An enterprise policy is a policy defined on the enterprise level that can be applied to arrays. The policy contains an ordered set of policy rules. An enterprise policy also contains a placeholder for where the array policy should appear within that enterprise policy's rules. For more information, see ISA Server Help.
This topic describes general policy considerations. For information about best practices for policy design, including tips on how to avoid policies that reduce the performance of ISA Server, see Best Practices Firewall Policy for ISA Server 2004 (www.microsoft.com).
When you create an enterprise policy, you create a policy that can be applied to more than one array in your enterprise. For example, you may have three arrays that handle VPN connections, six that handle publishing, and twelve for Internet access. You can create three enterprise policies:
-
Enterprise access policy for VPN arrays
-
Enterprise access policy for publishing arrays
-
Enterprise access policy for Internet access arrays
Each policy will contain the access rules that are appropriate for one type of array. You then apply the appropriate enterprise policy to each array, saving the effort of creating those parts of the policy on each array. Further, if a change is needed in policy, you will only have to make the change in three policies, rather than on each of 21 arrays.
.gif) Note: |
|---|
|
Enterprise policies can only include access rules. The enterprise policy for a publishing array can control access through that array, but the publishing rules must be created on the array level.
|
Enterprise policies and array-level policies allow you to differentiate between different levels of administrative authority in your enterprise. ISA Server flexibility in enterprise policy rule placement, either before or after array-level rules, also allows the enterprise administrator to create rules that are not necessarily enforced on the array level. In that case, the enterprise administrator can create rules to relieve the burden of creating the rules from the array-level administrator, but can still give the array administrator policy flexibility. The following are several examples of how enterprise and array policies work together.
No array administration allowed
Scenario: All responsibility for configuration of firewall policy is maintained at the enterprise level.
Responsibility: Enterprise administrator.
Policy: When you create enterprise policies, create all of the rules as pre-array rules, to prevent the creation of array-level rules that could affect policy. Also, the enterprise administrator can create arrays that are not allowed to create deny access rules, allow access rules, or publishing rules.
Enterprise-level restrictions
Scenario: You have a corporate policy that prohibits the use of a particular protocol, or access to certain Web sites.
Responsibility: Enterprise administrator. Array administrator to complete policy on array level.
Policy: In each enterprise policy you create, include rules that deny access on the restricted protocol or to the restricted URL set. Because this is a rule that must be enforced throughout the company, and you do not want it overridden by an array-level rule, the rule must appear in the pre-array rules.
Reduce array-level responsibilities
Scenario: The array-level administrators have several other functions, and you do not want them to spend time designing array-level policies for access issues that can be handled on the enterprise level. For example, your company allows access on Hypertext Transfer Protocol (HTTP), Secure Hypertext Transfer Protocol (HTTPS), and File Transfer Protocol (FTP), or allows access on certain protocols to specific sites or servers on the Internet.
Responsibility: Enterprise administrator. Array administrator to complete policy on array level.
Policy: In each enterprise policy you create, include rules that allow the required access. For access that is necessary throughout the enterprise, you do not want the rules overridden by an array-level rule, so they must appear in the pre-array rules. However, if there is some access that is not required, and there may be circumstances in which an array administrator may want to block access (for example, block FTP to conserve bandwidth), those rules should be placed in the post-array rules. The array administrator can create an array rule that will match requests before the enterprise rule is encountered, effectively overriding the enterprise-level rule.