ISA ncecessary for OWA?

[BADSBRD]

Is ISA a necessary component for OWA 2003? The front-end server will be placed in our DMZ behind our PIX. I believe that we only need to open 4 ports on our PIX going to the OWA server, and that we will only lose statefull packet inspection by not using ISA. Is this a huge issue?

Thanks,

Rick

 

[coco10]

isa is not a necesarry component for owa... you may dont need isa but its a good product not only for owa.

you only need to open https port to acces owa

coco10

 

[BADSBRD]

Thanks, thats what I thought, but wanted confirmation.

 

[NickFerrar]

ISA adds security beyond app-layer protection. With the frontend in your DMZ you're going to have to open a bunch of ports to your internal network for the FE server to talk to the BE + DCs. Having and ISA box sit on the DMZ with it's own connection to the internal network (assuming the ISA box is a member of the internal domain) adds a bit more protection. You can go further by having ISA in a workgroup or it's own forest and using RADIUS or trusts etc. but this needs more investment.
ISA's not vital but recommended if you have the budget for it, as coco10 said you can do a lot more than publish OWA through ISA to.

 

[BADSBRD]

So, I should setup ISA on the front-end server. Should I also put it on its own domain and create a one-way trust? If I go this route will I need an additional server? In the past I've run ISA and other apps on the same machine.

Thanks,

Rick

 

[coco10]

its higly recommend to use isa in a dedicated server.
in its own domain if you want to use user auth. you need to create a trust.

hope ist helps.
coco10