Publishing Access Rules

ISA Server access rules determine how clients on a source network can access resources on a destination network. They are generally used to give internal computers protected by ISA Server access to resources on external networks, or to control traffic between the Internal network and servers located in a perimeter network.

ISA Server publishing rules are most often used to allow external clients to access resources protected by ISA Server. For example, you may allow public access from the Internet to a Web server published with a Web publishing rule, or allow external access to a specific server using server publishing rules. Server publishing in a NAT relationship hides the actual address of the published server (a SecureNAT client), so that the user requesting the object sees the IP address of the ISA Server computer rather than the private IP address of the internal server being published.

There are some circumstances in which you may consider giving internal clients access to resources in other networks by using a server publishing rule, rather than by means of an access rule permitting access using a specific protocol.

One common scenario is when you have a perimeter network defined, and you want to allow computers in the perimeter network to contact Internal network hosts, or to allow computers in the Internal network to contact hosts in the perimeter network. When choosing whether to use access rules or server publishing rules, consider the following:

• A server publishing rule can only publish a single server.
• Port translation can easily be performed with server publishing.
• Some built-in application filters, such as the Simple Mail Transfer Protocol (SMTP) filter are designed to work with server publishing rules, and not with access rules.
• In a NAT relationship, you cannot use an access rule to permit access to a computer if that computer is a SecureNAT client. In this scenario, you must use a server publishing rule. If there is a route relationship, an access rule will work.
• When using server publishing in a route relationship, the server publishing rule works like an access rule to allow access to the published server. Clients send requests directly to the IP address of the server being published, and not to the IP address of the ISA Server client-facing network interface.
• If you are using Network Load Balancing (NLB), use server publishing rules in preference to access rules. Server publishing rules allow correct load balancing of traffic to the published server.
• An access rule allowing Hypertext Transfer Protocol (HTTP) always uses NAT in both directions by default, even between networks with a route relationship.
• If you choose to configure a route relationship rather than NAT between two separate networks, there is no loss in functionality using server publishing rules. Filters (for example SMTP, POP3, or DNS) should work as they would for server publishing rules across networks with a NAT relationship. Note that the H.323 filter does not support server publishing.

In the scenario described, there may be either of the following relationships between the perimeter network and the Internal network:

• You have a route relationship between the perimeter network and the Internal network.
• You have a NAT relationship between the perimeter network and the Internal network.

The following table summarizes how the use of access rules or server publishing rules is affected in a NAT or route network relationship.