ISA vs SmoothWall

[Haux]

Hi all,

 

Whats everyones opinion on Smoothwall? What's it like to setup, what are it's features like e.t.c.?

 

Would you say it's better or worse than Microsoft ISA 2006?

 

Cheers

[Guest Guest]

At what? They are for fairly different purrposes. Although alot of teh functionality overlap, SW is more for filtering and "all in one" routing/VPN/etc, where as ISA is more for webpublishing and making MS products talk to eachother nicely ie seamless authentication between exchange and sharepoint sites etc. Edited December 3, 2009 by Guest

[Haux]

Ah righto We currently use ISA as a webproxy and were wanting Smoothwall to do the same. Edited December 3, 2009 by Haux

[Guest Guest]

Doing filtering or just caching?

 

ISA is the equivilent of squid (smoothwalls proxy componant) in this case in that it doesnt do any filtering itself, it just provides the platform which a filtering solution can be added. In the case of SW this is Dansguardian.

 

Assuming you are talking about filtering; SW does content filtering where as many of the ISA addon solutions only do URL filtering. In this way alone there is no comparison between the 2, SW wins hands down.

 

As an overall solution, taking into account VFM, SW is probably the best in the business.

[Haux]

Both filtering and caching, could you use ISA and Smooth wall together? The main reason we were looking at Smoothwall is because of it's Proxy blocking capabilities.

[krisd32]

No you wouldn't use them together you can get add ons for isa such as websense but they are expensive and don't seem to work just quite as well as smoothwall, in my experience anyway.

[Guest Guest]

Theres no reason why you cant use both together. We have an ISA box as our main router for webpublishing, with a linux box running squid and dansguardian (which is effectively what SW is) on our LAN doing the filtering.

In that case iirc its the basic schoolguardian you want to be looking at as you wont be using any of the routing features the fully fledged SW has (as ISA will be doing that). Have a word with Tom Newton on this forum, he works for SW

[krisd32]

I think i've got the wrong end of the stick with what the OP was asking then. presumed he meant using smoothwall as an extra to isa which in the situation described above he was only using isa as a proxy and not web publishing therefore eliminating the need for isa altogether.

[ZeroHour]

We run both here, we have ISA because of its vpn and it just works and network guardian (smoothwall but filtering only) as the proxy behind it. Works well for us. I would have both again tbh.

[tom_newton]

These guys have it pretty much bob on - you can use both if you want to, *often* a Smoothie can totally replace ISA, doesn't have to though. I am unsure of my movements tomorrow, but call 0113 3874181 and speak to Rob, or get me on 0113 3874166 in the morning (may be around early) or monday, and we can work out what is best for you.

[Haux]

So how would it work? Internet/outside world - ISA - Smoothwall - Switch - Computers?

 

If so how would we configure the PC's? Would they still connect to the same Gateway address on the ISA?

 

Cheers

[ZeroHour]

I have ISA as our gateway but have the GP putting smoothwall as the proxy.

We use ISA to control https (https is proxied to isa) because we found it easier to control with ISA.

[tom_newton]

@Haux - thats right. Normally you'd use GP or some other method (DHCP?) to redirect users to Guardian as a proxy. Additionally you'd block user PCs from access t'internet direct through ISA, except for any ports they need (likely: none).

 

@Zerohour: You little rascal... ISA for HTTPS? What is it you'd like us to do better at HTTPS? Tell me and I will make someone do it

[featured_spectre]

we have ISA running, if I could I would have the following in order..

 

PC > ISA > Smoothwall > E2BN filter...guarantee'd one of them will catch something bad.

[Guest Guest]

http://upload.wikimedia.org/wikipedia/commons/8/85/ManWearingTinFoilHat.jpg

[ZeroHour]

PC > Smoothwall (Network Guardian Edition) > ISA > E2BN filter

Would be best I think as you dont really need 2 firewalls. ISA fyi has not been hacked yet...

[Guest Guest]

ISA fyi has not been hacked yet...

 

Interesting to know. So is that ISA and its windows platform as a hardened OS/routing package has not been hacked? Or is it ISA hasnt but there are still vulnerbilities in windows which if left unchecked may be exploited even with ISA sat on top of it?

 

Just be interesting to know if you can set it up and "forget" like you can with *nix based products, or atleast to some extent.

(Obviously *nix still gets updates but for the most part once you get to teh stable releases updates tend to be bug fixes rather than patching holes)