.

Good, bad, ugly of Microsoft ISA server

<<

hayabusa

User avatar

Hero Member
Hero Member

Posts: 1662

Joined: Mon Jan 29, 2007 2:59 pm

Post Mon Jul 06, 2009 12:38 pm

Good, bad, ugly of Microsoft ISA server

Hello everyone.

I've always had mixed feelings about Microsoft ISA server.  On one hand, it simplifies MS security mgmt by tying many necessary security items into one management realm.  On the other hand, IMHO, it's not as thorough as some of the standalone solutions out there, which I've implemented.

I was talking to a solutions consultant earlier this morning, who said he's working on a squid proxy solution for a customer, and that they are a normally a heavily-biased, pro-MS shop.  They're open to his solution, however, their security folks are strongly pushing to be fully ISA-only, thereby making his proposal a tough sell.

He asked me if I have any docs or info from anyone on the 'negative' side of ISA.  Does anyone have any feedback to that regard?  Again, I personally could go either way, dependent upon the scenario, even though I prefer individualized offerings.

Thanks in advance for any information you might have.

Tim (Hayabusa0194)
~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
<<

former33t

Full Member
Full Member

Posts: 226

Joined: Sat Feb 14, 2009 12:33 am

Post Mon Jul 06, 2009 6:48 pm

Re: Good, bad, ugly of Microsoft ISA server

ISA == expensive.

However, when properly configured it is a tough nut to crack on the network.  Not trying to shatter your friend's idea, but If I had the money and all other things being equal, I'd go with ISA over squid. 

That being said, if I had to do it personally (since I have Linux expertise but no money) I'd use squid.  I can really lock down the machine much better than I can with an MS machine (just my $.02).  If I'm selling this to a company, I have to know that they have the required Linux and open source background to deal with updates, configuration management, and the like.  If they don't have that experience already on tap, you won't save them any money.  You'll cost them money over the long run in support costs.
Certifications: CREA, MCSE: Security, CCNA, Security+, other junk
<<

hayabusa

User avatar

Hero Member
Hero Member

Posts: 1662

Joined: Mon Jan 29, 2007 2:59 pm

Post Mon Jul 06, 2009 10:09 pm

Re: Good, bad, ugly of Microsoft ISA server

That's kind of what I'd mentioned to him, previously, too.  I know when ISA first hit the scene, it was kind of shaky in my experimentation with it, but it's really grown and been pretty solid.  Like I said, I prefer to have my individual solutions, but that's me, and I go either way, dependent on the needs and training of the customer, as you duly noted.

I appreciate the feedback, and will pass along to him.

Anyone else?

Thanks.

Tim (Hayabusa0194)
~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
<<

hades_a

User avatar

Newbie
Newbie

Posts: 22

Joined: Wed Jun 14, 2006 10:38 am

Post Tue Jul 07, 2009 3:52 am

Re: Good, bad, ugly of Microsoft ISA server

I personally have a love / hate relationship with ISA.

I am particularly not fond of web-publishing rules but once they are up they are up.

I agree that it is expensive but post ISA 2006 SP1 MS now supports it on a virtual platform. I have recently successfully deployed a L2TP IPSec VPN between two ISA VM's running on Hyper-V... yes you guessed it they are are VERY big MS Shop. :)

Hope this helps your contact and I hope I have not posted too late.

Regards

Chris

PS. Here is a pretty good whitepaper on the Virtualisation of ISA and how to secure the host environment it is running on: http://technet.microsoft.com/en-us/libr ... 91502.aspx
MCSE 2003:Security, Security+, MCITP:EA
<<

dalepearson

Sr. Member
Sr. Member

Posts: 357

Joined: Thu Nov 09, 2006 10:03 am

Post Tue Jul 07, 2009 9:47 am

Re: Good, bad, ugly of Microsoft ISA server

I havent really got anything to add, personally my opinion would be as long as it can be proven to meet the customers requirements, has the management requirements needed and the robustness, and most importantly to the customer meets both the financial infrastructure requirements it should be considered on its own merits.

Anyway I was just wondering if anyone has ever been pressured to move away from a software solution like ISA, and guided down a hardware solution route. That is certainly the impression I get from alot of customers who are not familiar with ISA and alike.
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Tue Jul 07, 2009 9:59 am

Re: Good, bad, ugly of Microsoft ISA server

Besides the price and the Windows platform, I don't have much negative to say about ISA Server.  I've been involved with it since the original version, and even it's predecessor (which really sucked).  The proxy itself gets very granular and is very easy to maintain in my opinion.  If you are a Microsoft shop, I would say that it makes more sense than Squid especially with AD integration.   
~~~~~~~~~~~~~~
Ketchup
<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Tue Jul 07, 2009 11:25 am

Re: Good, bad, ugly of Microsoft ISA server

About the only additional thing I would consider is the size of the organization. Even MS themselves say that if it placed on an edge with a huge amount of bandwidth, it just can't keep up. So use a hardware firewall. Many large organizations heavily invested in MS use Cisco on the outside and ISA on the inside. But if the company is small enough and the server hardware used for the box has enough horsepower to handle the load, then let them use ISA. Especially if their comfort zone is in MS tech and as Ketchup mentions, the AD integration really makes more sense.

Hope that helps,
Don
CISSP, MCSE, CSTA, Security+ SME
<<

hayabusa

User avatar

Hero Member
Hero Member

Posts: 1662

Joined: Mon Jan 29, 2007 2:59 pm

Post Tue Jul 07, 2009 9:47 pm

Re: Good, bad, ugly of Microsoft ISA server

Thanks for all of the input, gents.  Well put and thought out, and I can lend this to him.  Generally speaking, I'd agree with going what's best with customer knowledge, etc, but I'd promised him I'd dig around, to see if there were alternate responses and experiences with it.  Like I said, in the early versions, I definitely would have gone away from ISA, but with the more recent ones, I'd told him pretty much the same as you have all said, that it's become pretty solid.

Don, thanks for the mention of scalability for larger shops too.  That MIGHT be where he's got some beef with them, as this is for an EXTREMELY large organization, and that was a point I hadn't discussed with him, previously.

Many thanks all, and I'll pass this along.

Tim (Hayabusa0194)
~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
<<

Data_Raid

User avatar

Full Member
Full Member

Posts: 165

Joined: Fri Nov 09, 2007 5:55 am

Post Wed Jul 08, 2009 6:55 am

Re: Good, bad, ugly of Microsoft ISA server

I don't have any experience with ISA but thought I'd mention that one reason why a customer installed an ISA server instead of other similar products from different vendors is because they have strict criteria regarding security and ISA has EAL4 accreditation: http://www.microsoft.com/forefront/edge ... teria.aspx
Even though other vendor products were tested and proven to be faster and more scalable than ISA the only reason why ISA was chosen was because EAL4.
All men by nature desire knowledge.

Aristotle

Return to Web Applications

Who is online

Users browsing this forum: No registered users and 1 guest

cron
.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software