Version of ISA Server?

[eodMember]

#149852

We are looking to roll out a ISA server to publish our Exchange 2003 services. At some point in the future we will end up some Exchange 2010.

Would we be painting ourselves into a corner by rolling out ISA 2006? Would the newer renamed ISA (Forefront Gateway or something). Be harder to configure with Exchange 2003?

Thanks guys

[DumberMember]

#201240

Re: Version of ISA Server?

Which services do you want to publish?
TMG (Thread Management Gateway) can do the job.

[cruachanParticipant]

#329771

Re: Version of ISA Server?

Given that ISA 2006 is 4 years old and 32-bit only I would strongly recommend Forefront TMG. We had it publishing Exchange 2003 prior to migrating and there were no issues. The publishing features in TMG are very similar to ISA 2006.

[eodMember]

#295962

Re: Version of ISA Server?

Trouble with TMG is that it’d require 64 bit hardware and for this we are only publishing Exchange services for ActiveSync in a fairly small organization. (OS License, TMG license also).

With ISA 2006 we could use a spare bare metal server with an existing in house 2k3 license we have.

[tehcamelModerator]

#356119

Re: Version of ISA Server?

well, why don’t you check the hardware.
You may have a 64 bit compliant server, thus enabling you to run Win2003 x64, and Forefront:TMG…

[DumberMember]

#201241

Re: Version of ISA Server?

pssst, TMG runs on Windows 2008… ;)

anyhow ISA 2006 will do the job just fine, but TMG is highly improved.

[cruachanParticipant]

#329773

Re: Version of ISA Server?

ISA 2006 is Exchange 2007 aware in it’s publishing wizards, but not 2010 aware. I doubt that matters, although I haven’t done an Exchange 2010 deployment yet. That’s due very soon, we’re building the TMG Servers next week.

ISA and TMG are both now supported in virtual enviroments by Microsoft if that helps. Whilst I prefer to have the firewall on a seperate bit of hardware myself we’ve done a few virtual deployments where required.

[SembeeMember]

#259398

Re: Version of ISA Server?

Unless you are installing the server on very old hardware (more than 4 years old) it is probably already 64 bit. If you are that concerned, then buy TMG and use downgrade rights to install the older version. Buy it on volume licencing and then ask your reseller to order a media kit.
Then if you migrate to Exchange 2010 you can then switch the version to the later one. I certainly wouldn’t want to buy a 4 year old product now.

Although if you are a small org, why bother with ISA/TMG at all? It isn’t a requirement to publish Exchange services.

Simon.

[gforceindustriesMember]

#344376

Re: Version of ISA Server?

Sembee;210057 wrote:

Although if you are a small org, why bother with ISA/TMG at all? It isn’t a requirement to publish Exchange services.

Agreed. Since you have a “spare” server, and as burget is clearly an issue, why not look at Squid, FreeProxy, Untangle, or any of the other free and almost free offerings out there.

[eodMember]

#295966

Re: Version of ISA Server?

Well I have no intention of exposing a member server to the Internet.

Can squid correctly publish exchange services?

[SembeeMember]

#259406

Re: Version of ISA Server?

I can’t answer the question on Squid, but if you lock down to port 443 and 25 to a dedicated Exchange server, then you are perfectly safe. The combination if IIS and Exchange has not been compromised. All compromises of IIS have not been the server itself, but something on top of it, usually a poorly written application or an SQL injection attack.

Obviously some sites simply don’t allow it on policy basis alone, but from a pure security basis, it is an acceptable configuration.

And it doesn’t really matter what you do – if you have users who insist on using “mickeymouse” as their password and the password expire option being turned off, then you will be at risk. The biggest security issue on all networks, without exception is always the users.

Simon.

[cruachanParticipant]

#329775

Re: Version of ISA Server?

Agreed. TMG and ISA are really enterprise class products, but ISA 2004 had a large penetration into the small business market because of SBS 2003 Premium.

Whilst TMG has some very nice new features (WAN Failover/Load Balancing, Web Filtering, Direct Access to name a few) it is not a cheap option.

[gforceindustriesMember]

#344377

Re: Version of ISA Server?

TMG does proper web filtering? Good to hear :)

[cruachanParticipant]

#329776

Re: Version of ISA Server?

gforceindustries;210101 wrote:

TMG does proper web filtering? Good to hear :)

It’s a subscription add on, but pretty cheap.

[gforceindustriesMember]

#344378

Re: Version of ISA Server?

Cheaper than adding Websense on to ISA?

[DumberMember]

#201246

Re: Version of ISA Server?

Well what is cheap…

http://www.microsoft.com/forefront/threat-management-gateway/en/us/pricing-licensing.aspx
Forefront TMG Web Protection Service

$12.00 per user or device, annually

Forefront TMG Web Protection Service provides continuous updates for malware filtering and access to cloud-based URL filtering to protect against the latest Web threats.

[Author]

Posts