Tom once said to me that if you wanted to ruin his day right from the start, you can do one of two things:

• Ask him about unihomed “hork mode” ISA or TMG firewall deployments
• Ask him about workgroup ISA or TMG firewall deployments

Why are these questions depressing? Because when you deploy the firewall in hork mode or workgroup mode, you slash out, gut, destroy, hamstring, and otherwise break about 60-90% of the firewall’s functionality. And the worst thing about it is that the capabilities that are broken or destroyed by these deployments are some of the most important when it comes to securing the network.

However, sometimes you are forced to do things that you know aren’t right, and when that happens, you want to do the wrong thing as well as you can (that didn’t sound so right, did it?). Anyhow, if you want some very useful information on how to deploy the TMG firewall in a dreaded workgroup, then check out his series at:

http://blog.msedge.org.uk/2010/05/workgroup-deploy...g.html

http://blog.msedge.org.uk/2010/05/workgroup-deploy...8.html

http://blog.msedge.org.uk/2010/05/workgroup-deploy...9.html

Also, make it a point to let Jason know about how his approach using the Problems Steps Recorder works for you. I’d be interested as well!

HTH,

Deb

DEBRA LITTLEJOHN SHINDER
MVP (Enterprise Security)
“MS SECURITY”
dshinder@isaserver.org