Re: Re[2]: Bypassing ISA Server 2004 with IPv6
On Sat, 15 Apr 2006, Thor (Hammer of God) wrote:
ISA Server is an application that is installed on top of the base OS. Are
you suggesting that the application should actually prevent the local
administrator of the host machine from installing and configuring what
protocols are bound to what adapters?
No, I'm suggesting that the application should enable the local
administrator to configure that application. Configuring a firewall
is a bit more than setting a domain name. It must contain some
(preferebly reasonable) filtering mechanisms.
From what is said so far this seems not to be possible. If that is
true, ISA is broken by design. We are talking about a firewall. A
firewall that cannot filter is not a firewall. Agreed?
To me, *that* is the borderline. There is no such thing as "for what ever
reason ipv6 in enabled on ISA" when it comes to administering an enterprise
firewall product. If an administrator installs configures ipv6 on the OS of
the firewall, and then binds ipv6 to a protected network segment, then they
absolutely, positively, without-a-doubt get exactly what they deserve.
Do you think the same applies to ipv4? I said "for what ever reason ipv6
in enabled on ISA" because I am definitely not in the position to guess
all possible reasons for activating ipv6.
Anyone who does that without understanding what they are doing are simply
taking jobs away from competent, knowledgeable administrators.
You are speaking out of my deepest heart. Anyhow, you are aware that
it is not always the incompentent admin; sometimes it is the incompetent
superior and not every admin has the nerv and the backing to say no
to idiotic orders by management.
The mindset of "protecting the ignorant administrator from themselves" in
this business has got to end. Positioning this as if there is some flaw in
Definitely.
ISA because the application does not prohibit a local administrator from
binding unsupported protocols to interfaces is simply ludicrous. In fact, it
I still fail to see why an unsupported protocol goes through anyway.
The reason for implementing a firewall is to separate networks with
different trust levels. Not to connect them wide open. For this any
router will do.
is the opposite that is true: If I as an administrator of a machine want to
bind a protocol to an adapter for some reason (as in a separate, private
segment for use in a particular environment) then I should, indeed MUST, be
able to do it. And I will be responsible for the implications of doing so.
Sure. But even in a protected enviroment you may want some additional
restrictions.
There was an earlier thread today where a simple list of hostnames being
filtered from the Win32 HOSTS file was positioned as "deliberate sabotage"
of our machines by Microsoft; a case of "It's my computer- keep your hands
off." Yet here, the integrity of a product is being challenged because the
application does not prevent an administrator from installing and binding
protocols at the OS-level in cases where the application is not designed to
filter those protocols? That is a double-standard at its best.
Again: If that application is a firewall it's a must to be able to
filter. Anything else is not logical.
If the application is some funny network gaming tool, then I heartly
agree.
Cheers,
Christine Kronberg.