ISA Server

[mrbios]

Looking for some opinions, theres 3 of us in our IT team and only one of us knows linux, this becomes problematic when that one isnt around...

 

now assuming we have the hardware capable of running ISA and the knowledge of how it works would people recommend for or against it?

 

any past experiances people have with how good or bad it is would be appreciated

 

(i know it'd probably be easier to just learn linux but im not very good at learning something when im not interested in it, im willing to bet money that i could learn IAS server in a third of the time it would take me to learn linux )

 

Cheers

[plexer]

What do you want to do with it?

 

Ben

[mrbios]

sorry might have been a good idea if id mentioned that , we want to use it as a windows proxy, thus removing the last bit of linux involved in our school (apart from a little ftp server the kids use but no one cares about that)

[Geoff]

Threw IAS away and implemented FreeRADIUS on a Linux box a while ago.

[plexer]

Are you sure it's IAS you want and not ISA then?

 

Ben

[localzuk]

Just to clarify: Are you wanting to use radius authentication via IAS or are you wanting to do proxying via ISA?

[plexer]

It sounds like he wants to proxy using ISA I blame microsoft for having 2 products with the same 3 letters

 

Ben

[mrbios]

woops sorry its ISA

[webman]

Instead of throwing money at Microsoft crap I'd recommend investing in some Linux training which will benefit yourselves and the school in the long-term.

 

EDIT: Just read you couldn't care less about Linux... hey-ho

[spc-rocket]

Hi,

 

I don't think isa is a crap just becaue its from Microsoft, this forum has got a lot of anti MS people here but lets face it which ever solutions works for the organisation should be the main aim when evaluating or passing judgement on products.

 

We use ISA 2004 on our network with 2000 users and 800+pcs joined to domain and its doing the job very well. This is not to say that another solution would do the job better or worse than this.

 

Ash.

[Quackers]

We use ISA Server 2000, and find it good. Been using it for 3 years.

 

We have played with Linux proxy's, but found they all seem to want an Indent client installing on every machine if you want to use authentication, with ISA Server its all integrated.

 

The LEA gave us an RM Smartcache 2, gave it em back after 6 months, what a pile of poo that was.

[webman]

IPCop here with AdvancedProxy + URLFilter + CRE addons. Transparent NT authentication (without ident) and has been working reliably for 3 years. Nice web GUI, per-room internet on/off, keywords/blacklist/whitelist... can't fault it.

[Jake]

We are using ISA here to perform the same sorts of capabilities as webman above, (per room internet on/off, blacklist/whitelist/individual user banning etc. )

 

Havent had any troubles with it.

 

School I was at prior to coming here had a linux system for it and I have to admit that worked fine too.

 

I think both options are viable, and it will really boil down to which one you can pick up easier

[BooBoo]

See if your Grid has an offering, we use a SWGfL badged product by RM. It's a breeze to set up and I find it quicker than the ISA server we also have. The filtering and logging of the system is also good.

 

We also use the ISA server for connecting back into the school

[ranj]

Do any of these solutions work in a way, where you can block access to websites for a certain user but allow access for others.

[Ric_]

Do any of these solutions work in a way, where you can block access to websites for a certain user but allow access for others.

 

ISA will do this out of the box. IPCop will do this with the relevent addons.

 

Your choice really depends on how much you want to spend and what your skillset is. If you are not adverse to Linux then this is the more cost-effective solution and there are many alternatives - IPCop, Smoothwall (which also has commercial support - PM Tom Netwon), Endian Firewall and of course you could 'roll your own'.

[ChrisH]

ISA grumble grumble grumble. Mine has a mind of its own.

[ITWombat]

ISA grumble grumble grumble. Mine has a mind of its own.

 

Eh? But I though you were nix man Chris. Why aren't you using one the packages Ric has suggested.

[sidewinder]

Im a big fan of ISA Server

 

To be honest I only use it because 2000 was at the school when I joined and I logically upgraded to 2004.

