RE: ISA Server or Firewall Appliance?

From: Thomas W Shinder (tshinder_at_tacteam.net)
Date: 11/17/05

  • Next message: Barrie Dempster: "SBS always a security compromise ?" 
    Date: Thu, 17 Nov 2005 14:36:48 -0600
To: <focus-ms@securityfocus.com>

    Hi Abe,

    You should check out the Network Engines ISA firewall appliance. They
    have completely locked down the box. You can't get to the file system or
    anything else that Network Engines hasn't exposed to you, as required
    for firewall configuration. Unless you really worked had at it, you'd
    never know you were dealing with a Windows-based firewall. That's how
    hard they've locked down the interface. Some people love it, because it
    looks like a "hardware" firewall, while ISA firewall aficiandos don't
    care for it, because you can't make it dance and sing and do some of the
    amazing stuff you can do with it if you had full access to the ISA
    firewall and OS components. But it does solve the problems you bring up
    regarding complexity and potential to break things due to that
    complexity.

    Tom

    Thomas W Shinder, M.D.
    Site: www.isaserver.org
    Blog: http://spaces.msn.com/members/drisa/
    Book: http://tinyurl.com/3xqb7
    MVP -- ISA Firewalls
    **Who is John Galt?**

     

    > -----Original Message-----
    > From: Abe Getchell [mailto:mailing.list.spooler@gmail.com]
    > Sent: Wednesday, November 16, 2005 12:22 PM
    > To: Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]
    > Cc: focus-ms@securityfocus.com
    > Subject: Re: ISA Server or Firewall Appliance?
    >
    > Hi Susan,
    >
    > You bring up a good point concerning misconfiguration (of course it's
    > possible to misconfigure an appliance firewall), but with an
    > appliance
    > solution there's simply less to misconfigure in the first
    > place; either
    > the component simply doesn't exist or the administrator isn't given
    > (direct) access to screw it up.
    >
    > However, that being said, having people who understand
    > firewalls and can
    > manage them appropriately isn't at question here, that's an HR issue.
    > What is at question here is which piece of technology, that
    > the original
    > posted described, is better suited to be a perimeter firewall. We're
    > talking pure technology here, as is usually implied when
    > asking a "which
    > is better" question on a technology mailing list. We just assume that
    > regardless of the solution it will be managed competently (though we
    > shouldn't... we really, really, shouldn't).
    >
    > Simply going through the basic build/configuration/management process
    > and comparing the steps/processes involved will give you a
    > clear picture
    > as to why appliance solutions (such as Check Point's SPLAT or Cisco's
    > PIX) are much less complex than a "general purpose" solution (such as
    > Windows/ISA or Linux/IPTables). I'll spare you (and everyone
    > else) the
    > lengthy e-mail (unless you really, really, want it) and let you go
    > through that exercise on your own, if you choose.
    >
    > Abe
    >
    > --
    > Abe Getchell
    > abegetchell@gmail.com
    > http://abegetchell.com/
    >
    >

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Barrie Dempster: "SBS always a security compromise ?"

    Relevant Pages

    • Re: Firewall for VMS / TRU64
      ... >}for up to 254 client computers. ... >}Think of a firewall also as a circuit breaker. ... >}the network is much better than having your computer do so. ... is that the appliance is dedicated to one specific type of task. ...
      (comp.os.vms)
    • Re: searching for hardware firewall with web history
      ... it is marketed as an appliance... ... >hardware in it and the OS is some sort of BSD derivate. ... >> indicate that Astaro is a software firewall. ... Wrong, marketing speech and technical ...
      (comp.security.firewalls)
    • Re: ISA Server or Firewall Appliance?
      ... > is ISA server enough to use as a firewall (along with all of the other ... > Of course the ISA server would sit facing the internet, ... What you have to bear in mind here is that an appliance is, generally, a ... top of, with a proprietary operating system (typically based on freebsd, ...
      (Focus-Microsoft)
    • RE: ISA Server or Firewall Appliance?
      ... I've been using ISA 2004 on a box that's been facing the internet since it's ... I've run other firewall "appliances" as well ... ISA Server or Firewall Appliance? ...
      (Focus-Microsoft)
    • Re: Hardware vs Software Firewall - Pros and Cons?
      ... Now the problem is how to define a firewall appliance ... ... (Layer n refers to the OSI model). ... A more buzzworded firewall is a stateful packet filter with deep inspection. ...
      (comp.security.firewalls)