eXtreme. tech. : IAG

IAG runs ISA?

David Tesar — Fri, 01 Jun 2007 02:59:00 GMT

What is not obvious is the fact that the IAG appliance has the full edition of 2006 ISA standard edition running on it. I figured that I should do this as a follow up to my ISA vs IAG post - as I failed to mention it there. So why should I even buy ISA 2006 instead of IAG you might ask?

If you want any of the enhanced features for the enterprise version of ISA (NLB, Web farm publishing, shared configuration between multiple machines, etc)
As far as what I'm told, the cost for IAG is more than for a copy of ISA standard edition.
If you want to put the software on your own hardware instead of an appliance. IAG only can be purchased as an appliance currently.

I hope this helps. If there are other reasons, please feel free to comment.

Also, if this is the first post you're reading, please check out my post ISA 2006 versus IAG - Which one to use? which has more information and links to other sources.

Forefront IAG 2007 SP1

David Tesar — Thu, 31 May 2007 01:16:00 GMT

On May 21st, we announced IAG's SP1 - RTM expected around this August. I'll give a summary of the new features coming out with SP1:

Vista Client support

Details:

· Both online and offline installation / updates / removal of Download Manager

· Detection of multiple legacy client-security components

· SSL tunnel and session security with basic and socket forwarding

· Keyboard and mouse monitoring

· Network Connector functionality

· Added support for Forefront Client Security in endpoint security checks

Benefits:

· Attachment Wiper clears out IE images, cookies, history and auto-complete forms, plus private app-specific caches

ADFS enhancements

Details:

· SAML pre-authentication for all access

· Protected SAML-based access for users with federated trust relationships using granular, per-user policy

· DMZ-ready deployment (hardened appliance)

· Kerberos Constrained Delegation (KCD) support for SmartCard-only authentication

Benefits:

· Maintains SSO experience for users without needing direct server connections

· Web applications are not exposed

· Reduces TCO and increases security by eliminating need for a dedicated Federation Server Proxy

Performance

Detail:

· Enhanced regular expression handling

· Reduced buffer allocation / sizes

· Enhanced HTTP text string handling

Benefits:

· Reduced CPU consumption results in higher throughput

· Improved memory consumption

Internet Application Gateway (IAG) - Overview

David Tesar — Thu, 03 May 2007 02:59:00 GMT

Microsoft's Intelligent Application Gateway 2007 just released this February. It is a secure remote access gateway that provides SSL-based application access and protection.

So what are some of the cool things that IAG allows you to do?

NOTE: All of the items below you can do securely from an un-trusted network (such as the internet) while only requiring SSL (port 443) to be open to the IAG server and none require you to connect with a VPN connection. This means that you don’t have to worry about your internet connection allowing IPSec VPN traffic through. Many internet connections at coffee shops and hotels don't allow IPSec VPN traffic through...

1. Connect to internal websites and switch between them without having to re-input credentials
Microsoft has ~45: Any team sharepoint site, tar, hotfix, msexpense, itweb, autogroup, paystub, hrweb

2. Access non-web internal applications (such as file shares, Remote desktop)

3. Connect into an internal network with a full VPN connection

4. Execute various security checks for the client before allowing access to the application portal. These checks are highly-customizable via the GUI right out of the box. For instance, you can choose to only allow certain operating systems, check for the presence of anti-virus, etc.

Get started

General IAG learning:
Start an IAG virtual Lab (VS images w/ full functionality all done online)
Second IAG virtual Lab
Read some IAG White papers
Get a Product tour (Flash-based point-and-click)

ISA 2006 versus IAG - Which one to use?

David Tesar — Tue, 24 Apr 2007 05:02:00 GMT

If you read the only two places where ISA is compared to IAG, it doesn't really give a simple and clear comparison. I hope to do so now in this post. Please post comments if you find other comparison information out there.

The two comparisons I found are:
Secure Remote Access
IAG Frequently Asked Questions

(now updated) other comparison links from http://www.isaserver.org

Should You Get an ISA Firewall or the IAG 2007?
What's the ISA Firewall-based Microsoft IAG About?

To compare the two products, I am going to break it down into 3 major functionality categories: Forward Proxy, Reverse Proxy / Publishing, and VPN. Please keep in mind that you can run ISA and IAG independently or together in the same environment AND when you purchase IAG (you can only buy IAG via appliance vendors), it includes the standard edition of ISA.

