Microsoft TMG Gateway and ISA Server 2006
Microsoft Forefront Threat Management Gateway (TMG) 2010 and Internet Security and Acceleration (ISA) Server 2006 are multi-layer firewalls, VPN, proxy, and Web cache platforms that increase network performance while improving the protection of small business and enterprise networks against internal and external attacks that exploit web and email vulnerabilities. Forefront TMG is built on the Intrusion Prevention System (IPS) architecture of ISA Server 2006, which is designed to make it easy and affordable for businesses to implement secure application publishing, efficient branch office gateways, and comprehensive web access protection.

Secure Application Publishing with Forefront TMG 2010 and ISA Server 2006 enables greater control over intranet resources, yet provides increased productivity by making them available to remote users. TMG 2010 and ISA Server 2006 help protect your corporate applications, services, and data across all network layers with stateful packet inspection, application-layer filtering and comprehensive publishing tools. As a Branch Office Gateway, TMG 2010 or ISA Server 2006 firewalls simplify administrator and user experiences through a unified firewall and VPN architecture, with web caching and bandwidth management, an optimized firewall and filtering engine, and extensive access control. Forefront TMG 2010 and ISA Server 2006 help provide Web Access Protection with a hybrid proxy-firewall architecture, granular policies, deep content inspection, plus comprehensive alerts and monitoring capabilities.

ISA Server 2006 has been replaced by Forefront Threat Management Gateway 2010 (TMG 2010), which is based on ISA Server 2006's architecture while providing a variety of enhanced features. Forefront TMG 2010 has in turn been discontinued by Microsoft, and the gateway security features offered by the product are typically handled by purpose-built hardware appliances from vendors such as Cisco, Barracuda, Check Point and WatchGuard. (See Cisco ASA firewalls with Firepower Services consulting.) Progent's firewall integration experts can help you manage and troubleshoot your ISA Server 2006 or Forefront TMG 2010 environment or assess the business value of migrating to a more current solution. If you decide an upgrade makes sense, Progent can help you plan and execute a smooth, cost-effective migration, test and tune your firewall deployment, provide custom webinar training to your support staff, and deliver ongoing remote consulting and support services.

ISA Server 2006 Architecture

Microsoft Exchange Server 2007 Consulting
The architecture of ISA Server 2006, detailed in the above illustration, provides a flexible platform for a secure web gateway, a single-box all-purpose intrusion protection system, a remote access gateway, or a secure email relay.
  1. The core firewall engine operates in efficient kernel mode and integrates with the TCP/IP stack.
  2. The policy engine retrieves ISA Server policies from the policy store, and enforces them both in kernel mode, as part of the firewall engine, and in user mode, where the Microsoft Firewall service performs advanced functions, such as user authentication.
  3. An application filter API allows included protocol filters and third-party protocol filters to provide advanced services that integrate with ISA Server. The SMTP filter is an example of such a protocol filter.
  4. The Web Proxy Filter processes HTTP requests and performs application filtering on these requests. A Web filter API allows third-party Web filters to plug into the Web Proxy Filter for more advanced HTTP processing.
Key Features of Microsoft TMG 2010 and ISA Server 2006
ISA Server 2006 offers a wealth of new features and benefits that provide more tightly integrated network security, easier management, higher performance, and better protection for business information and applications.

Integrated Security
Microsoft TMG 2010 and ISA Server 2006 offer tight security through integration with Microsoft applications and protocols such as Active Directory, Windows Internet Name Service (WINS), Dynamic Host Configuration Protocol (DHCP), Network Load Balancing (NLB), and VPN Quarantine. Improvements in this area allow your business to:

