to ISA or not to ISA......

Hi everyone,

About a week ago, I started setting up a new company/domain and was at that time planning on running RH9, with Apache, Sendmail, and FTP. Since that time, I have looked at Sendmail and Qmail, and have had little luck getting either properly configured.

THe owners of the comapny have decided to go back to what we know, SBS2000.

My question is this. Is ISA robust enough to be the sole firewall on this server/domain, or should I convince them that the purchase of a hardware solution is neccessary?

Idea and opinions are great appricated.

MrCoffee

If you want ISA for the firewall only, buy a hardware firewall. It'll cost you less (1500 Us per Processor for ISA 2004) and it'll probably be more secure. It's really dependent on your need also. Do you need web caching abilites? VPN Abilites?

Etc Etc

THis server is going to be acting as a webserver, email server, and ftp, but email will be for a very limited number of people. I can't image the webserver or ftp will get more then 50-100 hits an hour max. Might want OWA at some point. We will not be using it as a proxy server.

Actually I was looking on CDW and found a base Sonicwall to work in conjunction with the ISA for around $249 so thats most likely the way I will go. But MS says that ISA is all you really need for a single domain. Acting as firewall for both server and client.

Don't run ISA and your webserver/ftp on the same machine.. It's asking for trouble...

Ok. But why? ISA come bundled with Exchange on SBS. In that kind of a configuration, it isnt possible to take the Web/FTP/email/ISA/IIS/SQL and put in on different servers, and why would you want to, since the whole point of SBS is to get everything you need.

Cheers!

Quote:

---

Originally posted here by MrCoffee
Ok. But why? ISA come bundled with Exchange on SBS. In that kind of a configuration, it isnt possible to take the Web/FTP/email/ISA/IIS/SQL and put in on different servers, and why would you want to, since the whole point of SBS is to get everything you need.

Cheers!

---

its just a basic security rule. As more components you put in a machine, more change of a "security breach" appears. Its not advisable run other stuff on the same machine as the firewall, EVEN when MS tell you to do so.

One of the goals of ISA is to act like a web server, ftp and email server all together but to redirect the traffic to a server inside your LAN who is secure. If you redirect the traffic to you the same machine, it’s destroyed that goals. I’ll stick with by first idea; buy a Sonicwall Firewall with DMZ and VPN support. (Specially VPN support, you don’t regret the $$ spend on that)

Ok. Now that makes sense (or maybe just stated in a way that my simple mind could grasp..:) It is strange that they would bundle it in such a way that it HAS TO reside on the very same server as the web/PDC/etc.
I wasn't trying to be difficult with my question, I was just trying to understand why it wasnt recommended.

I have a rec for either a Soho or a Watchguard and will order it today.

Thanks!

I have a couple of sites that run SBS 200x

I beleive the ISA is bundled for security and internal access...an intranet site...and not recommended for public access. Yes they do have public services available for the clients to work remotely...
and you need a VERY strong password policy enabled for these services to be and remain secure....and put a hardware firewall infront.

Get a real server if you want to host a public website. or set the SBS up for the services and pay to host your website\public access somewhere else.

The SBS is for small businesses to be able to have bundled services at a lower cost with out the Small Business having to buy 4 seperate servers, apps and CALs etc

You cannot install any of the SBS components SQL, Exchange, ISA etc on another server unless you buy seperate licensing for that server and setit up as a member.

The SBS is the domain controller.


My .02 cdn

MLF

I agree with Morgan. The bundling of ISA in SBS is intended to give a small business a certain degree of proxy, web caching, internet shating, and internal website protection... Using the sonicwall firewall in conjuction with ISA would work and give you a lot more protection than just using the ISA server as your firewall, exchange, iis, etc.. etc.. etc....

Nobody ever said that MS marketing in the past has been majorly concerned with putting out security products that agree with what everybody will tell you is a good model.

Got the server set up, but off the net until the Sonicwall arrives next week.

Thanks to all for your input!
MrCoffee

Mr Coffee

To fully benifit from the ISA firewall...use 2 NICs
One to the sonic firewall (WAN) and one to the LAN.

..an extra level of protection cant hurt ;)

MLF

im going to disagree.

SBS is meant as a complete package a for small business. That is an organization that has one server to dedicate to the internet. There is nothing basically insecure about ms-ftp outside of the fact the the password is sent in plain text. It still has to be captured. (trojan on a client your router is wide open, etc.) if the account that is used does not have any significant rights.... if its configured properly, you watch the logs and follow good sec procedures its alright. if you have a 'basic' web site without frontpage extensions or any test or example components, any asp thats used follows good sec guidelines and its configured and updated as it should be...its secure. Whats wrong with exchange if you know what your doing? I mean you have to go out of your way to make it an open relay and if it's kept up to date there are no remote exploits. Sure they happen but they are patched just as fast. It might not be the ideal security model but its sufficient as long as your not extending your use of it beyond its intended purpose.