 

Its a very good and secure product, I'm sure Linux could do just as good a job or better, but until I get time to learn it properly and evaluate solutions Im fine with ISA

 

Only problem is that when the LEA changed their own proxy, ISA started having major problems - massive slowdown and returning random websites, whatever you typed in. Since then we've been using it in a highly botched state to get it to an acceptable speed, and have lost the ability to authenticate users, so we have also lost most of the useful functionality

 

Over the summer I intend to totally reinstall it and play around with it until it works properly *hopefully*

[ChrisH]

ISA grumble grumble grumble. Mine has a mind of its own.

 

Eh? But I though you were nix man Chris. Why aren't you using one the packages Ric has suggested.

 

I have ISA but its not fully implemented because it drives me up the wall. I currently have Censornet V3 doing my firewalling but was getting a little sick of writing custom firewall rules for anything exotic so I thought I would give ISA a go as most of the services I was going to be publishing were windows based.

Thing is that I end up starting the firewall 2 or 3 times to get a rule to work. Best example is a forwarding of remote desktop. I have a rule that lets me through to a remote desktop which works fine. However if I change that IP to a correct IP address of another machine the dam thing doesn't work!!!! There is obviously something wrong with the install but I cant think why as its a pretty simple setup so far.

I have use Smoothwall/IP Cop in the past as well as shorewall. I was just hoping for something that would do as it was told as that git Ric told me it worked well for him .

[plexer]

We have played with Linux proxy's, but found they all seem to want an Indent client installing on every machine if you want to use authentication

 

You can use NTLM authentication with linux proxies yes M$ products may work better this way as they have it natively built into them.

 

Ident is easily spoofed so is one of the last resort methods I'd choose.

 

Ben

[srochford]

I put some notes at http://techinfo.cnwl.ac.uk/Squid%20Proxy/ about how I've configured Squid running on Windows to do NTLM authentication and logging in a reasonably useful way (and help was given by people here to get that going).

 

We use ISA here (2 x 2004 servers and 1 x 2000) - it works well.

 

I'm intrigued by webman's comments; mrbios wrote that there was an ftp server which no-one cared about, not that he didn't care about Linux.

 

I wonder if Linux would have an even wider take up if there wasn't almost religious zealotry and bigotry surrounding it. I don't find comments like these helpful (nor do I like the snide use of "M$" as an abbreviation for Microsoft) and, in my opinion, spoils what should be a professional forum.

[Guest Guest]

^ No MrBios said he doesnt care to *learn* linux. (And that theres a NAS that no-one cares about)

 

 

Personally id recommend learning linux as it will always be useful. Near enough anything "web" runs on linux. Its free, easy to learn, well documented, and most of all far quicker and more stable than windows.

[mrbios]

i want to learn it eventually but at the moment i have absolutely no motivation to learn something that goes straight over my head

 

had a staff review recently and im going to get some linux training in the future, but for now i think id like to add ISA server to my skill set for ease of use, thing with microsoft products is there so easy to pick up and go, i cant just trial and error things in linux because i have to know command line stuff for it (trial and error being my primary way of learning )

[Guest Guest]

^ Thats how i learned linux, that and like ive mentioned its *extreamly* well documented. I dare say if your willing to pay for books MS is better documented but if your just browsing the web looking for info its linux all day long.

 

Plus you dont need to learn any linux to use the pre-built proxes, and i honestly mean it; put cd in, follow onscreewn instrucions (hostname, ip address, the usual) and away you go.

 

You can obviously use a web browser, so you can configure a linux proxy as they are all web/browser based

 

Smoothwall community

IPCop

Endian

 

 

But your obviously willing to pay money, how much ISA cost i wouldnt know, but Smoothwall School guardian could be an option as it extreamly easy to use and also has support

 

 

The only bit anyone has trouble with is getting the proxy to authenticate against AD, but if you go for smoothwall i know they'll be able to guide you through it.