لطفا منتظر باشید ...
Frequently Asked Questions
The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the 'Ask the Author' form. You will also gain access to thousands of other FAQs at ITFAQnet.com.
Q. Why doesn't Microsoft offer ISA Server as a turn-key security appliance?
A. Microsoft is working with partners to provide security appliances running ISA Server, which can compete more directly with other hardware-based firewall and caching products for those who prefer the advantages of the appliance form factor over the flexibility and easy upgradeability of a software-based solution. Companies offering ISA Server 2004-based appliances include Hewlett-Packard, Network Engines, RimApp, and other hardware vendors. These ISA 2004 appliances will run on a hardened version of the Windows server OS and will provide the turn-key convenience of an appliance with all the deep integration into Windows networks that only ISA Server 2004 can offer.
Q. Is ISA Server's underlying operating system (Windows 2000 Server or Windows Server 2003) inherently insecure, and does this make the firewall insecure as well?
A. No, and no. Microsoft's security initiative began in earnest with the release of Windows 2000 server, which included a level of security orders of magnitude above its older operating systems. Windows 2000 introduced numerous new security features such as Kerberos authentication, file encryption, Active Directory, the Security Configuration Manager, Transport Layer Security (TLS), IPSec, PKI support, smart card authentication, L2TP VPN, and more. That trend has continued and intensified with the release of Windows Server 2003, which is built on a 'secure by design' and 'secure by default' philosophy, wherein services such as IIS are disabled out of the box.
ISA Server 2004 uses the Windows Server 2003 Security Configuration Wizard (included in SP2), which includes a special ISA Server profile to harden the OS specifically for running the ISA firewall.
Q. How can ISA Server compete with low-cost NetScreen and SonicWall devices that are priced under $500?
A. If you examine the specifications for the low-end devices, you'll find that they are intended for SOHO or telecommuter use. They cost less, but they also give you less functionality. For example, they provide far fewer simultaneous VPN tunnels, fewer concurrent firewall sessions, and/or much slower throughput. ISA Server was not designed for SOHO/telecommuter use (although it can perform well in those situations). It is designed for medium-to-large networks, and its specifications reflect that. Additionally, the low-cost firewalls mentioned don't provide any Web-caching functionality at all. Adding another caching solution on the network will bring the true total price up considerably.
Q. Most popular firewalls, such as PIX, SonicWall, and NetScreen, seem to come in several different models. Why does ISA Server only come in two editions? How can ISA Server scale to meet the needs of small to very large organizations with only two editions?
A. That's the difference between appliances and software-based firewalls. If you read the fine print, you'll see that the firewall software itself is the same for all those different models (although some of its functions may be disabled on some models unless you buy extra licenses). The differences between the models are generally hardware differences: processor(s), amount of memory, number and type of network interfaces, and so on. With ISA Server, you can install the software on any machine that meets the minimum requirements. Thus, you have complete control over the hardware specs, rather than being forced to choose between a set number of models.
Q. Why does ISA Server support only CARP for communications between caching servers, when other caching proxies support a number of different protocols, such as ICP, HTCP, Cache Digests, and WCCP?
A. The Cache Array Routing Protocol (CARP) was selected as the protocol of choice for communications between distributed ISA Server caches because it is the most optimum for this purpose. CARP supports both server-side and client-side routing requests. Server-side routing is similar to that supported by WCCP
and ICP. Client-side routing is more efficient because the client is able to predetermine which array member is responsible for the URL, and can send its request directly to that array member. CARP uses a more efficient method for caching content across multiple servers in that CARP, unlike ICP, ensures that cached Web content is not duplicated on servers and that the CARP algorithm provides a deterministic method for locating the server that holds the cached content.
Q. How does ISA Server's VPN quarantine feature compare to similar features provided by other firewall/VPN vendors?
A. VPN quarantine is provided through the Network Access Quarantine feature of Windows Server 2003. It allows you to block connections from VPN clients that don't meet a number of administrator-defined criteria; for example, service packs and hot fixes must be current; antivirus software must be installed and operational, and personal firewall software must be installed and operational. Other vendors that provide similar functionality usually do so through the use of their proprietary VPN client software. This software may be different and cost more than their standard proprietary VPN client. If the standard client supports this functionality, the firewall may come with only a limited number of VPN client licenses and you must purchase extra ones for more VPN users. Some vendors' client configuration enforcement extends only to requiring personal firewall software be installed and does not enforce service pack and hotfix requirements. ISA Server's VPN quarantine feature works with the Windows VPN client software that is built into all modern Windows operating systems, and there is no extra cost for any of this functionality.
Q. Why would I pay for ISA Server when I can use free open source firewall and caching programs such as IPChains and Squid, which run on Linux, an open source operating system?
A. As Robert A. Heinlein, famous science fiction author, once said: TANSTAAFL ('There ain't no such thing as a free lunch'). The price you pay for 'free' software comes in many forms:
Frustration and administrative time spent learning obscure commands, or misconfigurations resulting from a single typo in a text-based configuration file
The cost of third-party books or support contracts when you find that documentation for the open source code is sparse and difficult to understand, and support from the developers is non-existent
The need to implement a commercial product later instead of, or in addition to, the open source 'solution' because the free product does not provide all the features you need, or is so user-unfriendly that you can't figure out how to implement them.
Specifically, IPchains/iptables and FWTK are very rudimentary firewalls that don't include the application layer filtering, VPN gateway, and other features you expect from a commercial product. IPCop is more user-friendly, but is designed for SOHO and home users, not for the enterprise. None of the open source products are designed to integrate into Microsoft networks and provide seamless support for Exchange mail servers, SharePoint collaboration servers, and other Microsoft products as ISA Server does.
