FW_ClientOver

Microsoft Internet Security and Acceleration (ISA) Server 2006 uses various communication layers to protect the corporate network. At the packet layer, ISA Server implements a firewall policy. In this way, ISA Server controls data on the network interface, evaluating traffic before it reaches any resource. Data is allowed to pass only after the Microsoft Firewall service processes rules to determine whether the request will be serviced.

As illustrated in the figure, ISA Server protects three types of clients: Firewall clients, SecureNAT clients, and Web Proxy clients.

Firewall clients . Computers that have Firewall Client software installed and enabled. Requests from Firewall clients are directed to the Firewall service on the ISA Server computer, to determine whether access is allowed. Subsequently, they may be filtered by application filters and other add-ins. The Firewall service may also cache requested Web objects or serve Web objects from the ISA Server cache.

SecureNAT clients . Computers that do not have Firewall Client software installed. Requests from SecureNAT clients should be routed to ISA Server via the network routing infrastructure and default Internet routes. They are then directed to the network address translation (NAT) driver, which substitutes a global IP address that is valid on the Internet for the internal IP address of the SecureNAT client. The client request is then directed to the Firewall service to determine if access is allowed. Finally, the request may be filtered by application filters and other extensions. The Firewall service may also cache requested Web objects or serve Web objects from the ISA Server cache.

Web Proxy clients . CERN-compatible Web application. Requests from Web Proxy clients are directed to the Firewall service on the ISA Server computer, to determine if access is allowed. The Firewall service may also cache the requested object or serve the object from the ISA Server cache.

Regardless of client type, when ISA Server receives an HTTP request, the client is treated as if it is a Web Proxy client. Even when a Firewall client or a SecureNAT client makes an HTTP request, the client is considered a Web Proxy client. This has specific implications for how the client is authenticated.

Both Firewall client computers and SecureNAT client computers may also be Web Proxy clients. If the Web application on the computer is configured explicitly to use ISA Server, all Web requests are sent directly to the Firewall service, including HTTP, FTP, and HTTPS. All other requests are handled first by the Firewall service.

The following table compares the ISA Server clients.

For more information about clients, see "Internal Client Concepts in ISA Server 2006" at the Microsoft ISA Server TechCenter Web site (https://www.microsoft.com).