لطفا منتظر باشید ...
Frequently Asked Questions
The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the 'Ask the Author' form. You will also gain access to thousands of other FAQs at ITFAQnet.com.
Q: Is ISA Server 2004 a firewall or a cache server?
A: ISA Server 2000 can be configured as an integrated firewall and caching solution, or it can be deployed as a locked-down firewall only. The caching feature is disabled by default and is enabled only after a firewall administrator acts to enable it. Organizations require a robust firewall solution. The ISA Server 2004 firewall secures their networks with ISA Server 2004 dynamic packet filtering (stateful filtering), intrusion detection, system hardening, and deep application layer inspection. Microsoft's emphasis in developing and marketing ISA Server 2004 is on its firewall functionality.
Q: Does implementing the cache functionality compromise the security of ISA Server as a firewall?
A: No. The cache is a sophisticated memory and disk-based storage engine that allows improved network access performance by storing frequently retrieved objects. The Web cache is integrated into the firewall service engine that provides Hypertext Transfer Protocol (HTTP) connectivity, filtering capabilities, and security-related tasks such as content screening and Uniform Resource Locator (URL) blocking.
Q: Can I deploy only the firewall functionality?
A: The ISA Server 2004 firewall architecture is quite different than the ISA Server 2000 architecture. Because of this, the ISA Server 2004 firewall does not distinguish between firewall and caching services - all services are mediated by the hardened firewall service. You can completely disable Web caching if your organization does not require it.
Q: Do I have to run Active Directory to use an ISA Server 2004 firewall?
A: No. Active Directory is not required. While the ISA Server 2004 firewall can leverage the users and groups contained in the Active Directory to provide granular inbound and outbound access control that no other firewall on the market can provide, you do not need an Active Directory or NT domain to benefit from an ISA Server 2004 firewall.
Q: How does ISA Server handle streaming media?
A: ISA Server 2004 includes application filters that manage complex media streaming connections. It specifically supports Microsoft Windows Media-based streaming, RealAudio and Apple QuickTime. ISA Server 2004 has dropped support for media stream splitting.
Q: How do ISA Server 2004 access policies differ from ISA Server 2000
A: ISA Server 2000 access policy was based on Protocol Rules, Site and Content Rules, IP Packet Filters, Server Publishing Rules and Web Publishing Rules where deny rules were processed before allow rules. In contrast, ISA Server 2004 access policy is a single, unified ordered list of Firewall Rules that are applied from top to bottom. The rule highest on the list that matches the characteristics of the connection is applied.
Q: How does ISA Server 2004 support Exchange Server?
A: ISA Server 2004 provides a unique level of protection for Microsoft Exchange Servers. Remote access to Microsoft Exchange can be done in a highly secure fashion using ISA Server 2004 secure RPC publishing, secure Outlook Web Access Publishing, and secure POP3/IMAP4/SMTP publishing. The firewall performs SSL-to-SSL bridging, which provides a level of inspection of SSL stream content that no other firewall in ISA Server 2004's class can provide. In addition, the ISA Server 2004 firewall can perform form-based authentication on behalf of the OWA site on the internal network by generating the log on the form itself. This prevents non-authenticated connections to the OWA site.
Q: Can I put a VPN Server behind the ISA Server 2004 firewall?
A: Yes. Unlike ISA Server 2000, you can publish non-TCP/UDP protocols (GRE) using ISA Server 2004. You can publish a PPTP or NAT-T compliant L2TP/IPSec VPN server located behind the ISA Server 2004 firewall. In fact, you can make the ISA Server 2004 firewall a VPN server itself and publish a VPN server located behind the ISA Server 2004 firewall.
Q: What is ISA Server 2004 Multi-networking?
A: ISA Server 2004 multi-networking greatly increases the flexibility you have in deploying the firewall and expands on the LAT-based network view used by ISA Server 2000 firewalls. ISA Server 2004 firewalls apply firewall policy to all network interfaces and the firewall administrator can set the routing relationship between these interfaces. Each Firewall Rule includes a reference to the source and destination network. Unlike with other firewalls, you do not need to create rules for each interface because the ISA Server 2004 firewall automatically creates the required stateful filters to allow or deny the connection based on interfaces used for the source and destination networks.
Q: What is the Firewall System Policy?
A: Firewall System Policy is a default set of Firewall Rules that allows the ISA Server 2004 firewall to communicate with vital network infrastructure services on the internal network. The Firewall System Policy takes effect immediately after the ISA Server 2004 software is installed. The firewall administrator can adjust Firewall System Policy after the firewall is started the first time.
Q: What VPN Protocols does ISA Server 2004 support?
A: ISA Server 2004 supports PPTP and L2TP/IPSec for client/server VPN connections. When ISA Server 2004 is installed on Windows Server 2003, the VPN client can take advantage of IPSec NAT traversal (NAT-T). This allows the VPN client, VPN server, or both to be located behind NAT devices and use a secure L2TP/IPSec connection. ISA Server 2004 firewalls support PPTP, L2TP/IPSec, and IPSec tunneling more for site-to-site VPN links.
Q: What is Application Layer Filtering?
A: Application layer filtering allows the ISA Server 2004 firewall to determine the validity of communications moving through it by examining application layer protocol commands and data. The ISA Server 2004 firewall is configured to recognize legitimate commands and data for the application layer protocol, then pass valid connections and reject invalid ones. Traditional firewalls are not able to assess the validity of a connection attempt or message because they are only aware of source and destination IP addresses and port numbers. Traditional firewalls pass exploit code because they do not understand application layer protocols. ISA Server 2004 firewalls have a deep understanding of the most popular application layer protocols used on the Internet today. This understanding allows ISA Server 2004 firewalls to protect your network from known and unknown exploits now and in the future.
Q: Does ISA Server 2004 Application Layer Filtering have an effect on performance?
A: Deep inspection of application layer protocol commands and data does incur some memory, disk, and processing overhead. The level of overhead is determined by the number of rules and communications per second the firewall evaluates. Larger Firewall rule sets generate greater overhead than smaller ones. ISA Server 2004 includes a built-in Performance console you can use to evaluate effects of different rule set configurations. Because ISA Server 2004 runs on PC architecture hardware, it's simple to upgrade the hardware component that performance analysis indicates is causing a bottleneck. Traditional hardware firewalls require that you purchase a new license, or worse, purchase a new device when hardware upgrades are required.
Q: Can I customize the presentation of the information displayed in ISA Server 2004 reports?
A: The ISA Server 2004 reporting engine allows you to customize many components of the built-in ISA Server 2004 reports. For example, you can increase the number of user names that appear in the Web usage report, the number of sites that appear in the Web usage report, and the sort order of applications that appear in the application usage report. This is just a small sample of the customizations you can make to the ISA Server 2004 reports.
