Understanding Internet Security and Acceleration Server (ISA Server)

Internet Security and Acceleration Server (ISA Server) Overview

Microsoft Internet Security and Acceleration Server (ISA Server) is combination of a firewall and Web caching server that can be used to protect the enterprise from external access, while sharing an Internet connection on the network. The multilayer firewall of ISA Server protects valuable network resources of the enterprise from unauthorized external access, attacks from hackers, and malicious viruses. You can also control client access to the Internet. The Web cache server enables faster Web access for users by serving objects locally from the cache instead of over the Internet. This in turn improves Internet performance for clients on the network.

The internal private network is separated from the Internet. There is one physical connection to the Internet and another to the internal network. The networks are also connected to different network cards. Traffic must move through the ISA Server software to move from one connection to the other.

When you install ISA Server in your network, you can configure it as:

The architecture that ISA Server uses to protect the private network from unauthorized access and still enable users to access the Internet are listed here:

ISA Server Firewall Service Overview

The ISA Server firewall technology consists of a number of firewall techniques that secure the network from unauthorized access:

With packet filtering, you can manage the flow of IP packets to ISA Server and from ISA Server. Packet filtering inspects the header of each packet for protocol, port, and destination address and source address information. Packets are dropped if they are not explicitly allowed.

When you configure circuit-level (protocol) filtering, sessions are inspected, and not packets and connections. You can use access policy rules and publishing rules to configure circuit-level (protocol) filtering. ISA Server supports dynamic filtering. With dynamic filtering, ports open automatically only when needed, and closed once communication has occurred. In this manner, the number of ports that remain open are reduced. Circuit-level filtering provides integrated support for protocols with secondary connections. You can configure the primary and secondary connection of the protocol in the user interface. This is done by specifying the following:

Application-level filtering is used to protect against DNS server attacks and unsafe SMTP commands. You can use third-party tools for content screening and virus detection to apply application and Web filters. With application-level filtering, the data stream for an application is analyzed and inspected, and can be blocked, redirected, or modified.

ISA Server provides the following application filters:

ISA Server includes a built-in intrusion-detection mechanism that can protect the network from several common attacks. The built-in intrusion-detection mechanism can be configured to send an alert when an intrusion is detected.

ISA Server implements intrusion-detection at the following levels:

ISA Server can detect attacks at the packet filter level:

You can configure POP and DNS intrusion detection filters to check for the following:

The ISA Server intrusion-detection mechanism also allows you to define what action should be implemented by the system when an attack is detected:

You can use the ISA Server Security Configuration Wizard to apply system security settings to servers. You can choose between the following levels of security:

ISA Server can also operate as the end-point for a Virtual Private Network (VPN). A VPN enables data to be sent between computers over public network. VPNs extend the private network by creating a secure link between two separate networks over the Internet. Virtual Private Networks (VPNs) provide secure and advanced connections through a non-secure network by providing data privacy. Private data is secure in a public environment.

Many companies supply their own VPN connections via the Internet. Through their ISPs, remote users running VPN client software are assured private access in a publicly shared environment. By using analog, ISDN, DSL, cable technology, dial and mobile IP; VPNs are implemented over extensive shared infrastructures. Email, database and office applications use these secure remote VPN connections. You can configure ISA Server as a VPN server. You can configure ISA Server to allow VPN traffic from external VPN clients to pass over the firewall to a VPN server on the internal network. You can also configure ISA Server to allow VPN traffic from internal VPN clients to pass to a VPN server on the external network.

A VPN gateway, also called a VPN router, is a connection point that connects two LANs which are connected by a nonsecure network such as the Internet. A VPN gateway connects to either a single VPN gateway, or to multiple VPN gateways to extend the LAN. Tunneling is the terminology utilized to describe a method of using an internetwork infrastructure to transfer a payload. Tunneling is also known as the encapsulation and transmission of VPN data, or packets. The VPN tunnel is the logical path or connection that encapsulated packets travel through the transit internetwork. The tunneling protocol encrypts the original frame so that its content cannot be interpreted. The encapsulation of VPN data traffic is known as tunneling.

A few enterprise firewall security features and benefits of ISA Server are summarized here

ISA Server Web Caching Overview

ISA Server includes the Web Proxy service that can be used to cache frequently requested Web objects. Subsequent client requests are checked against the cache to see if they can be serviced from the cache. A new request is initiated if the ISA Server cache cannot be utilized to serve the client request. ISA Server stores most frequently accessed items in RAM. The items are then retrieved from memory instead of from disk.

