Microsoft Sharepoint Products and Technologies Resource Kit eBook

674 Part VIII: Securing SharePoint Products and Technologies
External
User
NLB
SharePoint Portal
Server Farm
Front-end
web server
Front-end
web server
F25XR01
Figure 25-1 SharePoint Portal Server deployment behind a firewall
On a simple level, firewalls perform packet filtering: when traffic comes to the
firewall, it compares the data in the Internet Protocol (IP) header with the preconfigured
rules to determine whether to allow or deny access. However, to protect
SharePoint Portal Server deployments from external attacks, it is also necessary to
check and verify the payload inside the HTTP header. A Microsoft Internet Security
and Acceleration (ISA) Server 2000 firewall is an application-layer firewall that, in
addition to packet filtering, provides the ability to examine the content contained in
the application-level protocols such as HTTP. Using ISA Server provides the ability
to publish portal sites to the Internet without compromising the security of your
internal network. In this chapter, we will look into issues you need to consider when
you configure ISA Server 2000 to protect the SharePoint Portal Server deployments
from unauthorized access.
ISA Server 2000 Web Publishing
Back-end
servers
When you set up the external ISA Server 2000 firewall, you first need to consider
how to use ISA Server 2000 Web publishing rules for making the internal SharePoint
site available for external users.
When a client on the Internet requests an object from a front-end Web server,
the request is actually sent to an IP address on the ISA Server computer. Web publishing
rules that are configured on the ISA Server computer forward the request, as
applicable, to the server running SharePoint Portal Server located behind the firewall.
The servers running SharePoint Portal Server require no special IP configuration.