Recently a coworker showed me some very interesting features of Microsoft’s Internet Security and Acceleration Server 2004. ISA works as a firewall and proxy server, but most engineers I know have nothing but scorn for ISA as a firewall solution. There are lots of dedicated hardware firewalls on the market that do a terrific job, and what’s more, they shift the load off the server and onto an external device, which is as it should be.
I suspect there is an unspoken second reason that many techs shy away from ISA, as well: it’s complex, and easy to screw up if you’re not sure what you’re doing. I’ve been to one or two ISA sites where the internet connection was down and there was a lot of head scratching and Googling going on.
So after my initial curiosity about ISA 2004 wore off (noting that it was much better than ISA 2000, but still a software firewall), I pretty much ignored the product until a few weeks ago, when a coworker showed me the other thing ISA is good at: being a proxy server. We had an enterprise customer who was in the middle of a web server migration (from IIS4 to IIS6). The IIS4 server had sat on their network as (a domain member, no less)… as an extranet web server. Yes, their public website was sitting on their production network, limping along dutifully and somehow resisting some very concerted efforts to hack it.
With the new server, the customer was finally going to get serious about security: they would place the machine in a DMZ as a standalone web server and harden it using the Windows 2003 SP1 Security Configuration Wizard. The SCW had a few settings specifically tailored to locking down IIS, so we felt confident the server would be able to survive in the wild, as it were.
However, the customer’s workflow had always consisted of copying their content to certain folders , as well as a lot of automation (such as dumps from their mainframe computers) that routinely updated reports on the website. The traditional methods included FrontPage, FTP, and SMB shares. Also, a couple of the web applications used SQL Server, so how could data owners inside the production network update the SQL data? Replication seemed to be out, because that would open up SQL ports and we weren’t confident of SQL 2000’s ability to resist hacking. How, then, would we make it possible for people to easily update their content, especially on a locked-down server? We were toying with ideas ranging from opening up a read/write FTP site on a non-default port to installing RRAS on the web server.
In the end, we decided to go with ISA 2004, using a reverse-proxy publishing method. Dude, it was sweet. Suddenly, there appeared a solution that gave us exactly what we needed. Not only could the new server remain on the production network where people could update content the way they always had, this new proxy server had a wizard to set it all up for you. The way it works is, no one on the Internet has direct contact with the web server: all requests are made on behalf of the user via ISA. I was a little skeptical at first, but after I saw it working, I was sold.
Which is why I went home and decided to install the premium firewall components on my testbed Small Business Server 2003 machine sitting in my garage.
ISA 2004 did not ship with the original edition of SBS 2003… I guess at the time SBS 2003 shipped, ISA 2004 wasn’t ready yet, so they instead provided ISA 2000 (which I hate, because it is very confusing and unfriendly). However, SBS 2003 R2, which came out recently, updates the premium components to SQL Server 2005 and ISA Server 2004. I also learned that you don’t need to upgrade your SBS 2003 installation to R2 to use the ISA 2004 / SQL 2005 components. SBS 2003 SP1 is sufficient.
My plan was to install ISA and disable whatever firewall components it set up (I have a pretty good external firewall, and wanted to keep using it). I was more interested in using the proxy server functionality of ISA.
However, I realized during the installation that with Small Business Server, the ISA setup expects (rather: demands) that the SBS server have two network cards installed. I didn’t have a spare NIC lying around, but I thought I might be able to dismiss the warnings and reconfigure everything after the installation was done. What happened was the extranet components of SBS (such as OWA, RWW, and mail services) stopped working. No matter how many times I re-ran the Internet and Email Configuration Wizard, the “Firewall Configuration” step broke, and I had a non-working SBS server.
Now, I set this server up just so I could learn it, but I was still a bit distraught that after running so beautifully for all these months, I had broken it.
Here are the symptoms I observed after I installed ISA 2004:
The setup program launched the Configure Email and Internet Connectivity Wizard, which popped up a warning that my server only had one NIC; the CEICW; with one NIC, “The firewall cannot be configured.”
After the setup, all internet access and hosted services (such as OWA, RWW, etc) stopped working.
I suppose I could have gone into ISA and tried to figure out what the setup had done to my server, but I was a little irritated at this point. I had seen the ISA server set up specifically as a proxy server; why wasn’t there an allowance for that in the setup program? I decided to uninstall it.
The uninstallation went normally, but after completion, the extranet components were still broken and the CEICW process still failed on the firewall component. It took a bit of digging, but I found the solution in a newsgroup, posted by a Microsoft employee. It seems that you need to go into the IP Address and Domain Name Restrictions properties for the Default Web Site under IIS:
No matter what the setting for Granted or Denied is, toggle the radio button to its opposite value. Then you need to re-run the CEICW wizard.
But wait, you’re not done! You also need to re-run the Remote Access Wizard to re-enable VPN, because the ISA setup apparently disabled that service.
Lesson learned: The ISA component of SBS is a linear product, and the setup program anticipates a specific environment in which to be installed. It is not very forgiving of deviation. Use caution when implementing it.
