![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
Forefront Internet Security Gateway
- Thread starter dashpuppy
- Start date
shabazkilla
Lurker
- Joined
- Jan 4, 2004
- Messages
- 439
You mean Forefront Threat Management Gateway - aka ISA server?
shabazkilla
Lurker
- Joined
- Jan 4, 2004
- Messages
- 439
I've used the older versions (ISA 2000, 2004 and 2006), but never for firewalling. I've only used it's proxy functions for website publishing and web filtering.
I got a unit off Blue Fox, it's suppose to be a firewall with UTm features.. Just not having much luck on information about it and stuff.
IF ANYTHING, i could format, the box and use Untangle on it, since the box is a dual core and 6 x 1gig nic's
ISA / TMG is really a waste of time IMO. We had it when I started this job and it caused so many headaches it was unreal. We ditched it pretty quick to use just a Sonicwall NSA 2400. I know that probably isn't an option in your case, but you would be better off grabbing a off the shelf linksys router and going straight to the internet
For a business enviroment i think they're alright. It might take you a few minutes to get used to it as it does have its drawbacks in config-ability but other than that i think its pretty solid.
Nice integration with adds also. I never bothered with the NIS part of TMG though.
Nice integration with adds also. I never bothered with the NIS part of TMG though.
id love a sonicwall NSA2400, however the yearly subscriptions to keep it alive = $$$$$...
I have a tz210 it's good, until you put vlans on it, then it fails and transfer rates = LAME.
So my options are use this new isa server that i bought, with the os on it, OR install untangle to it.
Since its a core 2 duo with ram and 6 x 1gig nic's it should work great
2 totally different products.
very different..
Forefront Threat Management Gateway also replaces ISA, but it works well with Exchange. Effectively with Exchange it's a firewall that's connected through your DMZ to your CAS array for outside access.
Not sure what you mean by 2 totally different products, unless your refering to Forefront Unified Access Gateway which overlaps in a lot of ways as well.
one can be a external firewall ( dedicated box ) and one installed on your exchange box..
from what i can tell.
I've installed 2008r2 server + fore front threat management and couldn't get it configured and working
one can be a external firewall ( dedicated box ) and one installed on your exchange box..
from what i can tell.
I've installed 2008r2 server + fore front threat management and couldn't get it configured and working
No, Forefront Threat Management Gateway can be installed on an Edge Server in your dmz if you wish, but it can also be on a dedicated box. It's not installed on an internal Exchange Server, that's Forefront Protection for Exchange Server.
I do have it configured and working.
No, Forefront Threat Management Gateway can be installed on an Edge Server in your dmz if you wish, but it can also be on a dedicated box. It's not installed on an internal Exchange Server, that's Forefront Protection for Exchange Server.
I do have it configured and working.
wanna shed some help ?
Im trying to create a firewall.
initially id like to have it run vlans for my home network.
And protect a few things
WWW server
exchange server
File server
So i would like it to protect those from :
Viruse & Spyware etc etc
hacked attempts
also want vpn
i got one of these that's suppose to be running perfectly, just needs to be setup, when it arrives..
shabazkilla
Lurker
- Joined
- Jan 4, 2004
- Messages
- 439
Im trying to create a firewall.
initially id like to have it run vlans for my home network.
And protect a few things
WWW server
exchange server
File server
So i would like it to protect those from :
Viruse & Spyware etc etc
hacked attempts
also want vpn
i got one of these that's suppose to be running perfectly, just needs to be setup, when it arrives..
I've used one of those boxes before, but just for a WebSense box. You have to love a server with a jog dial though
I use it at home to play around with, it gets the job done for the most part, definitely given its share of headaches but some of that has been self inflicted. Definitely easy to setup if you're using other MS products like exchange or sharepoint, other reverse proxy sites are plenty easy to setup. RAM usage is pretty ridiculous, I give it 4GB but it has like an 8GB commit for just home use, and uses several GB/mo in SQL log usage. I can't comment much on the malware inspection since it's never found anything but there are times I have to disable it because it interferes with some applications and sites. Also no IPv6 support.
It's better than the linksys DD-WRT it replaced but I'm hoping the next version fixes some of the issues I've seen and heard of.
It's better than the linksys DD-WRT it replaced but I'm hoping the next version fixes some of the issues I've seen and heard of.
My idea was to use it for untangle, as i want to block all the crap on the net
and personnally, untangle does WAY better than Sonicwall does at virus protection & malware/spyware. I only have a www server Exchange server sbs 2011 with share point,
I was reading more about this Microsoft firewall and doing dhcp and other stuff, some say that it wont do Vlan's
Define "do vlan's".
