What's New and Improved in ISA Server 2004

Internet Security and Acceleration (ISA) Server 2004 is the advanced application-layer firewall, virtual private network (VPN), and Web-cache solution that enables you to easily maximize existing IT investments by improving network security and performance. ISA Server 2004 offers the following new or improved features:

Advanced Protection

• Application-layer filtering
• Security and firewall

Ease of Use

• Multinetworking
• Monitoring and reporting
• Management

Fast and Secure Access

• Secure remote access to Microsoft servers
• Virtual private networks
• Web cache and Web proxy

Advanced Protection

Application Layer Filtering

New or Improved	Feature	Description
New	HTTP filtering on a per-rule basis	The ISA Server 2004 HTTP policy allows the firewall to perform deep HTTP stateful inspection (application-layer filtering). The extent of the inspection is configured on a per-rule basis. With this capability, you can configure custom constraints for HTTP inbound and outbound access.
New	Block access to all executable content	You can configure ISA Server 2004 HTTP policy to block all connection attempts to the Microsoft Windows operating system executable content, regardless of the file name extension used on the resource.
New	Control HTTP file downloads through file name extension	The ISA Server 2004 HTTP policy enables you to define policy based on file name extension, including "allow all except a specified group of extensions" or "block all extensions except for a specified group."
New	HTTP filtering is applied to all ISA Server 2004 client connections	With the ISA Server 2004 HTTP policy, you can control HTTP access for all ISA Server 2004 client connections.
New	Control HTTP access based on "HTTP Signatures"	ISA Server 2004 deep HTTP inspection can help you create "HTTP Signatures" that can be compared to the Request URL, Request headers, Request body, and Response body. This gives you precise control over what content internal and external users can access through the ISA Server 2004 firewall.
New	Control allowed HTTP methods	You can control which HTTP methods are allowed through the firewall by setting access controls on user access to various methods. For example, you can limit the HTTP POST method to prevent users from sending data to Web sites using the HTTP POST method.
New	Enforce secure Microsoft Exchange Server remote procedure call (RPC) connections from full Microsoft Outlook messaging and collaboration MAPI clients	ISA Server 2004 Secure Exchange Server Publishing Rules give remote users' connection to their Exchange server using the fully functional Outlook MAPI client over the Internet. However, the Outlook client must be configured to use secure RPC so that the connection is encrypted. With the ISA Server 2004 RPC policy, you can block all nonencrypted Outlook MAPI client connections.
New	FTP policy	You can configure the ISA Server 2004 File Transfer Protocol (FTP) policy to let users upload and download through FTP, or you can limit user FTP access to download only.
New	Link translator	Some published Web sites may include references to internal names of computers. Because only the ISA Server 2004 firewall and external namespace, and not the internal network namespace, are available to external clients, these references appear as broken links. ISA Server 2004 includes a link translation feature that you can use to create a dictionary of definitions for internal computer names that map to publicly known names.
New	Granular control over IP options	With ISA Server 2004, you can configure IP options on a granular basis and allow only the ones you require while blocking all others.

