Firewall Protection with ISA Server 2000

A proxy server and a firewall for protecting your network from intrusion

Wednesday, November 01, 2000

The Microsoft Internet Security and Acceleration Server 2000(ISA) is a proxy server and firewall. The Release Candidate 1 for it wasrecently released. It has a host of firewall options, which we’ll talk aboutin this article.

ISA Server is configured using the Microsoft ManagementConsole (MMC). The MMC window is divided into two panes. The right pane displaysthe sub-folders within these folders and properties that can be configured ineach, while the left pane displays the various configurable items and all theservers running ISA Server. Each server is called an array, and holds a set ofits own configuration options. When you click on a particular server, the rightpane shows the configurable parameters. This contains wizards that let youconfigure the server’s security policies.

ISA Server’s firewall can be configured for both internaland external users. Two configuration wizards do this. One configures accesspolicies for internal users, while the other configures firewall protection forexternal users. You can also manually configure everything, which requires anunderstanding of the server’s functioning.

Protection from inside

From the client’s side, ISA Server let’s you preventunauthorized traffic from going to the Internet. This can be done to conservebandwidth, prevent access to certain websites, keep a tab on and preventunwanted downloads, etc. The Configure Access Policy wizard let’s you setthese options. You can also configure the options from the Access Policy folderin the left pane. This folder let’s you define address sets for clients thatare allowed access to the internet. Client address sets can also be set todivide your intranet into smaller virtual networks with individual access rules.You can also define protocols, which can be used later to create protocol rules.These can either be predefined or user-defined.

Created protocol rules are applied to all traffic passingthrough the ISA Server. These rules can be either of Allow or Deny type. Acertain protocol rule may be applied to either a single protocol or a group ofprotocols. On the client front, these rules can be applied to specified users orgroups or client address sets. Protocol rules can also be scheduled. So theadministrator can choose to implement a rule only during office hours.

Site and content rules can be applied to the type of contentbeing accessed by clients. So you may choose to block out images, text, audio,video or any other type of content that you don’t want them to access. As inthe case with protocol rules, these can also be client specific. You may applythem to a particular sub-network that you created in the beginning.

Page(s)   1  2