As that is fairly straight forward and just limit my comments to the 2003 Server. Although make sure you have Flashed it to the latest firmware version available. I take it you are running the trial version of 2003 Small Business Server but there are a few basic things you should know about that version. Firstly you can only have 5 concurrent connections on it one of MS little tricks so it isn't overly usefully even though you do get to play with it for 6 months.
Firstly I would have the modem feeding the router and then the router feeding the server which then connects to a hub to feed the workstations.
Now on 2003 Server do not install or un-install IE6 {this has the biggest holes in it} and then make sure that the 2003 server is fully patched but first make sure that you have some form of AV protection on it because it will get infected by just loging onto the MS Web Site for the patches. I learned that one from bitter experience on a rush job that I was trying to shortcut to make things go faster instead it made me wipe the drive and start again but the lesson was learned and is something that I'll never make the same mistake again.
When the server is fully patched and I take it you are only going to use this unit as the Internet Server and not a file share server download the trial version of ISA from MS as that not only checks the packets but their contents as well or at least that is how it is supposed to work now with the current release. I think it is a 30 or 60 day trial version but it is good for experiment purposes.
Once this is setup you can then go into 2003 and implement the different levels of function that you want for each workstation and create a name list with their level of access. That will be a good start although it will never be fully secure but it will at least stop the armatures from getting in and pocking around.
When you setup the Second 2003 Server which I presume will be a file server feed the main network off the file server and the file server off the Internet server, use ISA on the file server as that will limit the accessibility to the inside of the network. On the file server you will again need to setup a Name list with different levels of access for different workstations with Active Directory this is fairly straight forward and while a bit time consuming is relatively easy to perform. Remember to not only fully patch the OS but every MS application so if you are running a version of Office patch that as well. And do this on every workstation as well. If you have standard hardware on each and every one of the workstations you can automate the patch service but if there are different components inside each workstation it will be easier to just patch every one of them individually.
Just remember to keep everything fully updated and patched and it should be fairly secure but I would keep whatever AV program you already had prior to loading ISA and maybe even put on another level of AV protection. You will have to schedule these to auto-update and run at different times and ignore the virus vaults of the other AV programs. Keep one starting on boot-up and others running at staggered intervals that way you are more likely to pickup any intrusions. Also set any ports that you have not directly allowed access through to shut or disabled whichever you prefer to call it so you do not have any attempts to sneak out a transmission on a unsupervised port.
That should give you a very good start and quite a lot to play with until you have things setup the way that you want. Also run at least one Intrusion Application just to be on the safe side to see if anyone is attempting to gain access.
I take it you are doing this for your MSCE so you want to keep everything MS but if that isn't the case you could try a front end Linux Server to access the Internet almost any Distro will do but I've recently been trying out a pre-release copy of Snap Linux which so far I haven't been able to break so it is very good and it has a Security application that fits on top it is called "Trustifier" which is supposed to make the thing even more secure and from the little that I've heard of it I'm impressed it should prove very hard to break when it is up and running. If you are interested drop me a contact through the peer listings and I'll pass on the contact details to you as while this is a Linux version it isn't one of the free ones but a commercial copy that is fully featured for security and aimed directly at the front end of any LAN, WAN market. It's so good that I'm either going to admit defeat and have myself committed for my own safety or take on selling the thing as the agent here which while not good for my sanity from the little that I've been able to play with so far looks very promising. I've only had it running for about a month now and have had it setup as a small network that is under constant attack from another computer hard wired to it so far I haven't been able to break in from the outside which I can generally do within a few minutes/hours depending on just how well it is locked down. This thing however is straight out of the box so to speak with no tweaking and I have been unable to break it yet. :(
Anyway best of luck and happy hunting.
Col ]:)
