Re: Traffic Routing and Content Filtering
- From: Joe <joe@xxxxxxxxxxxxxx>
- Date: Thu, 10 Jul 2008 19:45:32 +0100
RP wrote:
One more thing. When I go into Server Management under Internet and Email it says "Setup Firewall", is this ISA 2004? Or am I getting this mixed up. Thanks.
It's ISA if installed, or the built-in firewall if not, neither of which can be used with only one NIC. The traffic must pass through the SBS. The minimum-cost option, if you do have SBS Premium and therefore ISA, is to switch to two NICs and use it. If you don't have ISA, then two NICs will allow you to use the built-in firewall, but this has almost no filtering facilities and no web proxy. You have been warned about the next SBS version not having this capability, but this may not be important at the moment. IT planning rarely works years ahead, and nobody upgrades a server operating system unless they need to.
Probably the minimal-disruption method to achieve what you want is a stand-alone firewall appliance placed between the network hub/switch and the Internet router. I understand the cost constraints, which everyone has, but there's no law that says you have to be able to do what you want without it costing anything. I'm quite sure your boss will value network uptime quite highly, and it's up to him how highly he values the abilities he now wants. If you were to go this route, then the connection between router and appliance forms another tiny network, which must use a different network address than your current one, and I'd strongly advise against using the 10.0.0.0 network address.
There is a virtually zero-financial-cost option, that of running one of many free operating systems on a two-NIC computer to implement an ISA-type firewall appliance. There is, of course, a cost in the very steep learning curve involved. It is no more practical to utilise such a system without any knowledge of it than it is to run and troubleshoot ISA on SBS without knowing anything about ISA or SBS.
The drawback to the use of any firewall is your VOIP system. Usually quite a large range of ports must be opened for VOIP, and any firewall, whether 'software' or an 'appliance', will have a CPU-limited throughput which may be heavily utilised by VOIP. Many people implement VOIP as a completely separate IP network running directly from an Internet router port to avoid this, but obviously this cannot be retrofitted easily.
.
- References:
- Prev by Date: Re: Backups HELP!
- Next by Date: Re: Problem after removed "domain users" from "local administrator"s g
- Previous by thread: Re: Traffic Routing and Content Filtering
- Next by thread: Roaming Users Local Profile
- Index(es):
Relevant Pages
|
