT a good idea, for any number of reasons.

    Abe 

    -- 
Abe Getchell
abegetchell@gmail.com
http://abegetchell.com/
Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] wrote:
> The annoying SBSer with ISA on her box is going to challenge you on that 
> one.
> 
> What exactly doesn't feel quite right?  Why does it not feel right?
> 
> In my network I like it because it's on a platform that I can monitor 
> easier. Control better.  Patch easier.  [WSUS will soon support ISA as a 
> matter of fact]
> 
> Isn't the same true for big networks?
> 
> I think we all need to let go of our OS perceptions and look at the 
> realities of operating systems these days and what not.  If we can't 
> control it...understand it...I'm not sure it's not helping in the 
> security fabric of my network.
> 
> Our firewalls are not our perimeters any more.
> 
> http://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?EventID=1032286231&EventCategory=3&culture=en-US&CountryCode=US 
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: Laura A. Robinson: "RE: Renaming Administrator account"

    Relevant Pages

    • Re: Fazing out x86
      ... important are fighting on old core. ... we have simple ISA, we can have simpler core, many of them, why not 2 ... x86 core and 4 new core and BIGGER caches!? ... but at the expense of complexity. ...
      (comp.arch)
    • Code density and performance?
      ... For a new ISA intended to be suitable for markets from ... Since all implementations would have an on-chip L2 cache, ... Heidi Pan's "High Performance, Variable-Length Instruction ... In addition to decode complexity constraints, ...
      (comp.arch)
    • Re: ISA Server or Firewall Appliance?
      ... misconfigured appliance firewalls. ... I'm not convinced 'the vast majority of that complexity doesn't exist' ... you have folks that understand that firewall you can make such blanket ... In this case, that implication is very true, as both ISA ...
      (Focus-Microsoft)
    • Re: SBS R2 ISA2004 Dark Arts
      ... ISA in SBS as intended or you'll get into trouble. ... I have to get the back firewall configuration to work with the ... network in the rules/policies. ...
      (microsoft.public.windows.server.sbs)
    • Re: Outgoing VPN Error 619
      ... I've checked in local network rules and I do have a rule called VPN clients ... PPTP clients are configured to use ISA as a hop to the Internet ... SecureNAT Clients while still trying to have Web and Firewall Client ...
      (microsoft.public.isa.vpn)
    • Quantcast