Evaluating Interoperability Issues

Before you can make ISA Server interoperable with other network services and computers, you need to evaluate possible implementation and integration issues within your configuration, as shown in Figure 5.6.

Figure 5.6: Evaluating Interoperability Issues

Running Other Services with ISA Server

You can run ISA Server on a computer with other services running already, such as e-mail or Web servers. However, it is not recommended to place other services on the firewall. For improved security and protection, place services behind the firewall, as shown in Figure 5.7. For example, if your organization needs to deploy ISA Server to connect branch offices to the Internet in integrated mode, ISA Server can be installed on existing e-mail or Web servers to simplify deployment and minimize the cost.

Figure 5.7: Running Other Services with ISA Server

Implementing ISA Server in a Domain

ISA Server with ISA Server SP1 can be installed as a stand-alone server or as a member of an array in a Microsoft Windows 2000 Server or Windows Server 2003 domain. When you install ISA Server as a stand-alone server, the configuration information is saved to the local registry. When you install ISA Server as a member of an array in a Windows 2000 or Windows Server 2003 domain, the ISA Server schema is installed into the Active Directory . You need to install Active Directory on the ISA Server domain to use ISA Server arrays.

ISA Server can be installed as a stand-alone server in a Windows NT Server 4.0 domain. No special configuration is required. You can use arrays of ISA Server computers to connect and secure Windows NT 4.0 domain users and clients to the Internet. However, the array must be set up on a separate Windows 2000 or Windows Server 2003 domain. Then you can establish a trust relationship from the domain containing the ISA Server computer to the Windows NT 4.0 domain.

Using ISA Server with Other Network Services

You might have run the Routing and Remote Access service in Windows 2000 or Windows Server 2003 to make network services and computers available to remote clients. ISA Server enables remote connectivity and extends routing and remote access functionality by providing additional security features. ISA Server packet filtering replaces the packet filtering functionality in the Routing and Remote Access service. In addition, ISA Server uses the dial-up connections that you previously configured for routing and remote access.

Similarly, you might have used Internet Connection Sharing (ICS) or network address translation (NAT) to access the Internet. ISA Server provides the connectivity enabled by NAT or ICS, while adding sophisticated security and caching features.

Caution

You cannot combine ICS or the NAT that is included with the Routing and Remote Access service for Windows Server 2003 with ISA Server or else you will lose firewall functionality. Also, IIS cannot run on the same computer as ISA Server without special configuration. For more information about configuring IIS for use with ISA Server, see the ISA Server link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources, and then search for the keyword socket pooling.