لطفا منتظر باشید ...
Solutions Fast Track
Our Approach to the ISA Firewall Network Design and Defense Tactics
Traditional Firewalls are simple stateful filtering devices, sometimes referred to as 'stateful packet inspection.' All modern firewalls perform stateful filtering.
Attacks on networks now take place at the application layer and only stateful application-layer inspection firewalls like the ISA firewall can meet the challenge of protecting against these modern 'Layer 7' attacks.
Simple stateful packet-filtering firewalls should be placed on the Internet edge of the network if the effective Internet bandwidth exceeds the rate at which the stateful application-layer filtering ISA firewall can effectively process traffic (about 400Mbps). If the Internet 'pipe' exceeds the ISA firewall's bandwidth limits, place stateful packet-filtering firewalls in front of the ISA stateful application-layer inspection firewall to offload some processing.
There are multiple security perimeters on any network. Stateful filtering and stateful application-layer inspection should ideally be done at each perimeter.
The Windows operating system can be hardened to the extent that it is no more or less penetrable than any other firewall, including hardware firewalls.
Because ISA firewalls provide a significantly higher level of protection than stateful filtering 'hardware' firewalls, the ISA firewalls should be placed closest to the core network assets.
Tom and Deb Shinder's Configuring ISA 2004 Network Layout
The sample network layout in this chapter provides the information you need to replicate the network topology we use in the discussions and exercises through out book.
We used VMware Workstation 4.51 as our test bed environment. Each network ID was placed on a separate VMNet virtual switch, which allowed us to segregate the Ethernet broadcast domain for each network in the same way a network router would do.
Out of the box VMware 4.51 supports only three network adapters per virtual machine. Thanks to Alessandro Perilli for the great tip he provided us on how to install a four NIC on a VMware virtual machine.
How ISA Firewalls Define Networks and Network Relationships
The ISA firewall does not use the old LAT-based concept where 'internal' networks were trusted and external networks are untrusted. The new ISA firewall performs stateful filtering and stateful application-layer inspection on all interfaces, including its VPN interfaces.
The term 'multinetworking' refers to the ISA firewall's approach to networks. Networks are defined based on the location behind a particular NIC installed on the ISA firewall, and route relationships are defined between those networks
Communications between any two hosts on a Network should never be looped back through the ISA firewall. Hosts located on the same network should always communicate directly with one another.
The ISA firewall contains five default networks: Local Host, Internal, External, VPN Clients, and Quarantined VPN Clients.
The Local Host Network includes addresses bound to the ISA firewall.
The Internal Network includes all addresses located behind the NIC you designate as the default Internal network during installation of the ISA firewall software.
The default External Network includes all addresses that are not defined as part of a Network on the ISA firewall.
The VPN Clients Network includes all addresses in use by VPN clients and gateways at any point in time.
The Quarantined VPN Clients Network includes all addresses of VPN clients and gateways that are currently in quarantine.
You can create your own Internal, Perimeter, VPN site-to-site, and External Networks.
All communications between Networks must have a Network Rule that defines the route relationship between the source and destination Network. You can have either a Route or a NAT relationship between any two Networks.
A Route relationship is bidirectional, and the source IP address of the communicating hosts is always preserved.
A NAT relationship is unidirectional, and the source IP address of a host behind the NATed Network is always replaced by the primary IP address on the interface that the connections leave on the NATed host Network.
The ISA firewall supports nine Network Object types: Networks, Network Sets, Computers, Address Ranges, Subnets, Computer Sets, URL Sets, Domain Name Sets, and Web Listeners. Each of these Network Objects can be used to control the source and destination of any communication moving through the ISA firewall.
The ISA firewall includes five Network Templates out of the box: Edge Firewall, Front Firewall, Back Firewall, Trihomed DMZ (3-Leg Firewall), and Unihomed Web Caching-only Firewall (Singe NIC Template).
The Unihomed Web Caching-only Firewall Template is unusual because all addresses are included as part of its default Internal Network. This means there are no external addresses, and all source and destination addresses in Access Rules must be from Internal to Internal.
The ISA firewall supports dial-up connections to the Internet. Automatic dialing may not work properly for dial-up VPN connections used to establish the Internet link.
The ISA firewall supports dynamic address assignment on its external interface. However, you must configure the ISA firewall's System Policy to support dynamic address assignment.
The 'network within a Network' scenario is one where there are multiple network IDs located behind the same ISA firewall network interface card. All addresses located behind a particular ISA firewall NIC are part of the same Network, and the ISA firewall must be configured with routing table entries that indicate the correct gateway for each network ID located behind that interface.
Web Proxy Chaining as a Form of Network Routing
Web Proxy chaining allows you to connect ISA firewall Web Proxy servers to one another to route requests to the Internet.
Upstream Web Proxy servers are closer to the Internet link, and downstream Web Proxy servers are further away from the Internet link.
Web Proxy Chaining is sometime referred to as 'Web Routing' because you can configure Web Proxy Chaining of some requests and not others.
Web Proxy Chaining saves bandwidth on both the Internet link and any links between the upstream and downstream Web proxies in the Web Proxy chain.
Firewall Chaining as a Form of Network Routing
Firewall Chaining allows you to connect ISA firewalls in a manner that allows the downstream ISA firewall to be a Web Proxy client of the upstream. Unfortunately, it does not appear to work at this time.
Configuring the ISA Firewall as a DHCP Server
The ISA firewall can be configured as a DHCP server for the corporate network.
The DHCP server on the ISA firewall can provide DHCP options to DHCP clients on the corporate network.
The DHCP server on the ISA firewall can supply IP addresses to VPN clients and gateways, but it cannot supply DHCP options to the VPN clients and gateways. However, if you place a DHCP server on the corporate network, and configure a DHCP Relay Agent on the ISA firewall, then you can assign DHCP options to VPN clients.