  • Increase security and deployment flexibility for Web application servers through enhanced multi-factor authentication (smart cards and one-time passwords), flexible integration with Active Directory (LDAP), and customizable forms-based authentication for almost any Web application and client device.
  • Easily integrate TMG 2010 or ISA Server with your existing authentication infrastructure through enhanced authentication delegation (including NTLM, Kerberos, and SecurID), and gain more access control with improved session management that detects non-user traffic through automatic idle-based time-outs.
  • Maintain secure branch office infrastructure using Background Intelligent Transfer Service (BITS) caching to accelerate the deployment of software updates and keep remote computers protected.
  • Help defend your network with Enhanced Flood Resiliency features for event handling and monitoring that provide better resistance to Denial of Service (DoS) and Distributed DoS attacks.
  • Mitigate the effects infected computers have on your network with enhanced worm resiliency through simplified client Internet Protocol (IP) alert pooling and connection quotas.
  • Enhance attack remediation through extensive alert triggers and responses to notify administrators of network problems promptly.
Easier Management
Total cost of ownership of application-layer security can be reduced significantly by TMG 2010 and ISA Server 2006 through simplified deployment and management, plus server consolidation. ISA Server 2006 saves your company money by allowing IT managers to:
  • Simplify the process of securely publishing Exchange, Windows SharePoint Services, and other Web servers with easy-to-use wizards for multiple sites, and enhanced certificate administration to avoid configuration errors.
  • Easily deploy farms of Web servers behind TMG 2010 or ISA Server 2006 using session-based and IP-based affinity with automatic out-of-service detection using Web Publishing Load Balancing.
  • Easily deploy and configure TMG 2010 or ISA Server 2006 computers in branch offices by using answer files on removable media for unattended installation, and with easy-to-use VPN wizards to streamline connectivity.
  • Manage remote TMG 2010 or ISA Server 2006 computers more effectively with faster propagation of enterprise policies, reduced server requirements, and low-bandwidth optimizations.
  • Provide enhanced resource control by log throttling and control of memory consumption and pending DNS queries.
  • Unify management and monitoring across your TMG 2010 or ISA Server 2006 infrastructure with the Management Pack for Microsoft Operations Manager, and use enterprise-level and array-level policies to streamline control of security and access rules across your organization.
Faster and More Secure Access
TMG 2010 and ISA Server 2006 offer secure and seamless user access to network resources with added speed achieved through caching. Deploying TMG 2010 or ISA Server 2006 can:
  • Enable a smoother user experience for published Web applications, document libraries, and content through single sign on and comprehensive link translation to help ensure secure and consistent access.
  • Improve Web page load times and reduce WAN costs for users in branch offices with HTTP traffic compression and caching.
  • Help ensure that the highest priority applications get precedence over other network traffic through Diffserv IP settings, providing better bandwidth utilization and response times for critical Web resources.
Innovative Features of Forefront Threat Management Gateway 2010
Microsoft's Forefront Threat Management Gateway 2010 offers a number of important features that make it an attractive alternative to ISA Server 2006. Top new features include:
  • 64-bit support for Windows Server 2008 R2 for improved performance, scalability, and reliability.
  • Web anti-malware protection through the inspection of inbound and outbound traffic and the ability to block encrypted folders.
  • The ability to inspect HTTPS sessions for encrypted malware or exploits.
  • Optional email security with Forefront Protection 2010 for Exchange.
  • Network Inspection System (NIS) for continually updated signature-based inspection of multiple network protocols.
  • Support for virtualization with Windows Hyper-V.
  • Internet Service Provider redundancy for high availability or load balancing.
  • Support for Secure Socket Tunneling Protocol (SSTP) and Network Access Protection (NAP) for improved VPN capability.
For a more detailed discussion of TMG 2010's enhancements over ISA Server 2006, see Progent's Forefront TMG 2010 consulting services.

How Progent's Microsoft-certified Consultants Can Help You with TMG 2010 and ISA Server 2006
Progent's certified firewall experts can assist you to maintain and troubleshoot a deployment of TMG 2010 or ISA Server 2006, and Progent can help you migrate efficiently to more current security platforms. Progent's CISM, CISSP, GIAC, and CISA-certified security engineers can show you how to create a complete security and compliance plan that adheres to industry best-practices for corporate-wide security policies. Progent can help you enhance your TMG 2010 environment by providing Exchange Server 2010 integration for protected email solutions and with Microsoft Operations Manager integration for network monitoring, automated warnings and remediation, and reports. Progent's team of Cisco CCIE-certified consultants can provide affordable online expertise for architecting and troubleshooting a secure network infrastructure with Cisco routers and switches.

If you have moved up to Windows Server 2008 R2 and to Microsoft's latest mission-critical platforms such as Exchange Server 2010 and SharePoint 2010, Progent can help you evaluate the costs and benefits of migrating to Forefront Threat Management Server 2010 from ISA Server 2006 to take advantage of TMG 2010's close integration with the current versions of Microsoft's mainstream applications.

Progent offers a range of cost-effective information technology services to fit your network environment and budget. Services available from Progent include emergency troubleshooting, high-end consulting, project management for major migrations and upgrades, onsite and remote support, Help Desk, and comprehensive IT outsourcing.

For more information about Progent's consulting and support services for ISA Server 2006, call 1-800-993-9400 or visit Contact Progent.