If you use it your job becomes one of looking for new exploits against it, keeping it patched (all components) and using work-arounds until a fix is found for any new exploit and if the company your working for has not sprung for a good AV system, one that works with exchange...quit. It's only going to hurt your reputation and self esteem..

There is NO NEED of an additional firewall if you learn to use ISA correctly and harden the server. If you want more security you can find it in your routers configuration.

Although its reporting abilities suck and third party plug ins are needed ($$) to get any real info the logs are still available to you and can be searched/grepped for the info you want and a well written batch file can give you more than adequate reports...or better yet perl.

I used isa for almost two years....hated it. It was really mickey mouse but it servered its purpose.

If the network gets hacked while your administering it...you did something wrong or better yet you did not do something right.

Tedob1,

When you look at Microsoft Overview page of ISA 2004 (See Link), the figure 1 really show that ISA should be use to intermediate server. For me, ISA is just a firewall build on Windows Kernel with Active Directory Abilities.

Link : http://www.microsoft.com/isaserver/e...ew/default.asp

Morganlefay: Yup, good suggestion, I actually have two teamed NICs, and a third for ISA :)

Tedob1: I am leaning toward agreeing with you, the more I read and learn about SBS. But based on my 1) lack of overall knowladge of ISA, and 2) my short time frame to get this up and running, and 3) my lack of any kind of budget, and 4) that I am getting no kind of payment what so ever for setting this all up (It is being done on my time) it is most likely best that I install the sonicwall I ordered.
The plan is basically this: Set up SBS2000 server, Exchange, ISA, IIS behind the sonicwall. Go home and set up a "testbed" network of SBS. READ READ READ, try, test READ READ READ, try test some more. Learn ISA inside out, learn SBS inside out. READ READ READ. Reconfigure live server as needed. (Read some more).. :)
Honestly I just do not have the faith in my skills that I can do ISA properly at this point.
But so far I have been reading a book called "SBS 2000 Best practices" which takes you from planning to full configuration of SBS and all it's parts. The forewards are written by Ben Smith, from Microsoft, and having met him, I thought I would get his input. His email mirrored yours pretty closely. If you ARE going to use ISA without a hardware firewall, you HAVE TO configure it RIGHT. But it can do the job, and is, for both Hotmail and MSN.

SDK: My understanding is that ISA as a stand alone product is used as a intermediate server, but the functionality is different under SBS. You might want to look at the ISA product info in comparison. Always remember that when you are talking SBS verses other MS Servers, all the products MUST reside on the SBS server. There is no way to properly "break them out".

Cheers!
MrCoffee

I lack information about SBS. I'll look into it before my next port! If I never manage to get some free time before Monday, I never to take down my network this week-end! Will be pain!

SBS is a whole nother beast because everything resides on one box.

ISA, Exchange, SQL, etc

I never would recomend a SBS to have public access...unless that is all it is going to be used for.

I guess it all depends on what is being stored on the box.

Most small businesses only have the one server.......and use it for internet access, email and a database app, user files etc.

I would always put a hardware firewall in front as an extra layer..

But then again...if the port is open for a service....its still open to attack. :eek:

My thoughts are if there is a vulenrability with the OS, ISA, Exchange or SQL or any 3rd party app.....maybe it can be stopped by the hardware firewall until the server can be downed and patched....which with a small business you down all services..
.and hope it comes back on line :(

My .02 cdn

MLF

Morgan is right.... For a few reasons....

1. Defense in depth.....
2. Additional ability to open and close services regardless of potential vulnerability
3. Improved and more diverse logging of connections.
4. It's just smart to have a HW firewall sitting in front, with luck you can properly DMZ it all too.

No brainer.... I think Morgan was using US cents....

if you have a HW FW there is absolutly no reason to use ISA unless you configure it to be a proxy only...and why would anyone want such a piss-poor proxy at such a price?

Tedob1


The ISA logs and controls access...in and out.

Most of the low end HW FW only log incoming.

I am asked every once in a while to report on a users internet usage...and I use the ISA logs to get my data from.

The new features of SBS are mostly for remote access, Outlook Web access,vpn, terminal server etc....I would want the ISA there to authenticate and log who\when is accessing the server.

The SBS Standard does not come with ISA.

The SBS Premium comes with ISA and SQL...and most of the time...the ISA is just a bonus cause the businesses want the SQL to run their databases.

Tiger...Thanks
But it definately is canadian sense

MLF