Welcome to ISAserver.org

workgroup versus domain member

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA 2006 Firewall] >> Network Infrastructure >> workgroup versus domain member

Page: [1]

Message

<< Older Topic Newer Topic >>

workgroup versus domain member - 2.Nov.2006 10:33:24 PM

paul_psmith

Posts: 53
Joined: 2.Nov.2006
Status: offline

Not sure if this was the right forum for this question.

I found one article on the site about the pros and cons of workgroup versus domain members. We are about to set up our ISA infrastructure for an Exchange 2003 upgrade and we had planned to use a workgroup for the ISA and SCC servers, but I would like to get more info on what was in the article and possibly any others experience setting up in a workgroup.

Thanks

Post #: 1

Featured Links*

RE: workgroup versus domain member - 3.Nov.2006 4:24:11 AM

elmajdal

Posts: 5061
Joined: 16.Sep.2004
From: Lebanese in Kuwait
Status: offline

i think you mean this article : http://www.isaserver.org/tutorials/Debunking-Myth-that-ISA-Firewall-Should-Not-Domain-Member.html

u can discuss it here : http://forums.isaserver.org/Discussion_about_article_on_making_the_ISA_firewall_a_domain_member/m_2002019810/tm.htm

_____________________________

Tarek Majdalani

MS Forefront Edge Security MVP
Website : http://www.elmajdal.net/ISAServer
New Section : http://www.elmajdal.net/Win2k8

(in reply to paul_psmith)

Post #: 2

RE: workgroup versus domain member - 3.Nov.2006 12:18:53 PM

paul_psmith

Posts: 53
Joined: 2.Nov.2006
Status: offline

Thanks for the links, but in truth, I don't see a lot of detail that tells me exactly why I should put my ISA servers in a domain. Since 2006 now supports LDAP authentication (will it also allow authentication against another LDAP directory other than AD?), it seems that that was a big reason to keep the boxes in the domain, but I am not convinced yet.

I'm not trying to be a bother or elitist. I am a big Windows fan. I like the direction it is going and the inegration is great. I am just asking because if I decide to go down the add to the domain path, then I need some ammunition to convince others in the security group who are not as Windows savvy.

Thanks

(in reply to elmajdal)

Post #: 3

RE: workgroup versus domain member - 3.Nov.2006 1:11:30 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Paul,

did you thoroughly read Tom's article Debunking the Myth that the ISA Firewall Should Not be a Domain Member? If so, you should already know that:

only an Active Directory LDAP server is supported.
LDAP authentication only works for Web Publishing Rules, and not for outbound access control via ISA firewall Access Rules.
the Firewall client is only supported when the ISA server is a domain member.
...

Aren't that enough reasons?

HTH,
Stefaan

(in reply to paul_psmith)

Post #: 4

RE: workgroup versus domain member - 6.Nov.2006 2:17:51 PM

paul_psmith

Posts: 53
Joined: 2.Nov.2006
Status: offline

Thanks for the links Stefaan.

I saw the article about LDAP support after I posted, so I am good on that one.

As far as the other two go, we will just be using the ISA server as an Exchange 2003 application firewall for inbound connections (OWA, POP3, RPC/HTTPs, etc.), so we don't need to worry about other outbound stuff which is being handled by our BlueCoats. Do I need to worry about POP3 and RPC/HTTPs in a workgroup or do I need domain membership for that?

We don't have any plans for installing the ISA client, unless it can do something big for us that we can't do wiht the BlueCoats. The BlueCoats are the product of choice by our Security Manager, so I don;t think they will be going away soon.

Thanks
Paul

(in reply to spouseele)

Post #: 5

RE: workgroup versus domain member - 6.Nov.2006 3:37:33 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Paul,

in that case I think it should work equally well with LDAP only.

Note that for POP3 you'll need a server publishing rule and that type of publishing doesn't support authentication at the ISA level. For RPC/HTTPS you'll need a web publishing rule with basic authentication, very similar as with OWA. In fact it can be the same web publishing rule.

HTH,
Stefaan

(in reply to paul_psmith)

Post #: 6