Customer Reviews

Microsoft Internet Security and Acceleration (ISA) Server 2004 Unleashed

5 star:		(3)
4 star:		(1)
3 star:		(0)
2 star:		(0)
1 star:		(0)

 

 

The book is poorly named. "Unleashed" suggests to me wild and wonderful things to do with complex features or even tricks and undocumented things. This is definitely a black Labrador on-the-leash kind of book, and it will get an administrator safely across the broad avenue that is an ISA installation. It's a great book in spite of the name.

I used "Unleashed" as a guide for installation of ISA Server 2004 (replacing ISA Server 2000) on the perimeter of a small office network that has ten servers on three different domains (including a web server and a mail server) and twenty workstations. I studied this book and Shinder's "Configuring ISA Server 2004" extensively before beginning the installation, and I had previous experience doing the installation and maintenance of the ISA 2000 installation that ISA 2004 replaced.

I preferred this book ("Unleashed") to the Shinder book as an installation guide, but I like Shinder as a reference because of its greater depth (twice as many pages). Both books promote ISA, but the Shinder books examines (in a defensive but very useful way) competing options to ISA more thoroughly. Shinder's book then would be more useful for those evaluating ISA versus competing products.

I also have the Microsoft MCSA/MCSE Training Kit. This book is the only ISA 2004 book that includes a 120-day trial version of ISA Server 2004. I have spent only two hours with this book but found the questions and answers at the end of each lesson helpful reflecting on key points. I did find a glaring error early on. It is not true that "the IP address assigned to the external interface [of the ISA server] must be routable ON [emphasis added] the Internet." The truth is that this IP address must be routable TO the Internet; and a private address (10.1.1.1 for example) will do just fine if there is (as in my case) a router with a public address between ISA and the Internet. Microsoft books are of coure authoratative and prep well for the exams in spite of an occasional error.

Our ISA server is connected on the Internet side with a private (nonroutable) IP address to an $89 Linksys router, which is configured with simple firewall filters. The Linksys router has a public IP address and connects to a Verizon DSL modem. A laptop in the DMZ between ISA and the router is used for testing ISA protection. The ISA server of course could be connected directly to the DSL modem; but we like the presence of the additional appliance (the Linksys router) as an additional level of defense. We run GFI (number one Exchange spam filter) on our Exchange server since ISA and most other firewall products only do token spam filtering.

"Unleashed" provided sufficiently detailed and accurate guidance for each step that I took: hardening the OS, installing ISA, configuring the networks attached to the ISA NICs, setting up firewall rules, publishing an IIS web server, publishing an Exchange mail server, and setting up Outlook web access. The total time required was only two hours even with a couple of errors.

ISA is a complex product with routing, caching proxy and reverse proxy servers, firewall (including stateful and advance application level inspection), VPN server, and simple spam filter. Michael Noel in "Unleashed" clearly shows how to use the greatly improved ISA administrative interface with its templates and wizards to configure my simple architecture and also more complex architectures that place servers in the DMZ as well as the limited single-homed topology with the ISA server in the DMZ. My company is not using VPN, but the book provides thorough coverage of VPN, which many be mission-critical to those with branch offices and road warriors.

Lastly, if you are new to ISA, be aware that ISA 2006 was released as a beta earlier this year. Many reviews suggest that ISA 2006 is not a major change. Microsoft says that upgrading from 2004 to 2006 will be supported. Amazon shows no titles as yet for ISA 2006. My guess is that the final release of 2006 will not come before the end of the year.

I found this book to be extremely helpful in understanding ISA architecture and how it might fit into our organization.

The book is well laid out, concise and readable. The first section lays out a high level view of ISA functions and provides a clear overview of how to assess which components are appropriate for solving specific network security issues. The section on deployment goes into more detail, explaining how to install and configure the various components of an ISA deployment. Part III on securing servers and services goes into the specific details of configuring ISA to protect messaging, web and RPC traffic.

Microsoft networking products continue to improve both in functionality and ease of use. Having guides like this make understanding and implementing new technology viable even for small organizations with limited budgets.

This is THE book if you are looking to learn ISA 2004. It is structured in an easy-to-understand manner for windows admins who are familiar with Windows but may not have been exposed to ISA Server or are upgrading from ISA 2000. All in all this is the only book on the subject you'll need.

This is by far the best ISA Server book on the market.
Worth every penny I paid for it.