Security and Firewall

New or Improved	Feature	Description
New	Extensive protocol support	ISA Server 2004 gives you control over accessing and using any protocol, including IP-level protocols. Users can then use applications such as ping and tracert to create VPN connections using PPTP. In addition, IPSec traffic can be enabled through ISA Server.
New	Support for complex protocols requiring multiple primary connections	Many streaming media and voice/video applications require that the firewall manage complex protocols. You can use the new ISA Server 2004 New Protocol Wizard to help manage these protocols and to create protocol definitions.
New	Customizable protocol definitions	With ISA Server 2004, you can control the source and destination port number for any protocol you create a firewall rule for. This allows the ISA Server 2004 firewall administrator a high level of control over which packets are allowed inbound and outbound through the firewall.
New	Firewall user groups	You can use ISA Server 2004 to create custom firewall groups that consist of preexisting groups in the local accounts database or the Active Directory directory service domain. This increases your flexibility to control access based on user or group membership, because the firewall administrator can create custom security groups from these existing groups. This removes the requirement that the firewall administrator be a domain administrator, to credit custom security groups for inbound or outbound access control.
Improved	Authentication	Users can be authenticated using built-in Windows, RADIUS, or RSA SecurID authentication Enters or other namespaces. Rules can be applied to users or user groups in any namespace. Third-party vendors can use the software development kit (SDK) to extend these built-in authentication mechanisms.
New	Firewall client credentials forwarded to the Web Proxy service	ISA Server 2004 allows firewall clients to access the Web cache with the HTTP filter without requiring separate authentication with the Web Proxy service.
Improved	Hotmail Web-based e-mail access through the firewall	Improved HTTP filter enables users to access Hotmail through an easy-to-configure firewall rule without the need for special configuration on the client or firewall.
Improved	Network objects	You can greatly expand your ability to define network objects by creating computers, networks, network sets, address ranges, subnets, computer sets, and domain name sets. These network objects are used to define source and destination settings for firewall rules.
Improved	Firewall rule wizards	ISA Server 2004 includes a new set of rule wizards that make it easier than ever to create access policy. You can create access policy or configure required policy elements "on the fly" with a sophisticated firewall rule. And, you do not need to leave the rule wizard to create a network object; any network object or relationship can be created in the new wizard.
Improved	Firewall rules represent an ordered list	Firewall rules are represented in an ordered list in which connection parameters are first compared to the top listed rule. ISA Server 2004 moves down the list of rules until it finds a rule matching the connection parameters and enforces the matching rule's policy. This approach to firewall policy makes it much easier to determine why a specific connection is allowed or denied.
Improved	User/group-based access policy	With the enhanced firewall rules, you can define the source and destination for each protocol a user or group is able to access. This greatly increases flexibility for inbound and outbound access control.
Improved	Outlook Web Access Publishing Wizard	Clientless remote access through secure SSL connections form the core of SSL VPNs. The ISA Server 2004 Outlook Web Access Publishing Wizard walks you through creating a firewall rule and creates the Outlook Web Access SSL connection to your Exchange server. All network elements can be created "on the fly" and you never need to leave the wizard to create a policy element.
Improved	FTP support	ISA Server 2004 gives you access to Internet FTP servers, listening on alternate port numbers without requiring special configuration on the client or ISA Server 2004 firewall. The FTP server publishing on alternate port numbers requires nothing more than a simple FTP server publishing rule.
Improved	Port redirection for FTP server publishing rules	Using ISA Server 2004, you can receive a connection on one port number and redirect the request to a different port number on the published server.
Improved	Secure Web publishing	You can place servers behind the firewall, either on the corporate network or on a perimeter network (also known as a demilitarized zone [DMZ] or screened subnet), and securely publish their services. With the improved secure Web Publishing Wizard, you can easily create a rule that lets users' secure SSL remote access to published Web servers.

Ease of Use

Multinetworking

New or Improved	Feature	Description
New	Multiple network configuration	You can configure one or more networks, each with distinct relationships to other networks. Access policies are defined relative to the networks and not necessarily relative to a particular internal network. ISA Server 2004 extends the firewall and security features to apply to traffic between any networks or network objects.
New	Unique per-network policies	The new multinetworking features of ISA Server 2004 enable you to protect your network against internal and external security threats by limiting communication between clients even in your own organization. Multinetworking functionality supports sophisticated perimeter network scenarios, helping you to configure how clients in different networks access the perimeter network. Access policies between networks can then be based on the unique security zone represented by each network.
New	Routed and NAT network relationships	You can use ISA Server 2004 to define routing relationships between networks, depending on the type of access and communication required between the networks. In some cases, you may want more secure, less transparent communication between the networks. For these scenarios, you can define a NAT relationship. In other situations, you want to route traffic through ISA Server. In these cases, you can define a routed relationship. Packets moving between routed networks are fully exposed to ISA Server 2004 stateful filtering and inspection mechanisms.
New	Network templates	Includes five network templates that correspond to common network topologies. After you use one of the templates to configure firewall policy, ISA Server 2004 will automatically create the necessary firewall policy and network relationships.
New	Network Load Balancing (Enterprise Edition only)	Provides real-time failover and load balancing of connections made through an ISA Server 2004 Enterprise Edition array. Real-time failover enables high availability for enterprise arrays, while load balancing evenly distributes connections across firewall array servers to prevent network slow downs related to impacted firewalls.

