ISA server

[kirkles0206]

Is ISA server a good product for a LAN environment? As opposed to Zonelabs or Tiny or any other firewall software.

I am currently running W2K adv server behind a linksys router and would like to know if installing and running ISA server is a good idea.


Thanks

 

[SaigonK]

To be honest ISA is expensive and a pain in the ass since it wont do half of what i would like it to do.
Get a better hardware firewall rather than a software one.

 

[Goosemaster]

Originally posted by: SaigonK
To be honest ISA is expensive and a pain in the ass since it wont do half of what i would like it to do.
Get a better hardware firewall rather than a software one.

For cheap just find any router with a SPI(Stateful Packet Inspection) firewall built-in.



Very cheap and the SPI will allow you to setu specific rules for content going in an out of yof your network....lets just say it does more than just blcok ports.

 

[Dowfen]

If you can get ISA Server working correctly it can be great. Since it's Microsoft software it isn't perfect. But, everything and anything I've ever wanted to do with a firewall you can do with it. The mere fact that configuration is a bear is reason enough to go with something easier/cheaper, however.

 

[SaigonK]

Good point Dowfen. Also if you need to do something really specific like I did, Microsoft wont help you.
They will offer you a fee based service.

 

[Saltin]

ISA is expensive. If your replacing a Linksys router with it, my guess is you're using it at home?

If so, it's too much (unless you want to learn it).

ISA is an excellent firewall/proxy that allows you to do *all sorts of things* in regard to access policy, server publishing, etc.

Anyone who says it's crap or that it's limited doesnt understand it. It's one of MS's best products. Find a Firewall that has significantly more features than ISA server. There isnt one.

 

[Dowfen]

Originally posted by: SaigonK
Good point Dowfen. Also if you need to do something really specific like I did, Microsoft wont help you.
They will offer you a fee based service.

Yes, this is entirely correct. We've gone through many $250 support charges. There is isaserver.org, which can be helpful.

 

[err]

ISA server is an excellent web proxy server and firewall server. Configuring ISA server could be tricky but if everything is setup right, it is an excellent piece of software.

We have ISA server in production and all of our users are going through ISA to get out to the Internet. You can also do a policy based filtering, create custom reports and everything.

ISA can't really be compared to zonelabs. It is a totally different product and different animal in different class.

Try it on if you'd like. Play with it. ISA works well with Win2k server products.

eRr

 

[chsh1ca]

Originally posted by: Saltin
ISA is an excellent firewall/proxy that allows you to do *all sorts of things* in regard to access policy, server publishing, etc.

Anyone who says it's crap or that it's limited doesnt understand it. It's one of MS's best products. Find a Firewall that has significantly more features than ISA server. There isnt one.

Either that or they believe that a firewall shouldn't have beyond what is necessary for packet filtering, and that all-in-one solutions are rarely best.

Anyway, I gave it a go, and I never really saw anything it offered that I needed and couldn't do for 10 minutes extra work elsewhere

 

[Nothinman]

Personally I'd probably just use squid, unless you need something Windows specific like NTML authentication.

 

[Saltin]

Either that or they believe that a firewall shouldn't have beyond what is necessary for packet filtering, and that all-in-one solutions are rarely best.

Blah blah.

Look around. It's one of the most feature rich Firewalls available, and it doesnt sacrifice security for the sake of features ( a nice change on MS's part).

It's got all the security committe rubber stamps and gold stars that any hardware firewall has.
Hell, I've even heard Nix guys say good things about it.

Of course, setting it up in your computer room at home isnt going to give you proper exposure. You need a large AD/network to reall leverage it.