• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

ISA 2000 or 2004 for DMZ

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2004 General ] >> General >> ISA 2000 or 2004 for DMZ Page: [1]
Login
Message << Older Topic   Newer Topic >>
ISA 2000 or 2004 for DMZ - 31.Aug.2004 6:00:00 PM   
Compton

 

Posts: 17
Joined: 4.Jun.2003
Status: offline
Hi,

Im trying to install a DMZ with a web server in between two ISA servers. (one is already up and running as our current firewall)
My previous post:
http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=3;t=004338

I own both of Tom's ISA 2000 books (just ordered the newer one) and was wondering if it would be easier to just install ISA 2004 as my Internet side firewall instead of 2000. I heard its a lot easier to setup a DMZ in 2004.. Any comments? Thanks
Post #: 1
RE: ISA 2000 or 2004 for DMZ - 1.Sep.2004 8:25:00 AM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Compton,

Yes, the new ISA firewall is a lot easier to create a trihomed DMZ segment. I'd definitely go with it if you have the chance.

HTH,
Tom

(in reply to Compton)
Post #: 2
RE: ISA 2000 or 2004 for DMZ - 6.Sep.2004 6:51:00 PM   
Compton

 

Posts: 17
Joined: 4.Jun.2003
Status: offline
Would I have to a trihomed server? Or could I do a back to back DMZ?

(in reply to Compton)
Post #: 3
RE: ISA 2000 or 2004 for DMZ - 7.Sep.2004 2:38:00 AM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Compton,

No problem with trihomed, back to back, or even back to back trihomed ISA firewalls. I've done it all those ways. It all depends on how you want to segment and secure your network. And the really cool thing is you get stateful filtering and stateful application layer inspection for ALL networks!

HTH,
Tom

(in reply to Compton)
Post #: 4
RE: ISA 2000 or 2004 for DMZ - 7.Sep.2004 5:43:00 PM   
Compton

 

Posts: 17
Joined: 4.Jun.2003
Status: offline
Thanks for your reply Tom. In reading your ISA Server and Beyond book, it seems as though the back to back would be a lot easier to configure. My questions are: (Forgive me if these questions are low level)

1. What is the purpose/advantage of having a trihomed ISA server as opposed to the back to back?
2. Do you have to use 3 (or 2) separate network cards for these solutions? (As opposed to just adding the IP Addresses to 1 NIC). I am thinking yes due to all of the other settings, but want to make sure.
3. Is there an advantage to using a public IP Address DMZ vs. a Private Address range?
4.. Is there a write up anywhere as to the ideal physical connectivity of this solution? (eg. Should the DMZ be isolated on its own Switch)
5. I know you said 2004 is easier to implement a tri home solution, but is 2004 easier to implement a back to back solution? or should I stick with 2000? I haven't purchased either yet for the 2nd firewall. Thanks

Proposed Connectivity:
Internet-->ISA-->DMZ WEB SERVER-->ISA-->Citrix Server

Thanks a lot for any help.
Compton

[ September 07, 2004, 05:51 PM: Message edited by: Compton ]

(in reply to Compton)
Post #: 5
RE: ISA 2000 or 2004 for DMZ - 8.Sep.2004 3:00:00 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Compton,

Thanks for getting the book! [Big Grin]

I think the back to back config is always more secure, and it most cases easier. So, if you have to the option to configure a back to back config, I'd go with that.

Thanks!
Tom

(in reply to Compton)
Post #: 6

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2004 General ] >> General >> ISA 2000 or 2004 for DMZ Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts