The ISA Firewall’s Default Post Installation System Policy and Configuration

The table below shows the list of System Policy rules and their status after installing the ISA firewall software. The Order/Comments column includes our advice regarding configuration of the specific System Policy Rule.

LDAP (UDP)

LDAP GC (global catalog)

LDAPS

LDAPS GC (Global Catalog)

If no one is going to use the remote MMC to manage the ISA firewall, then disable this rule.

NetBIOS datagram

NetBIOS Name Service

NetBIOS Session

RPC (all interfaces)

Confirm that the Remote Management Computers Computer Set has the addresses of the hosts that will manage the ISA firewall; if you don’t want to allow RDP management of the ISA firewall, then disable this rule.

Enable this rule if you want to log to SQL servers

NetBIOS Name Service

NetBIOS Session

Will you be using RADIUS authentication? If not, then disable this rule.

RADIUS Accounting

Will the ISA firewall be authenticating users? If not, then disable this rule

Kerberos-Sec (UDP)

This rule must be enabled so that the ISA firewall can initiate DNS queries

If the ISA firewall isn’t going to act as a DHCP client, then disable this rule

If the ISA firewall isn’t going to act as a DHCP client, then disable this rule

Confirm that you have configured the proper IP addresses for the Remote Management Computers Computer Set

This rule must be enabled so that the ISA firewall can carry out network management tasks via ICMP

ICMP Timestamp

Ping

This rule is automatically enabled when you enable the ISA firewall’s VPN server component

This rule is automatically enabled when you enable a site to site VPN connection to this ISA firewall

IPSec Remote Gateways

This rule is automatically enabled when you enable a site to site VPN connection to this ISA firewall

IPSec Remote Gateways

Will you be trying to access file shares from the ISA firewall? If not, then disable this rule

Microsoft CIFS (UDP)

Enable this rule when you choose SQL logging

Microsoft SQL (UDP)

Unless you want to allow the ISA firewall to contact the Windows Update site itself, then I would disable this rule. I prefer to download updates to a management machine, scan them, and then copy them out of band to the ISA firewall and install them from that.

HTTPS

This rule is enabled when you create an HTTP/HTTPS connectivity verifier

HTTPS

This rule is enabled if the Firewall client share is installed on the ISA firewall

Microsoft CIFS (UDP)

NetBIOS Datagram

NetBIOS Name Service

NetBIOS Session

Enable this rule if you want to perform remote performance monitoring of ISA firewall

NetBIOS Name Service

NetBIOS Session

Unless you plan to access file shares from the ISA firewall, you should disable this rule

NetBIOS Name Service

NetBIOS Sessions

Unless you plan to use RPC to connect to other servers, then you should disable this rule.

This rule allows the ISA firewall to send error reports to Microsoft

HTTPS

This rule should be enabled if SecurID authentication is enabled

Enable this rule if you use MOM to monitor the ISA firewall

This rule should be enabled if you want the ISA firewall to access CRLs – required if the ISA terminates any SSL connections

You should change this rule by allowing contact with a trusted NTP server in your organization. The Internal entry allows it to contact all servers anywhere in the world

If you don’t plan on use SMTP to send alerts, you should disable this rule. If you do plan on sending SMTP alerts, then you should replace the Internal Destination with a specific computer that will accept the SMTP messages from the ISA firewall

This rule is automatically enabled when Content Download Jobs are enabled

Unless you plan on using the remote MMC, then you should disable this rule

The ISA firewall’s System Policy Rules are evaluated before any user defined Access Rules in the order listed in the Firewall Policy first column. View the ISA firewall’s System Policy by clicking the Firewall Policy node in the left pane of the console and then clicking the Tasks tab. In the Tasks tab, click the Show System Policy Rules link. Click the Hide System Policy Rules link when you’re done viewing the firewall’s system policy.

You can edit the ISA firewall’s System Policy by clicking the Edit System Policy link on the Tasks tab. This opens the System Policy Editor, as shown in Figure 6.12. For each System Policy Rule there is a General tab and a From or To tab. The General tab for each Configuration Group contains an explanation for the rule(s) and the From or To tab allows you to control protocol access to or from the ISA firewall machine itself.

The table below shows the default post installation configuration of the ISA firewall

In this article we went over the default post-installation System Policy and provided some guidance on how to reconfigure the system policy based on your own network environment. Its important to keep in mind that the ISA firewall’s System Policy only controls traffic originating from the ISA firewall itself, or terminating at the ISA firewall itself. The System Policy never controls traffic moving through the ISA firewall.