MS Proxy or Hardware Firewall

I prefer the separate firewall approach for a few reasons. It was designed for a single purpose. I'm always skeptical of microsoft's security, too many of their packages modify too many other settings when you install or update them. If someone manages to hack into your firewall they still haven't hacked into your server (multi-layer defense).

I would use a separate hardware firewall on your external connection and supplement it with software firewalls on your internal servers.

Ms Proxy is best suited as a proxy not a firewall. You'll spend a lot of time comfiguring the firewall part with out the effectiveness of an outright firewall. Proxy can not protect you from and type of denial or service attack and will be lacking in protecting from newer threats. If you go with a simple hardware based unit you will get all the latest features and be able to update the firmware to add in new ones when needed. Also with a firewall that uses statefull inspection there is no need to open any extra ports for returning users responces. A statefull inspection will see that user xyz has gone out and put 123 and when then external system respones back to xyz on port 123 it will be allowed without you having to open the port, in most cases. Hope this helps.

...my view is that both are necessary for good security. The only issue with having MS Proxy 2 in the network, is make sure you are aware of the issues you are creating by using it. You can use MS Proxy 2 for filtering out certain sites, etc, and for improving the experience (faster page loads from cache) if your users hit particular pages often. Otherwise, stick with the hardware firewall, by a matter of lifestyle ;)
Hardware firewalls which are session-state-aware (such as CheckPoint FW-1, NetScreen, or WatchGuard) are very good at what they do. Stay away from the LINUX-type 'packet-filters' which is mostly what Proxy-2 is for you right now. You want session awareness, for sure, because at that point, it's necessary to run NAT (which you surely want) and it makes it VERY difficult for an attacker to spoof and force their way into your network through port 80.

Hope that helps...email me for more info if you want to discuss further...

--rL
Sr. Security Consultant & Trainer

This question was closed by the author