quote:

---

Originally posted by George Ou:
It's quite normal that perception lags behind reality. A lot of people simply don't ever do the research and don't know what they're talking about whenever they start talking about "hardware" devices. I personally like to keep my options open and I've worked with just about every Enterprise firewall platform there is from CheckPoint to PIX to Firewall IOS to NetScreen. I think that gives me an objective look on all of the platforms. I think a bigger factor in justifying existing platforms is not just the money that they spent, but the time that they spent getting their certifications for their specific platform.

I think that ISA 2004 is the first ISA version that can be used in an Enterprise configuration as a stand alone firewall. As you have said, ISA 2000 was a good product but was a little lacking in some features that would keep me from using it in a standalone configuration.

---

Hi George,

That's why I really appreciate your observations on the ISA v. "hardware" firewall debate. You've got tons of experience with just about every platform and you know the pros and cons first hand. I'm sure when you get keep into your ISA setups, you'll really appreciate the flexility of access control it brings to the table.

BTW -- if you're interested in writing for ISAserver.org, let me know. I'll get you set up as a site author and take care of the formatting stuff for you. We don't pay as much as TechRepublic, but you don't have to wait very long before your stuff goes up on the site.

Thanks!
Tom

(in reply to tshinder)

quote:

---

Originally posted by George Ou:
Hi Tom,

One configuration that I am using now is a Load Balancer behind a PIX. The Load Balancer serves as a reverse proxy when it's doing load balancing and failover duties. Although it's not meant or marketed as an Application Firewall and probably doesn't have anywhere near the application filtering capabilities of an ISA 2004, it is at least doing reverse proxy. Another benefit of doing this type of a configuration is that the load balancer is also leveraged as an HSM for all of the servers behind it. This means if you're using a FIPS 140 Level 3 crypto card in your 2 redundant load balancers, it beats the hell out of trying to shove a $7000 HSM in to each of your 100 servers. All of your sites will being proxied and load balanced will become Level 3 by proxy.

Now obviously, you can leverage the same HSMs in your ISA 2004 boxes, but I don't think it has load distribution capabilities like an F5 box(correct me if I'm wrong). If such a thing was possible with ISA 2004 and there is no reason it can't be built with F5 BigIP capabilities, then that would truly be an awesome device. Right now, I'd have to put the ISA2004 box in front of the F5 box.

---

quote:

---

BTW -- if you're interested in writing for ISAserver.org, let me know. I'll get you set up as a site author and take care of the formatting stuff for you. We don't pay as much as TechRepublic, but you don't have to wait very long before your stuff goes up on the site.

---

Hey Tom,

Sure thing, I'd love to write for ISAServer.org.

Actually, I have an idea for an article already, more along the lines of building optimum hardware for an ISA 2004 1U box for a little over $1000.



The system would include dual Intel Gigabit capability so that you can 802.1q trunk the internal LAN interface for maximum throughput. The 3.2 GHz CPU on an 800 MHz FSB would deliver optimum price/performance ratio. Dual hotswap SATA hard drives would give you storage piece of mind.

I think this would be something different, but I think a lot of readers would be interested in building something like that. Actually, you wouldn't really need to build that much since the whole thing comes in a kit anyways. You just need to insert Disks, RAM and CPU.

Of course, I could include some performance benchmarks to demonstrate just how it stacks up against some of the "hardware" based solutions out there. Most people have a hard time believing me when I tell them that such a box would outperform a $30,000 VPN concentrator. This should put all doubts aside.

(in reply to tshinder)

quote:

---

Originally posted by George Ou:

quote:

---

BTW -- if you're interested in writing for ISAserver.org, let me know. I'll get you set up as a site author and take care of the formatting stuff for you. We don't pay as much as TechRepublic, but you don't have to wait very long before your stuff goes up on the site.

---

Hey Tom,

Sure thing, I'd love to write for ISAServer.org.

Actually, I have an idea for an article already, more along the lines of building optimum hardware for an ISA 2004 1U box for a little over $1000.



The system would include dual Intel Gigabit capability so that you can 802.1q trunk the internal LAN interface for maximum throughput. The 3.2 GHz CPU on an 800 MHz FSB would deliver optimum price/performance ratio. Dual hotswap SATA hard drives would give you storage piece of mind.

I think this would be something different, but I think a lot of readers would be interested in building something like that. Actually, you wouldn't really need to build that much since the whole thing comes in a kit anyways. You just need to insert Disks, RAM and CPU.

Of course, I could include some performance benchmarks to demonstrate just how it stacks up against some of the "hardware" based solutions out there. Most people have a hard time believing me when I tell them that such a box would outperform a $30,000 VPN concentrator. This should put all doubts aside.

---

quote:

---

Originally posted by <FSimon>:
I was most interested in your article. However at my org we are repalcing an ISA server firewall arrangment I designed with a hardware firewall because the new boss says we need a proper secure certified firewall.

All the technical arguments in the world cant get passed that one, or can they?

---

quote:

---

Originally posted by George Ou:

quote:

---

Originally posted by <FSimon>:
I was most interested in your article. However at my org we are repalcing an ISA server firewall arrangment I designed with a hardware firewall because the new boss says we need a proper secure certified firewall.

All the technical arguments in the world cant get passed that one, or can they?

---

The question is "certified by who"? Certified based on some obscure organization's standard that some salesman has shown you on a PowerPoint slide? The fact of the matter is, ISA server has some certifications of it's own. I probably would never use ISA 2000 as a standalone firewall but I would probably feel very comfortable in using an ISA2004 box in standalone configuration depending on the organization's needs.

As far as security is concerned, you're probably better off using an Application Layer firewall such as ISA2004. A hardware firewall such as a Cisco PIX definitely has it's benefits but it will not do a reverse proxy to your web servers. Opening a raw TCP 80 session to your Web Server will not be as secure as doing a reverse proxy to that server.

Using both a hardware box in front of an ISA2004 box is probably ideal in terms of performance and flexibility. That hardware stateful filter box in front of your ISA2004 box does not have to be a PIX, it can be your edge router running Cisco Firewall IOS with integrated IDS. This combo configuration can be cheaper and more effective than a mid-range PIX.

---

Hi George,

Ha! You bet! Maybe I should put together a "hardware firewall cert" program. I'd require that it perform static packet filtering so that all filters must be explicitly created. That should be plenty secure

Right on regarding stateful application layer filtering. To quote the grand-daddy of Internet firewalls, Marcus Ranum:

"With the increasing focus on application layer attacks, the day
of packet-filters even being termed "firewalls" is pretty much over.
Packet filters were barely firewalls to begin with, but today, the
fight's mostly up in Layer 7 where they have no value.

Of course "we told you so" applies.

mjr. "

Thanks!
Tom

(in reply to tshinder)