Hi Abe,
You should check out the Network Engines ISA firewall appliance. They
have completely locked down the box. You can't get to the file system or
anything else that Network Engines hasn't exposed to you, as required
for firewall configuration. Unless you really worked had at it, you'd
never know you were dealing with a Windows-based firewall. That's how
hard they've locked down the interface. Some people love it, because it
looks like a "hardware" firewall, while ISA firewall aficiandos don't
care for it, because you can't make it dance and sing and do some of the
amazing stuff you can do with it if you had full access to the ISA
firewall and OS components. But it does solve the problems you bring up
regarding complexity and potential to break things due to that
complexity.
Tom
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**
-----Original Message-----
From: Abe Getchell [mailto:mailing.list.spooler@gmail.com]
Sent: Wednesday, November 16, 2005 12:22 PM
To: Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]
Cc: focus-ms@securityfocus.com
Subject: Re: ISA Server or Firewall Appliance?
Hi Susan,
You bring up a good point concerning misconfiguration (of course it's
possible to misconfigure an appliance firewall), but with an
appliance
solution there's simply less to misconfigure in the first
place; either
the component simply doesn't exist or the administrator isn't given
(direct) access to screw it up.
However, that being said, having people who understand
firewalls and can
manage them appropriately isn't at question here, that's an HR issue.
What is at question here is which piece of technology, that
the original
posted described, is better suited to be a perimeter firewall. We're
talking pure technology here, as is usually implied when
asking a "which
is better" question on a technology mailing list. We just assume that
regardless of the solution it will be managed competently (though we
shouldn't... we really, really, shouldn't).
Simply going through the basic build/configuration/management process
and comparing the steps/processes involved will give you a
clear picture
as to why appliance solutions (such as Check Point's SPLAT or Cisco's
PIX) are much less complex than a "general purpose" solution (such as
Windows/ISA or Linux/IPTables). I'll spare you (and everyone
else) the
lengthy e-mail (unless you really, really, want it) and let you go
through that exercise on your own, if you choose.
Abe
--
Abe Getchell
abegetchell@gmail.com
http://abegetchell.com/
---------------------------------------------------------------------------
---------------------------------------------------------------------------
