Networks

Ask something
Discussion Locked

MS ISA Server behind PIX 515 firewall

0 helpful
5 replies

by dvandenbosch

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

About a year ago we implemented a PIX 515 firewall and did away with Border Manager as our network firewall. Unfortunately we don't have a way of monitoring internet usage unless we buy a product like WebSense, which supposedly integrates with the PIX.

Since we're now a Microsoft shop I was thinking it might be possible to deploy ISA Server as the internet proxy behind the PIX firewall.

I haven't been very successful finding any documentation on using these devices together.

Does anyone have experience with this or ideas on how to configure?

5 replies

by erikdr

Basically, it should work. The proxy 'monitors' (and forwards) the usage of port 80 and other HTTP ports, and the Pix filters all other ports and illegal port80-attempts.

At www.isaserver.org you'll find a wealth of info on ISA, including cooperation with some other fwall tools. But don't take EVERYthing they say for granted - in my (lab and hearsay) experience ISA is as good as Proxyserver 2.0 for proxying but fundamentally flawed and weak as a firewall. So better stay with the Pix for thatpart...

Hope this helps,

- The Netherlands

by nathanh

This will work fine, you can use the ISA server as a proxy to access the public networks and the PIX will not need any special settings since by default all lower nets will pass traffic from the higher nets. Since PIX traffic is stateful there is no need for reverse rules on the PIX for all the outbound ISA rules. Then you can use the ISA for reporting all outbound traffic and any traffic that gets by the PIX. This is actually a very good way to get multiple layers of security and utilize caching for outbound web access.

This discussion is closed to new replies.