quote:

---

Originally posted by tshinder:
When users come into the network and don't have the Firewall client installed, they won't be able to authenticate and their connections are blocked.

---

quote:

---

Originally posted by tshinder:
Hi Dan,

Not true! You're just using the Web Proxy if you're getting prompted for auth. The Web Proxy is just a very very small piece of the ISA firewall. You want to authenticated *all* TCP and UDP protocols, not just HTTP/HTTPS/tunneled FTP.

The Web Proxy can't do that. The Firewall client significantly increases not only the performance, but also the level of security and accessiblity (because the SecureNAT client can't support secondary connections).

Put the Firewall client to full use, and you'll never go back to the basic Web Proxy/SecureNAT config again.

Also, please REMOVE the checkmark from the "ask unauthenticated users to auth" setting, and then remove your anonymous access rules.

HTH,
Tom

---

quote:

---

Originally posted by Tinto:
Note that we have the best part of our internal PC with Windows XP and we will soon reinstall all of them using a "master image" so it would not be hard work.

---

quote:

---

Originally posted by Tinto:
hi Tom,

I have read your article and I was asking myself "why the external expert who has done first installation of our isa has suggested us not to use firewall client on our PCs?"
Note that we have the best part of our internal PC with Windows XP and we will soon reinstall all of them using a "master image" so it would not be hard work.
Sure we have some of my beloved Mac, Linux, Sun and so on machines that we will continue using without installing FWclient on them
but I was thinking it would be useful using it for the "mass" of windows users.
I really cannot imagine why not.

However, I've installed FWclient on my pc (XP pro) where runs IIS with a simple website where a php script polls some web server on the internet to chek their avaliability. This application (that's simply php-cgi.exe) has stopped working after the FWClient was installed.
What's the problem with that?

Thanks for commenting

---

quote:

---

Originally posted by Dan Ball:

quote:

---

Originally posted by tshinder:
Hi Dan,

Not true! You're just using the Web Proxy if you're getting prompted for auth. The Web Proxy is just a very very small piece of the ISA firewall. You want to authenticated *all* TCP and UDP protocols, not just HTTP/HTTPS/tunneled FTP.

The Web Proxy can't do that. The Firewall client significantly increases not only the performance, but also the level of security and accessiblity (because the SecureNAT client can't support secondary connections).

Put the Firewall client to full use, and you'll never go back to the basic Web Proxy/SecureNAT config again.

Also, please REMOVE the checkmark from the "ask unauthenticated users to auth" setting, and then remove your anonymous access rules.

HTH,
Tom

---

There must be something wrong with our ISA 2000 setup then. It isn't acting at all like it's supposed to according to the articles I've read.

Anyways, I'm not going to touch it for now. I'm going to be rebuilding the server with ISA 2004 in a couple of weeks, and will start over from scratch.

So, based off of your Web Proxy comments, do we really need proxy settings pointing to that serverat all? If the firewall client is installed, it should re-direct every web call through the ISA server anyways, is this correct?

Sorry for so many questions, the ISA 2004 class I was scheduled to take this week was cancelled, and now I'm scrambling to figure all this out by myself over the next couple of weeks...

---

Hi Dan,

No problem with the questions! I wonder how they would offer an ISA 2004 class yet, since there is no MOC available for 2004 at this time.

There is still value in configuring the clients as Web Proxy clients. While the Firewall client connections will be forwarded to the Web Proxy component when the Web Proxy filter is bound to the HTTP protocol (which it is by default), you benefit from using the autoconfiguration script to set sites that you should use Direct Access for. Direct Access is very useful and I've covered it in the book, and since its such a vitally important topic, I'll end up doing a series on the subject on this site.

HTH,
Tom

(in reply to tshinder)

quote:

---

Yes, your 'expert' was completely wrong when recommending that you not install the Firewall client. I suspect that the recommendation came from his lack of understanding of how the Firewall client worked, and the immense security benefits you get from using the firewall client.

---

agree... problably many very experienced people has had not so good experience with old winsock proxy client (is this the correct name?) and prefer not to deal with FWclient if not necessary.

But I'm new with all and reading the article has convinced me that for "normal users" installing the fwc would have advantages. For example I abstract clients from routing problems, I avoid them to query my internal dns server and I can see names when I try to kill sreaming radios connections

quote:

---

HOWEVER, I always tell people to *not* install the firewall client on servers. There are a number of reasons for this, but its a good general policy. So, if you're going to host an IIS site on a workstation, don't use the firewall client on that workstation. But for all standard Windows clients that don't host Web or other services (file sharing is fine, it works with the Firewall client installed), then you should always install the firewall client.

---

it was just an example... my pc is designed for all of my destructive testings

thanks

(in reply to tshinder)