Forward Proxy
This section is very simple to explain; IAG isn't a forward proxy at all. so if you need clients to get out to the internet through a proxy server you'll need to use ISA 2006. Along those lines, it also doesn't do web content caching for forward proxy or reverse. To learn more about ISA 2006's forward proxy and caching features, check out:
About ISA Server Clients
Caching and CARP in ISA Server 2006

Reverse Proxy / Publishing
This is where it gets tricky. Both ISA and IAG can securely publish resources, but the capabilities and ways it is done varies greatly between the two products. To compare the two it is easiest to break this down via a table. Of course, this isn't a comprehensive comparison - just some of the advantages that I see each product have over each other.

Publishing type:	ISA Advantages	IAG Advantages
Web Sharepoint OWA	· Can check service state of website (WPLB) · Can cache published content · Compression capabilities	· Can set granular access policies (User profiles, client validation – i.e. browser type, if running software, etc) · Client side cache clean-up and Attachment Wiper · Document upload/download policy controls · Portal makes it easier to switch between sites and applications
Exchange	· Supports RPC / RPC over HTTP for exchange server only · Supports secure publishing for SMTP traffic (port 25)	· Supports RPC / RPC over HTTP for any application or website. · Supports mobile device webpage support for portal and websites.
Non-HTTP(S) Apps	· Have to server publish the ports directly back to the server. More limited with amount of security granularity/control available compared to IAG. Exchange publishing does have more configuration/security than other non-HTTP(S) protocols. · Protocol inspection for some non-HTTP(S) protocols · Allows anonymous connections if desired	• Access to user's home directory and shared file folders using the built-in File Access application as a Web Part • Session management and security • Integrated Password Management • Supports almost any client-side application or server-side proxy • Policy based on endpoint profile • Application-specific session control • Seamless support of MS Office on the client, plus Web Services through host address translation and SharePoint-specific reroute actions • Can compute the MD5-hash of a client executable; only applications that match this hash are allowed push traffic through the SSL VPN tunnel

So what is my summary here? If you want real granular control over securely publishing your internal client applications - especially non-HTTP(s) ones, then IAG is definitely the way to go. It's great because even if the internal app your company uses is on a non-HTTP(s) port, a client can gain access through the stanadard 80 (HTTP) or 443 (HTTPS) ports that are open pretty much anywhere you're at that has internet access. The area where ISA wins with publishing is with Exchange (not OWA) and other applications that you would like to have open anonymous to the public (such as FTP and HTTP).

VPN
IAG is strictly a SSL VPN solution whereas ISA is only an IPSec VPN solution. The SSL VPN is nice because you can access anything on the internal network by only using the standard HTTPS port which will get around many internet connection issues. On the flip side, the IPSec VPN offers many more options with security.

Also, IAG does not have any site-to-site capabilites (SSL VPN tunnelling) and ISA does (IPSec VPN tunnelling). It's also worth noting that if you want to do any form of client-side checking with ISA this must all be done via custom scripting utilizing CMAK. IAG has a ton of pre-configured and customizable options for validating if the client is compliant (i.e. has AV that is installed and up to date, only certain OS or browser, etc).

Forefront IAG ISA Client Antigen Exchange Edge Security

David Tesar — Wed, 11 Apr 2007 03:04:00 GMT

Confused yet? I know that I was when I first started hearing this term Forefront... Is "Forefront" just a client/server security product or something else?

Forefront simply is a name that MS is branding onto our security related products. Forefront is divided into three categories of client, server, and edge security. Within those categories there are currently a total of 5 products.

Client:
1) Forefront Client Security - Comprehensive realtime protection against viruses, malware, and spyware

Server:
2) Forefront Security for Exchange Server - helps protect your mail server against Viruses, Worms, Spam, and Inappropriate Content. This is basically the "Antigen" for exchange product lines all combind into one for Exchange.
3) Forefront Security for Sharepoint - helps protect your sharepoint server against the latest threats, inappropriate content, and disclosure of confidential information.

Edge (a.k.a. "Edge Security and Access"):
4) Internet Security & Acceleration Server (ISA) 2006 - Application layer firewall and web proxy server.
5) Internet Application Gateway (IAG) - SSL remote access gateway. This can work with or independently from ISA to provide much more granular levels of access to published resources (file shares, applications, websites, etc). The easiest way to think about IAG is if you want to give people on an unprotected network granular and secure access to an internal resource without doing a IPSec/PPTP VPN, this will do the trick.

One thing that I think deserves a better and more simple explanation is the difference between ISA 2006 and IAG. I hope to publish another blog about this in the future. Please add a comment to this blog if you'd like me to write this up to spur me on...

The forefront overview which is linked on the forefront homepage does a decent job at explaining more about the differences, so I won't get into it in any more detail. I just wanted to clear that up for anyone who wanted to quickly understand this "forefront" area that we are throwing out there.