From Ryan Groom,
Your Guide to Business Security.
FREE Newsletter. Sign Up Now!

I have written a few articles around Microsoft Internet Acceleration Server (ISA) 2006 as a firewall solution for businesses. Protection is only one component. Think of buying a fancy sports car. You have it all decked out and you lock its doors so that no one steals anything from it. The last component you need is an alarm. ISA is no different. No matter how well it is configured, you still need a mechanism to monitor and report back to you when something is going wrong or violating corporate policies. Let us take a look at WebMonitor 4.0 from GFI. Let’s take a look.

Ease of Installation (5/5 stars)

Installing GFI WebMonitor 4.0 is extremely simple. The install process simply asks where to be installed and a few simple questions concerning which IP addresses will be allowed to access the tool and what mail server you want to use to send alerts. The only note to pay attention to is to ensure that the account you specify to run the service has the appropriate permissions, otherwise you will have problems later on when trying to access the WebMonitor database.

I tested this on a standard ISA 2006 installation using Windows 2003 Server. The server was hardened and patched and ISA was set up in a DMZ configuration. The only noticeable change to ISA is the addition of a couple of rules to allow GFI WebMonitor access to GFI Update site and to allow “local users access” to the GFI WebMonitor Web GUI.

Click here to View ISA Rules Image

Ease of Use (4.5/5 stars)

WebMonitor doesn’t only monitor traffic, it allows you to set policies across the network on what people can and cannot access. The interface is broken into a number of sections including WebFilter, WebSecurity, and Monitoring.

Click here to see an image of the GFI WebMonitor

The admin can configure the network according to corporate policy. The monitoring and WebFilter section allows you to view in real time who is accessing what, what they are downloading, how much bandwidth they are using and all of their browser activity.

WebMonitor also gives you the ability to sever connections based on your policy. There is something satisfying about stopping someone from downloading the latest movie trailer in mid download. Should you feel the need to be even more Draconian, you can configure white and blacklists.

The WebSecurity allows you to easily block unwanted downloads using Download Control.

Click here to see the Download Policies Screen

The beauty of the interface easily allows the administrator to choose the type of download, who it applies to and who (the user or the administrator) gets notified when an exception to the policy occurs. GFI WebMonitor also can use three brand name anti-virus vendors to scan downloads for spyware and viruses. Using BitDefender, Kaspersky and Norman, users are kept safe at the Gateway despite of what they may have tried to download. Quarantine flags any malicious items so you can easily determine what it was that set off the alarm. There is also an Anti Phishing engine built in, but this option was not available for the product I reviewed.

Support (5/5 stars)

To me support is paramount. If you are going to charge me for a product, I expect support should something go wrong. Support with GFI surprised me. This is good, read on... When I initially configured the product, My ISA rule set was too restrictive and I was playing with the rule set. I inadvertently stopped GFI WebMonitor from accessing the DB. I had left for the weekend and didn’t think anything else about it. When I returned there was an email from GFI support noticing that I was having trouble accessing the DB (kudos to GFI for checking their logs) and would I follow the attached troubleshooting process. GFI has its own trouble shooter built in which allows you to create all of the files that GFI support requires should something go amiss. In my case, it was my fault and I quickly realised the problem, but I can honestly say that that is the first time I have been proactively contacted when there is an issue. My hat’s off to GFI.

Conclusion

On GFI’s website is says, “Research by IDC shows that up to 40% of employee internet activity is non-work related. As a network administrator, you need tools to control employees' web browsing activities and to ensure that any files downloaded are free of viruses and other malware.” GFI WebMonitor lives up to being one of those tools. Overall, GFIWebMonitor is an excellent addition to any ISA installation. The control and knowledge that an administrator can glean from using the tool is definitely worth the price tag for the peace of mind it affords. Bottom Line: If you have ISA 2006, get GFIWebMonitor for ISA