In this article I’ll begin my trek through the installation and configuration of SBS 2003 SP1. The installation is a clean installation. I will not discuss upgrade scenarios in this series. While I realize that this isn’t the most common deployment scenario, it allows me to discuss the salient points of the CEICW and subsequent ISA firewall installation and configuration.
With the release of ISA Server 2004 (subsequently referred to as ISA firewall) and SBS SP1 (that included a free upgrade to the ISA firewall), came the realization that a large segment of the ISA firewall admin space is significantly underserved by our lack of coverage for ISA on SBS at www.isaserver.org. I hope that this, my first article about running ISA on SBS 2003 SP1 is the beginning of a long and continuing stream of information on how to get the most out of the ISA firewall when co-located on SBS.
In part 1 of this series of articles on the ISA firewall’s remote access VPN server component we discussed details of how the ISA firewall’s remote access VPN server provides a much higher level of security than you typically find on VPN servers included with stateful packet inspection-only firewalls. In this, part 2 of our series, we’ll go over the details of each of the granular Access Rules used to control VPN client access to resources on the corporate network.
The issue of hardening the ISA firewall has always been a hot topic. The topic became especially hot when ISA Server 2000 was released with system hardening wizards that broke key features of the ISA Server 2000 firewall product. While many of us made gallant attempts at coming up with comprehensive hardening plans that wouldn’t break core ISA Server 2000 firewall functionality, it always seemed like we were feeling our way through the dark.
One ISA firewall feature that doesn’t get the attention it deserves is the VPN remote access server component. The ISA firewall’s VPN server can provide an unusually high level of security for your remote access VPN connections because it applies the same strong stateful packet and application layer inspection features to VPN connections that it applies to any other connection made to or through the ISA firewall. This sets the ISA firewall’s VPN remote access server component apart from the typical stateful packet inspection-only firewall, where VPN users have the same level of access to the corporate network as a host directly connected to the network.
In part 1 of this two part series on configuring OWA access in a back to back ISA firewall configuration, we focused on the back-end infrastructure. In this, part 2 of the series, we’ll turn our attention to the front-end ISA firewall infrastructure and finish out by testing the solution.
Featured Links*
Receive all the latest articles by email!
Receive Real-Time & Monthly ISAserver.org article updates in your mailbox. Enter your email below! Click for Real-Time sample & Monthly sample
Become an ISAserver.org member!
Discuss your ISA Server issues with thousands of other ISA Server experts. Click here to join!