Control Access
• Flexible application-intelligent SSL VPN from virtually any device or location.
• Differentiated and policy-driven access to a broad range of network, server and data resources.
• Highly granular access and security policy.
• Customizable, identity-based Web portal experience.
Protect Assets
• Integration with enterprise infrastructure helps ensure the integrity and safety of network resources and applications.
• Adaptable Web application firewall enforces app-specific filtering to protect applications from unmanaged PCs and networks.
• Extensive monitoring and logging helps drive policy compliance by tracking user activity and data usage. Safeguard Information
• Strong endpoint security management and verification helps ensure endpoint health compliance and session control.
• More granular control at the browser over users’ access to Web and non-Web resources.
• Helps meet corporate information usage guidelines through client-side cache cleanup.
Application Optimizers [More Info]
The WSA includes multiple Intelligent Application Optimizers, integrated software modules with pre-configured settings designed for secure remote access to widely used business applications. Optimizers enable endpoint security, application publishing and server request filtering for default values on a per-application basis to help ensure a flexible balance between achieving business objectives and enforcing network and data security. Included are customized granular access policy and security capabilities for Microsoft Exchange Server and SharePoint® Portal Server, as well as for many third-party business applications such as SAP, IBM Domino and Lotus Notes.
Connectivity Modules
Client/Server Connector
The Client/Server Connector provides out-of-the-box secure access to business critical client/servers applications including Microsoft Exchange, Lotus Notes native client, Citrix, Microsoft Terminal Services, FTP and Telnet while allowing straightforward configuration for any additional client/server application through a generic application definition tool.
Tunneling modes
• Port Forwarding: The client component listens on a specific local address and port and causes the application to send the TCP traffic to this address rather than to the real application server’s IP address. The SSL VPN client then encapsulates the intercepted traffic within SSL and sends it to the gateway. This mode functions optimally for applications using static TCP ports, or with applications supporting an HTTP or SOCKS proxy.
• Socket Forwarding: The client component hooks into the Microsoft Winsock Service Provider interface. It uses Windows Layered Service Provider/Name Space Provider (LSP/NSP) interfaces and provides low-level socket handling. The NSP is used to resolve internal server names to ensure they will be tunneled. It provides full support for all Winsock applications – TCP and dynamic ports.
Network Connector
The Network Connector allows administrators to install, run and manage remote connections that give users full network-layer connectivity over a virtual and security-enabled transparent connection and give users the same functionality they would have if they were connected the corporate network.
• The Network Connector Module provides external users with a local IP address as if they are on the network, allowing for remote access to corporate servers and complex systems such as file shares and internal databases over secure network layer connection (shared folders).
• The Network Connector Module tunnels almost any IP-based protocol, enabling support for Voice over IP (VoIP).
• The Network Connector’s ability to implement a direct connection to departmental servers based on user identity, rather than mandating a fully open network-layer connection for all users through the SSL VPN gateway directly to the LAN, delivers significant security benefits.
• Provides administrators with the options of launching the connection immediately after user login using a predefined script, following compliance check, or on demand by the user by clicking the Network Connector icon on the portal page once authorized.
Best of Both Worlds
Integrated with ISA Server 2006, WSA delivers a single, consolidated appliance for network perimeter defense, remote access and application-layer protection over both SSL and IPsec connections, providing businesses with a broader set of choices for their remote access requirements. Integration of SSL VPN into existing Microsoft infrastructure supports secure access to both Microsoft and non-Microsoft applications and services from a single appliance. The WSA appliance features a new streamlined and cost effective design that can help lower cost of ownership and removes the need for multiple devices from multiple vendors for different access methods. Your corporate IT group can adopt a consolidated security appliance solution that is flexible and easy to deploy.
Securing the Perimeter
ISA Server, combined with the Intelligent Application Gateway, serves the need for network separation and full control of inbound and outbound content and adds significant edge security functionality to address a broad range of Internet threats. The consolidated appliance provides a flexible software-driven solution that is responsive to the need for performance, management and scalability in addition to comprehensive security. The blending of stateful packet filtering, circuit filtering, application-layer filtering, Web proxy, and endpoint security into a single appliance affords the administrator a variety of options for configuring policy-driven access to applications and network resources. ISA Server delivers the ability to filter traffic rather than rely on a mechanistic solution, providing three types of firewall functionality: packet filtering (also called circuit-layer), stateful filtering, and application-layer filtering. The ability to apply rule-based filtering to all traffic that traverses the network boundary enables the combined solution to directly address threats such as worms or malware that may originate from authenticated users. |
