Recommended Network Card Configuration for ISA 2004/2006 Firewall Servers

A common question about ISA Server configuration by people on the forums is:

How should I configure the network interfaces on my ISA Server?

A high-level overview of NIC configuration best practice is provided below:

• The network card name used within the operating system should be changed to closely match the associated ISA Server network name. This clarifies assignment and improves supportability.
• Only one network interface should be configured with a default gateway.
• Only one network interface should be defined with DNS servers.
• Unused or unnecessary bindings should be removed from all interface, where possible, to improve security. This is often termed ‘interface hardening’.
• The default bind order should be amended to define a specific customised order.

Based upon these best practices, the configuration shown below is the standard approach that I normally use as part of my usual ISA Server build process.

Multiple NIC Deployment - ISA Server Standard Edition

Rename NICs:

Rename all NICs to descriptive names that ideally match the ISA Server network names.

Internal Network
Anonymous Access Perimeter Network
Authenticated Access Perimeter Network
External Network 
Etc.

By matching the names, this makes mapping networks between ISA Server and Windows much easier when troubleshooting…

Configure NICs: 

Internal Network

1. Default Gateway should not be defined
2. DNS Servers should be defined
3. Register this connection’s address in DNS – Enabled 
4. File and Print Sharing for Microsoft Networks – Disabled 
5. Client for Microsoft Networks – Enabled
6. NetBIOS over TCP/IP – Enabled
7. Show icon in notification area when connected – Enabled

Perimeter Network(s) 
1. Default Gateway should not be defined
2. DNS Servers should not be defined
3. Register this connection’s address in DNS – Disabled 
4. File and Print Sharing for Microsoft Networks – Disabled 
5. Client for Microsoft Networks – Disabled
6. NetBIOS over TCP/IP – Disabled
7. Show icon in notification area when connected – Enabled

External Network 
1. Default Gateway should be defined
2. DNS Servers should not be defined
3. Register this connection’s address in DNS – Disabled 
4. File and Print Sharing for Microsoft Networks – Disabled 
5. Client for Microsoft Networks – Disabled
6. NetBIOS over TCP/IP – Disabled
7. Show icon in notification area when connected - Enabled 

Please Note: Disabling the 'File and Print Sharing for Microsoft Networks' binding on the ISA Server internal interface will prevent you from connecting to shares on the ISA Server computer, irrespective of ISA Server system policy or other custom rules that may allow it. This approach is recommended for better security, as your firewall should not beaccessible as a file server!

Amend Bind Order: 

Edit the bind order as follows:

Internal Network (Highest)
Perimeter Network(s)
…Others…
External Network (Lowest)

Multiple NIC Deployment - ISA Server Enterprise Edition

With ISA Server Enterprise Edition, it is recommended to add a dedicated Intra-Array NIC. Therefore, we need to consider this additional interface in our configuration.

Rename NICs:

Rename all NICs to descriptive names that ideally match the ISA Server network names.

Internal Network
Intra-Array Network 
Anonymous Access Perimeter Network
Authenticated Access Perimeter Network
External Network
Etc.

Configure NICs:

Internal Network

1. Default Gateway should not be defined
2. DNS Servers should be defined
3. Register this connection’s address in DNS – Enabled 
4. File and Print Sharing for Microsoft Networks – Disabled 
5. Client for Microsoft Networks – Enabled
6. NetBIOS over TCP/IP – Enabled
7. Show icon in notification area when connected – Enabled

Intra-Array Network 
1. Default Gateway should not be defined
2. DNS Servers should not be defined
3. Register this connection’s address in DNS – Disabled
4. File and Print Sharing for Microsoft Networks – Enabled
5. Client for Microsoft Networks – Enabled NetBIOS over TCP/IP – Enabled
6. Show icon in notification area when connected – Enabled

Perimeter Network(s) 
1. Default Gateway should not be defined
2. DNS Servers should not be defined
3. Register this connection’s address in DNS – Disabled 
4. File and Print Sharing for Microsoft Networks – Disabled 
5. Client for Microsoft Networks – Disabled
6. NetBIOS over TCP/IP – Disabled
7. Show icon in notification area when connected – Enabled

External Network 
1. Default Gateway should be defined
2. DNS Servers should not be defined
3. Register this connection’s address in DNS – Disabled 
4. File and Print Sharing for Microsoft Networks – Disabled 
5. Client for Microsoft Networks – Disabled
6. NetBIOS over TCP/IP – Disabled
7. Show icon in notification area when connected – Enabled

Amend Bind Order: 

Edit the network bind order as follows:

Internal Network (Highest)
Intra-Array Network
Perimeter Network(s)
…Others…
External Network (Lowest)

Single NIC Deployment – ISA Server Standard Edition

For a single NIC deployment, the following actions are recommended.

Rename NICs:

Rename all NICs to descriptive names that ideally match the ISA Server network names.

Internal Network 

By matching the names, this makes mapping networks between ISA Server and Windows much easier when troubleshooting…

Configure NICs: 
Internal Network

1. Default Gateway should be defined
2. DNS Servers should be defined
3. Register this connection’s address in DNS – Enabled 
4. File and Print Sharing for Microsoft Networks – Disabled 
5. Client for Microsoft Networks – Enabled
6. NetBIOS over TCP/IP – Enabled
7. Show icon in notification area when connected – Enabled

Please Note: Disabling the 'File and Print Sharing for Microsoft Networks' binding on the ISA Server internal interface will prevent you from connecting to shares on the ISA Server computer, irrespective of ISA Server system policy or other custom rules that may allow it. This approach is recommended for better security, as your firewall should not beaccessible as a file server!

Single NIC Deployment – ISA Server Enterprise Edition

For a single NIC deployment, the following actions are recommended.

Rename NICs:

Rename all NICs to descriptive names that ideally match the ISA Server network names.

Internal Network
Intra-Array Network

By matching the names, this makes mapping networks between ISA Server and Windows much easier when troubleshooting…

Configure NICs: 
Internal Network

1. Default Gateway should be defined
2. DNS Servers should be defined
3. Register this connection’s address in DNS – Enabled 
4. File and Print Sharing for Microsoft Networks – Disabled 
5. Client for Microsoft Networks – Enabled
6. NetBIOS over TCP/IP – Enabled
7. Show icon in notification area when connected – Enabled

Intra-Array Network 
1. Default Gateway should not be defined
2. DNS Servers should not be defined
3. Register this connection’s address in DNS – Disabled
4. File and Print Sharing for Microsoft Networks – Enabled
5. Client for Microsoft Networks – Enabled NetBIOS over TCP/IP – Enabled
6. Show icon in notification area when connected – Enabled

Please Note: Disabling the 'File and Print Sharing for Microsoft Networks' binding on the ISA Server internal interface will prevent you from connecting to shares on the ISA Server computer, irrespective of ISA Server system policy or other custom rules that may allow it. This approach is recommended for better security, as your firewall should not beaccessible as a file server!

Amend Bind Order: 
Edit the network bind order as follows:

Internal Network (Highest)
Intra-Array Network

I hope this helps!

Original Source. Another Source.