If the TMG is running on bare metal you can use the vlan config for your network adapters to make virtual VLAN adapters. If it's running in a VM like mine you can assign VLANs to the virtualized adapters. I have an isolated vlan on my setup on the off chance I need to work on an untrusted machine. The only access that VLAN has is port 80 and port 443 to internet and DNS between the isolated VLAN and my local DNS servers. The people saying it doesn't do vlans may mean it doesn't have any built in support for tagging and such, but it can manage and isolate or bridge virtual adapters bound to VLANs just fine
TMG server shouldn't really be handling DHCP or DNS, your SBS should be handling both of those, the only things on the TMG box should be TMG, an edge server for exchange, and any sort of mail AV/spam protection for the edge server.
If the TMG is running on bare metal you can use the vlan config for your network adapters to make virtual VLAN adapters. If it's running in a VM like mine you can assign VLANs to the virtualized adapters. I have an isolated vlan on my setup on the off chance I need to work on an untrusted machine. The only access that VLAN has is port 80 and port 443 to internet and DNS between the isolated VLAN and my local DNS servers. The people saying it doesn't do vlans may mean it doesn't have any built in support for tagging and such, but it can manage and isolate or bridge virtual adapters bound to VLANs just fine
TMG server shouldn't really be handling DHCP or DNS, your SBS should be handling both of those, the only things on the TMG box should be TMG, an edge server for exchange, and any sort of mail AV/spam protection for the edge server.
I don't want my sbs server handing out dhcp for my home network, I only want it to hand out deco for my 2 windows machines that join the domain, the rest are macs and Linux machines..
What difference does it make what hands out DHCP? The reason MS recommends not having DHCP on the TMG box is that "best practice" has the box practically completely locked down. You CAN install the DHCP service on the TMG host and open up the necessary ports and protocols (in the TMG config not just windows firewall), but there's no reason macs and linux boxes can't get their DHCP config from the SBS server. As long as whatever is handing out DHCP info is handing out the right info it shouldn't matter too much where it's being run ffrom.
But I have more than one subnet / vlans. I don't want my sbs handing out deco for all the other stuff, I have my network locked down.
Vlan one is 192.168.1.1. Default
Vlan two is 192.168.2.1 my rdp and nas boxes and other stuff live on this
Vlan 60 is my windows domain and desktops 192.168.60.1. (dhcp is from the sbs www server and exchange and internal domain)
Vlan 90 is wap 10.10.30.1
Vlan 77 is media & guest network for testing / repairs..
It's not a easy setup
but it's secure etc etcTMG can definitely be configured to route and NAT all that with as much or little cross talk as you want. Sounds like you don't want or need DHCP on most of those VLANs other than the windows VLAN, but if you did you could probably install the DHCP server on the TMG box and then just bind the proper scope to the proper interfaces.
I have 3 virtualized NICs and the OP would need 6 total virtual or virtualized NICs for what he wants to do, how many physical NICs that actually correlates to is largely irrelevant. Technically he could do what he wants to so with 1 NIC, or if he wanted to aggregate links for higher bandwidth, he could use several dozen physical NICs.
Personally I use 1 physical NIC and 3 VLANs cause frankly a 20Mbps internet connection doesn't REALLY need 2 much less 3 real gigabit connections.
Personally I use 1 physical NIC and 3 VLANs cause frankly a 20Mbps internet connection doesn't REALLY need 2 much less 3 real gigabit connections.
Exactly how I am using it. Although we have a pair of Kemp Load Balancers thrown into the mix to do some hardware load balancing across the Exchange servers and CAS Arrays.
Why not? Just set up 2 completely different scopes and place each network on its own vlan.
thats the plan ( i hope )
One nic for traffic int IE the cable modem, then the other nic to the switch that has vlans..
SO wish i had bought a layer3 switch long time ago instead of this layer 2....
its layer 2, right now i'm running all the vlans through it with a sonicwall TZ210 HOWEVER the tz210 can't sustain the through put i'm putting it through, hence why i'm switching to either Untangle OR isa..
exactly what i'm doing, and want to do. with the new isa box.
so just make 2 separate inside interfaces and have one go to your SBS network and the other go to your home network and then just use any old crappy router to serve DHCP just make sure you turn off all the routing features.
I would strongly recommend against loading DHCP services on that firewall, although you can do it as others have mentioned.
I would strongly recommend against loading DHCP services on that firewall, although you can do it as others have mentioned.
So you're planning on going cable modem to TMG nic1 (public IP) and then TMG nic2 (private IP) to your switch, that sound right?
I'd just run DHCP on the SBS box and have several scopes for each of your VLANs, then use helper addresses in the other VLANs to point them to our SBS box for DHCP.
I'd just run DHCP on the SBS box and have several scopes for each of your VLANs, then use helper addresses in the other VLANs to point them to our SBS box for DHCP.
i don't want to use that as a option. id rather the firewall hand out dhcp.
You're going to have to create custom rules in TMG to get it working as I don't think there's a rule for it by default. But why would you rather the firewall hand out dhcp?
because if i turn off my web server or my virtual machine i don't want my network down.