ISA (Internet Security Accelerator)

It is useful to speedup internet access and to protect private network from public network. It is actually firewall & acts as a proxy.

Types of firewalls:

1)Hardware firewall
2)Software firewall

Hardware firewall: CISCO pix, watch guard, multi com Ethernet II

Software firewall: ISA server
Checkpoint
Smooth wall

Firewall: a firewall protects networked computers from international hostile intrusions.

Types of Attacks:

1. Foot printing
2. Scanning
3. Dos attack (denial of service)
4. Exploits ex. Cgi scripts, perl scripts etc.)
5. Trojan horses ex: netbus, bo2k
6. Port scanner

1. Foot printing:

The art of gathering the complete security profiles of an organization or a target computer. By using a combination of tools and techniques the hacker can take up the system and determine its IP address and domain names.
2. Scanning:

Scanning the system for bugs and loopholes in OS. Hacker uses scanning technique to determine which ports are open what services are running and what is the OS
Ex: RATINA, shadow security scanner, ANSIL etc..

3. DOS attack:

Denial of service attack which is an attempt to get the service or the server down by overflowing the buffer. Eg. Win spoof a7, my spoof.

4. Exploits:

Exploits are usually bugs in applications or OS which can be exploited by using a piece of code often referred as scripts.

Ex: CGI scripts, perl scripts etc..

5. Trojan Horses:

Trojan horses are a program that pretends to be a useful tool but actually installs malicious or damaging software.
Trojan Horses can be used to take over the remote system sending viruses to steal the data. Ex. Netbus, Bo2k.

7. Port scanner:

Scanning the port to get into the application ex: port scanner, etc.

ISA can be configured as firewall or proxy server.
If it is configured as a firewall,
Packet filtering: ex: routers controls data transfer based on source destination IP addresses
TCP/UDP port of source destination IP address.
Packets are allowed or dropped through the device depending on the access control list.
If it is configured as proxy it acts like a web server
Application gateway: ex: proxy server.
Packets are allowed based on type of application and IP address.
Filter application commands such as http, GET and POST etc..
Application level gateways can also be used to log user activity and logins.

Flavors of ISA server:

Standard edition enterprise edition


Server deployment stand-alone only multiple servers with centralized management.

Policy based support Local only enterprise &array policies

Scalability CPU’s only no limit.



ISA server requirements:

Member server or DC
Service pack 1 or above
Two interfaces (public & private)
RRAS
Processor: PIII 300 MHz. Or above
256 MB RAM
20 MB of H.D. space on NTFS 5.0

Array considerations:

ISA server models:
49 Firewall model
50 Cache model
51 Integrated model.

Installing ISA:

On router
Open D or E drive
ISA standard - ISA – setup.exe
Select integrated mode &continue

Private Router Pubic

IP: 192.168.1.2 192.168.1.1 202.153.32.2
202.153.32.1

G/W 192.168.1.1 202.153.32.1

DNS 202.153.32.2 202.153.32.2 202.153.32.2


1) Enable LAN routing create websites & zones

2) Install ISA


Specify the range of address.:

Installing ISA service pack
Open D or E drive
ISA 2k standard
ISA service pack2.enu
Update
Update.exe – next – agree – next

Cache mode:

Select this option if security is not the criteria as it is used for accelerating the access speed of websites by the private network users. Since it maintains the recently accessed websites information in the ISA as cache information.
It can’t act like a firewall.

Firewall:

useful if we want to configure ISA as firewall, which protects the private network from public network. With the help of some protocol rules and policy elements we can set the security. We can also control the type of traffic to be allowed in or allowed-out.

Integrated mode:

Useful when we want to configure ISA as cache&firewall server.

Key features of ISA:

1. internet firewall (Instruction detection)
2. secure sever publishing
3. Web caching server.
4. Secure NAT.
5. Integrated VPN.
6. Tiered policy management
7. Web filters (for blocking audio, images etc.,)
8. Alerts
9. Multi processor support
10. QOS (Quality of Service)
11. Client side auto discovery.

Access is controlled based on

63 client address sets
64 destination sets
65 protocol rules
66 bandwidth priorities

Allowing websites

On router (ISA)
Start - programs – ISA server
ISA management – expand server

Creating a client address set:

Expand policy elements
Right click on client address set
New – set name of the set – ex. Sales
Add the range of available IP adds. Including ISA – ok

Setting Protocol rules:

For allowing websites
Expand access policy
Right click on protocol rules
New rule
Specify the rule name
Allow next protocols next schedule
Next – client type – select specific computers
Next – add the client add set we’ve created – ok – next – finish

Configuring the proxy client:

Move onto private network
Right click IE
Properties
Connections
LAN settings - check the box proxy server
Specify the add of ISA server &port no. 8080
Ok
Open Internet explorer and access any website

Denying a particular website:

Creating a destination set:

Expand policy elements
Right click on destination set
New set - specify the destination
Website name – click on add – specify the destination name
(Which site we want to block) – Ok


Creating a site & content rule:

Expand access policy
Right click on site & content rule
New rule - specify the name allow or deny
Rule action (do nothing)
Rule configuration
Destination set, select specified destination set
Select the name – next – finish

Verification:
Move on to private network
Try to access yahoo.com.
It shouldn’t open

Redirecting a website:

Create a destination set
Right click site & content rule
New rule specify the name of the rule ex: YRG, YRR
Next - check the box http
Specify the target site name (to which we want to go)
Next – select specify destination set
Click the radio button
Next – finish

Verification:

Move onto private network
Typing the source website we should find the redirected website.
Yahoo redirected to google.

Blocking images:

Create a destination set
Site (which we want to block)
Create a site & content rule
Double click on the root we’ve created
Http content
Select content groups
Check the box whatever we want (ex. Images)
Apply – ok
Move onto private network
Open the website
We should notice no images


Specifying schedule:

Double click the site & content rule we’ve created
Click on schedule
New -specify the day and timing Mention the schedule name – ok – apply – ok