Monitoring and Reporting

New or Improved	Feature	Description
New	Real-time monitoring of log entries	With ISA Server 2004, you can see firewall, Web Proxy, and SMTP Message Screener logs in real time. The monitoring console displays the log entries as they are recorded in the firewall's log file.
New	Built-in log query facility	You can query the log files by using the built-in log query facility. Logs can be queried for information contained in any field recorded in the logs. You can limit the scope of the query to a specific time frame. The results appear in the ISA Server 2004 console and can be copied to the Clipboard and pasted into another application for more detailed analysis.
New	Real-time monitoring and filtering of firewall sessions	You can view all active connections to the firewall. From a session view, you can sort or disconnect individual sessions or groups of sessions. In addition, you can filter the entries in the session's interface to focus on the sessions of interest using the built-in sessions filtering facility.
New	Connection Verifiers	You can verify connectivity by regularly monitoring connections to a specific computer or Uniform Resource Locator (URL) from the ISA Server 2004 computer using Connection Verifiers. You can configure which method to use to determine connectivity: Ping, Transmission Control Protocol (TCP) connected to a specific port, or HTTP GET. You can select which connection to monitor by specifying an IP address, computer name, or URL.
Improved	Customizing ISA Server 2004 reports	ISA Server 2004 includes an enhanced report customization feature for adding more information to the firewall reports.
New	Report publishing	You can configure ISA Server 2004 report jobs to automatically save a copy of a report to a local folder or network file share. The folder or file share the reports are saved in can be mapped to a Web site virtual directory so that other users can view the report. You can also manually publish reports that have not been configured to automatically publish after report creation.
New	E-mail notification after report creation	You can configure a report job to send you an e-mail message after a report job is completed.
New	Customized time for log summary creation	ISA Server 2004 is hard-coded to create log summaries at 12:30 A.M. Reports are based on information contained in log summaries. You can easily customize the time when ISA Server 2004 creates log summaries, giving you increased flexibility in determining the time of day reports are created.
Improved	Enhanced SQL Server logging	You can log to a computer running a SQL Server database located on another computer on the internal network. ISA Server 2004 SQL Server logging has been optimized to provide much higher performance.
New	Log to an MSDE database	Logs can now be stored in MSDE format. Logging to a local database enhances query speed and flexibility.

Management

New or Improved	Feature	Description
Improved	Management	ISA Server 2004 includes new management features, making it easier to secure your networks. New user interface features include Task Panes, Help Panes, an improved Getting Started Wizard, and a new look for the Firewall Policy Editor.
New	Export and import	ISA Server 2004 introduces the ability to export and import configuration information. You can use this feature to save configuration parameters to an .xml file, and then import the information from the file to another server.
New	Delegated permissions wizard for firewall administrator roles	The Administration Delegation Wizard helps you assign administrative roles to users and groups. These predefined roles delegate the level of administrative control users have over specified ISA Server 2004 services.
Improved	Centralized logging and reporting (Enterprise Edition only)	ISA Server 2004 logs and reports on traffic moving through all members of an enterprise array. There is never a need to collect log file information from each firewall and collate it to create unified report information.
New	Centralized storage of firewall policy (Enterprise Edition only)	ISA Server 2004 uses Active Directory Application Mode (ADAM) for firewall policy storage. ADAM storage enables you to place policy storage containers anywhere in the organization, allowing enhanced flexibility and availability for firewall policy redundancy and facilitated access.
Improved	Enterprise Policy (Enterprise Edition only)	Gain consistent control over security standards throughout your geographically diverse organization by setting security policies at the enterprise level, with application of array level and local policy, as appropriate.
New	Automatic array configuration (Enterprise Edition only)	Dynamically add new servers to your enterprise and arrays with a simple wizard. ISA Server automatically reads the ADAM database for configuration and policy details.
Improved	Administration Pack for Microsoft Operations Manager (MOM)	A newly-designed MOM pack for ISA Server 2004 enables enterprise-level event monitoring and consolidation of common firewall activities (available for separate download).

