Good article but I think a couple of points need to be added in order to be fair.
1) ISA comes in two versions: Enterprise and Standalone. In the former, the configuration is in the Active Directory. In the latter, it is in a number of places but obviously on the machine itself.
2) In the standalone version, the configuration backup functionality is misleading. Yes, you are backing up the configuration but you can only restore it to the original host machine. If the hard disk crashes on you rebuilt the machine (i.e., W2K and ISA), you can't restore the configuration from the backup. This leads to an obvious conclusion. If you want to really backup your ISA Server, then you need a disk image. This leads to a paradox. Most small installations that use ISA in the standalone version don't make disk images.
3) In the Enterprise version, there is a lot of money to spend. There are some good arguments for ISA in this configuration. However, this is not a inexpensive solution and at this financial point, you have a lot of alternatives.
4) ISA with Small Business Server is a nice idea. Here you have your Domain Controller, Exchange Server and ISA all sitting in one place on the network perimeter. Forget Defense in Depth. Still, how many small businesses buy Defense in Depth? They should but they don't. At least, in this configuration, there is a chance that the machine will be properly configured and managed.
4) One of SANS Top 20 vulnerabilities is the "Default Configuration". Very few vendors have a default installation that turns off all features. Remember: "Security does not sell software. Features do." Perhaps, that is why ISA fits in so well with RRAS.
5) ISA is not any poorer than other firewall solutions and in many ways it is better than most. It is a nice integrated little package with a GUI interface. Still, it needs to be configured and managed and that re
