From Ryan Groom,
Your Guide to Business Security.
FREE Newsletter. Sign Up Now!

I have been a proponent of Internet Security Acceleration (ISA) server from it’s inception to the latest reincarnations (ISA 2006). ISA provides a great security barrier between the outside world and your business. It is powerful yet fairly intuitive to use so that even a small shop with limited IT resources would be able to set up ISA securely with minimal effort. In this article we will take a look at some of the new and improved features of ISA 2006.

ISA is a Software Firewall and Proxy product from Microsoft. We have discussed the virtues of software versus hardware firewalls in other articles. You will require Windows Server 2003 to get the most from the product, but it is well worth it for the range of services you will reap. Let’s take a look.

Access

One of the key features of ISA is being able to serve as both a proxy and a reverse proxy server (That’s the “A” in ISA – Acceleration). ISA 2006 has now included integrated support for publishing out Exchange and SharePoint servers. This is a safe mechanism to allow users to access your in house Exchange or SharePoint server without a major reworking of the system. Microsoft has also included Cross Array Link Translation to allow web content published with an internal name to be published with an external public facing name regardless of where the resource resides on the array (An array is a collection of ISA servers collectively working as one ISA unit). Pretty cool.

VPN connectivity

Being able to connect your offices across the city has always been a bit of a pain. ISA now provides the Branch Offices VPN Connectivity Wizard which allows you to step through a process to help connect multiple offices together. Whether your offices use domains or simply workgroups, ISA will walk you through the process of connecting the sites together. A much needed tool!!

Firewall Protection

The rule set with ISA is continually improving. ISA does include rule Wizards to make rule creation easier. If you have ever set up a PIX firewall, you will appreciate the rule Wizard with ISA. More importantly, ISA now includes a number of features to help against intrusion attempts.

Flood resiliency protects ISA from Denial of Service attacks due to flooding. Flooding is when an attacker attempts to shut your system down by simply overwhelming it. Flood resiliency ensures that ISA is always reachable and not fully taken down by such an attack.

Microsoft has also added enhanced remediation during the attack. ISA allows throttling of the logs so they do not fill and bring your server to a halt, memory consumption control and the ability to kill DNS queries.

Server Publishing

One of the most adaptable features of ISA is the ability to reverse proxy (or Publish in Microsoft-ese) internal servers to the Internet. If you want to publish a web site or give external users access to their Exchange Server, ISA has wizards built in to help you. In fact two new wizards are the Exchange and SharePoint publishing wizards which make the accessibility of these two servers for your remote users a snap.

Now one of the things I always hated with wizards, was being led down the garden path until I encountered something out of the ordinary...then you were stuck. ISA allows just as much control with the rules after they are created, that if you do require to go back and amend rules, it is not as difficult as it once was.

Conclusion

Microsoft also bumped up the performance of ISA by playing with HTTP compression and Web publishing load balancing. All in all, if a software firewall system is best for your office, ISA 2006 is worth the investment. If you have an administrator who is used to managing Windows, ISA`s intuitive wizards and user interface make it a worthwhile addition for many businesses.