Fast and Secure Access

Secure Remote Access to Microsoft Servers

New or Improved	Feature	Description
New	Firewall generated forms for forms-based authentication	ISA Server 2004 can generate the forms used by Microsoft Outlook Web Access sites for forms-based authentication. This enhances security for remote access to Outlook Web Access sites by preventing unauthenticated users from contacting the Outlook Web Access server.
New	Remote access to Terminal Services using SSL	Computers running the Microsoft Windows Server 2003 operating system support RDP over SSL to allow secure SSL connection to Windows Server 2003 Terminal Services. With ISA Server 2004, you can securely publish your Terminal Server using secure SSL technology.

Virtual Private Networks

New or Improved	Feature	Description
Improved	VPN administration	ISA Server 2004 includes a more fully integrated VPN mechanism, which is based on the Windows Server 2003 and Windows 2000 Server functionality.
New	Stateful filtering and inspection for VPN	VPN clients are configured as a separate network zone. Therefore, you can create distinct policies for VPN clients. The firewall rule engine discriminately checks requests from VPN clients The engine statefully filters and inspects these requests and dynamically opens connections based on the access policy.
New	SecureNAT client support for VPN clients connected to ISA Server 2004 VPN server	ISA Server 2004 expands VPN client support by allowing SecureNAT clients to access the Internet without the firewall client being installed on the client system. You can also enhance corporate network security by forcing a user/group-based firewall policy on VPN SecureNAT clients.
New	Stateful filtering and inspection for communications moving through a site-to-site VPN tunnel	ISA Server 2004 introduces stateful filtering and inspection for all communications moving through a site-to-site VPN connection. As a result, you can control the resources that specific hosts or networks can access on the opposite side of the link. You can use User/group-based access policies to gain detailed control over resource use with the link.
New	VPN quarantine	ISA Server 2004 takes advantage of Windows Server 2003 VPN Quarantine tools for deep VPN client inspection and integration of your firewall policy.
New	Publishing VPN servers	Use ISA Server 2004 server publishing rules to publish IP protocols and PPTP servers. The ISA Server 2004 smart PPTP application filter performs the complex connection management. In addition, you can easily publish the Windows Server 2003 NAT-T L2TP/IPSec VPN server.
New	IPSec tunnel mode support for site-to-site VPN links	ISA Server 2004 improves site-to-site link support when using IPSec tunnel mode as the VPN protocol. IPSec tunnel mode support greatly increases ISA Server 2004 interoperability with an array of third-party VPN solutions.

Web Cache and Web Proxy

New or Improved	Feature	Description
Improved	Cache rules	With the centralized ISA Server Cache Rule mechanism, you can configure how objects stored in the cache are retrieved and served from the cache.
Improved	Path mapping for Web publishing rules	ISA Server 2004 significantly improves the flexibility of Web publishing because you can redirect the path sent to the firewall by the user to any path of choice on the published Web server.
New	RADIUS support for Web Proxy client authentication	With ISA Server 2004, you can authenticate users in Active Directory and other authentication databases by using RADIUS to query Active Directory. Web publishing rules can also use RADIUS to authenticate remote access connections.
New	Delegation of basic authentication	Published Web sites are protected from unauthenticated access by requiring the ISA Server 2004 firewall to authenticate the user before forwarding the connection to the published Web site. This prevents exploits from unauthenticated users from reaching the published Web server.
New	Preservation of source IP address in Web publishing rules	ISA Server 2004 gives you a choice on a per-rule basis whether the firewall should replace the original IP address with its own or forward the original IP address of the remote client to the Web server.
New	CARP-enabled Web caching arrays (Enterprise Edition only)	ISA Server 2004 Enterprise Edition Cache Array Routing Protocol (CARP)-enabled Web caching arrays significantly extend the bandwidth saving and performance-enhancing Web cache included in all versions of ISA Server 2004. Web caching arrays provide load balancing and failover for Web access from any Web browser.

[Topic Last Modified: 09/20/2007]