Security

Ask something
Discussion Locked

ISA 2000 and SonicWall

0 helpful
8 replies

by eminent87 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,

Currently we are using a sonicwall for our firewall and vpn but we're in a process of testing ISA server. Although the sonicwall has been working good for us, we want something more flexible to work with. So instead of cutting the sonicwall out completely, can we leave the sonicwall in place and add the ISA Server in front of it? What are the pros and cons to this method? Can someone give me some ideas or recommendation for my setup? Thanks!

8 replies

by cg it

well kinda need a little form info like are you using ISA server in conjunction with Windows 2000 server and running Active Directory? 2 firewalls tend to be very very secure. So much so that nothing gets in or out. ISA server is a big configurable proxy server and packet filter with grandularity to the protocol level and even further on down e.g. allow or deny specific protocols HTTP or FTP and so on. Is configurable to allow or deny at per user or groups of users configurable to allow or deny specific type of data such as audio or video file extensions that may come over HTTP such as .avi .wma .mp3 files. Can route protocol traffic to downstream servers that may host services such as web or ftp services. If you have a firewall between ISA and your network and the two don't coincide with each other, traffic you may want could be blocked by either one and determining which one can be a daunting task.

by ewgny

There are no real cons for using 2 firewalls from a security standpoint. I would suggest that you use a back to back configuration with the sonicwall between the internet and the ISA server. Although Microsoft claims that a properly configured ISA server has never been compromised, it would be a good idea to put it behind a statful packet inspection firewall.
Since ISA server is an application layer firewall, as well as a proxy server, it would be best placed between the internal network and the sonicwall. I suggest the book "ISA Server and Beyond" by Shinder
which covers various ISA topologies
http://tinyurl.com/4ymab
also visit his site at
www.isaserver.org

by ewgny

I disagree with answer 3. By having ISA behind th SPI firewall, it can also be a member server. Somthing you would not want to do if the ISA were on the edge of your network. By being a member server the ISA server can for example have rules based on group membership, as well as internet access based on windows authentication.
Also the use of ISA's firewall client (on the workstations) is what makes it a powereful application layer firewall, and having the sonicwall between the clients and ISA would make the use of firewall clients difficult. By having the SPI firwall on the edge, ports can be opened and directed specifically to the external interface of the ISA Server depending on what services are required. This would reduce the exposure of the ISA to attack.
The ISA server can in turn provide services via publishing to the external network

by techkid

I disagree.

Put the ISA server out in front of everything. ISA is an application layer firewall which is superior to any SPI firewall. True, it's a Windows box out on the internet but properly configured... application layer firewall is superior to a SPI firewall.

If you put the ISA out in front you can put an Exchange front-end server behind the ISA server. Advantages are a unified name space for OWA/OMA, more secure because the OWA/OMA requests are being filtered at the application layer before they hit your IIS box.

Use the SonicWall behind the ISA server and behind your exchange front-end... should you use an exchange front-end.

Here's everything you need to know about ISA

www.isaserver.org

This discussion is closed to new replies.