On a recent plane ride back from a customer engagement, it occurred to me that I’ve never put up a list of what I consider to be key ISA firewall best practices, tips and tricks on the www.isaserver.org Web site. I thought about the things I do on a routine basis to get the ISA firewall configured correctly so that it provides the best level of security, reliability and performance possible. The following list is the result.
In an earlier article I discussed how you can configure the DHCP Relay Agent on the ISA firewall to deliver DHCP options to VPN clients. The VPN client situation is somewhat unique, in that the RRAS server obtains IP addresses on behalf of the VPN clients, and then when the VPN clients connect to the ISA firewall’s VPN server component, the RRAS service provides the VPN clients with an IP address. The RRAS service never sends the VPN client DHCP options. That is why you need a DHCP Relay Agent on the ISA firewall. The DHCP Relay Agent forwards the DHCP messages to a DHCP server on the corporate network.
Dynamic DNS (DDNS) services enable users with dynamic IP addresses to register domain names users on the Internet can use to reach published resources. These DDNS services are a tremendous boon to small and home business users who would like to take the reins and run their own Internet accessible services.
In this article we will explore how the ISA Server 2004 Web Proxy and Firewall Client Automatic Configuration really works from a client point of view. With that knowledge you should be able to decide which method is the most appropriate for your specific environment. Although this article is written with the ISA Server 2004 in mind, most of the principles apply also to an ISA Server 2000 environment because the Web Proxy and Firewall Client Automatic Configuration is mainly a client feature, not an ISA Server issue.
Working with new software can be a frustrating experience. Often people well-heeled in a particular software package will forget what it's like to be a newbie with a particular piece of software. I was in this position not long ago when testing Small Business Server Service Pack 1.