Objects remain in the ISA Server cache until either of the following events occurs:

ISA Web Server caching can be implemented using either of these methods:

When you configure ISA server as a forward Web caching server, internal clients are able to access the Internet, and ISA Server maintains a cache of frequently requested Internet objects which can be accessed by any Web browser behind the firewall. Client browser performance is improved because using the cache results in less processing than requesting objects from the Internet. Bandwidth usage on Internet connections remains low. User response time is decreased as well.

How forward caching works

  1. A user requests a Web object.
  2. The request is forwarded to the ISA Server computer on the network.
  3. ISA Server checks whether the object exists in the cache.
  4. If the requested Web object does not exist in the cache, the request is forwarded to a server on the Internet.
  5. The server on the Internet returns the requested object to the ISA Server.
  6. The ISA Server places the Web object in its cache.
  7. The ISA Server forwards the object to the user that requested it.
  8. When another user requests the same object, the request is forwarded to the ISA Server computer, and the ISA Server computer returns the object to the user from its cache.

With reverse caching, objects requested from internal servers by external clients are stored on the ISA Server. Incoming Web requests are forwarded to the ISA Server and are serviced from the cache. Requests are only forwarded to the Web server when the cache cannot be used to serve the request.

How reverse caching works

  1. A request is sent to the ISA Server.
  2. ISA Server checks whether the object exists in the cache.
  3. If the requested object does not exist in the cache, the request is sent to the Web server.
  4. The home page is returned to the ISA Server.
  5. The ISA Server places the object in its cache.
    1. The home page is forwarded to the person that requested it.
    2. Another request is sent for the same Web page.
    3. ISA Server checks whether the object exists in the cache, and returns it from its cache. The request is not sent to the Web server.

You can use the ISA Server Scheduled Content Download feature to download the content to the ISA Server cache as per a predefined schedule. You can proactively ensure that important content is always available directly from the ISA Server cache and that the information is current.

You can directly download the following to the ISA Server cache:

You can also limit which content should be downloaded. You can define scheduled content downloading for outgoing Web requests and for incoming Web requests.

The ISA Server Enterprise Edition uses Cache Array Routing Protocol (CARP) to provide scaling and improve efficiency. When you install multiple ISA Server computers, ISA Servers are automatically installed in arrays. The array of ISA Servers is then treated as a single logical cache. A hashing algorithm determines the location for storage, and hash-based routing is used to retrieve the location of the stored object when requests are made.

The advantages of using CARP include:

The routing algorithm used by CARP works as follows:

The ISA Server Enterprise Edition enables administrators to arrange individual ISA Server computers or arrays of ISA Servers hierarchically. This process is also referred to as chaining. Requests are then sent upstream through the chain of servers until the object which was requested is located. Chaining provides fault tolerance. Content can be distributed to multiple locations without making requests on the Internet.

The Different ISA Server Editions and ISA Server Roles

The different ISA Server editions are:

The following features are the same for both ISA Server editions:

The features available with the ISA Server Standard Edition is listed here:

The features available in the ISA Server Enterprise Edition are listed here:

For each ISA Server edition, you can install ISA Server in either of these installation modes:

The different server roles that you can configure for ISA Server are:

Understanding ISA Server and Windows Integration

The Windows technologies that can be used with ISA Server to provide enhanced security, better performance, and management capabilities are listed here:

The Management Features of ISA Server

The management interface for ISA Server is ISA Management, which is a MMC snap-in. You can integrate third-party products into the ISA Server management console. ISA Management provides graphical taskpads and also a number of ISA Server wizards that can be used to manage your ISA Server environment.

The administrative tasks which you can perform through the ISA Server wizards are listed here:

You can use the same management interface for the ISA Server firewall and Web caching. Both the firewall and Web caching share the following:

You can also use the same access control policies to manage the ISA Server firewall and Web cache server. You can though configure logging separately for

The predefined reports that you can configure ISA Server to generate are listed here

You can configure a policy for an ISA Server array or an ISA Server Enterprise. The different policy-based rules that you can configure are:

ISA Server rules are affected by policy elements. Policy elements pertain to a part or component of a policy. They are not created explicitly for each rule. Policy elements are predefined, and can be reused and customized.

The policy elements that you can define in ISA Management are listed here



Top 5 Free Networking Tools

Bookmark Understanding Internet Security and Acceleration Server (ISA Server)

Latest Blog Posts


English English GermanGerman SpanishSpanish FrenchFrench ItalianItalian PortuguesePortuguese RussianRussian DutchDutch
GreekGreek HindiHindi JapaneseJapanese KoreanKorean ChineseChinese Chinese (Simplified)Chinese (Simplified) ArabicArabic

Copyright 2009 Tech-FAQ. All rights reserved. Privacy Policy.