THE OFFICIAL BLOG OF THE SBS "DIVA"

My vote is for two nics. I have a cable and a high speed wireless connection coming into a SonicWall (with failover on the wan connections). From there I connect to a wireless router (for internal wireless connections - I make the users vpn in to the SBS server if they need internal resources, and the external nic on my server. The internal nic then connects to the switch for internal users wired connections.

I like having the sonicwall as it provides a first layer of protection plus allows for site to site hardware vpn connections. The ISA server is a nice second layer to deal with the things that I allow past the sonicwall.

I was really trying to work an Animal Farm joke in here, but I can't make it work.
Susan brings up a...

From my experience, I have usually found it easier to configure SBS with a single NIC and use an external firewall to protect a network. It _can_ make using the VPN wizard more difficult, but overall it seems to work well.

However there are exceptions.

For my business, when speaking with a customer who is thinking about SBS, the deciding factor between an external firewall and using ISA Server is how concerned the business owner is with monitoring and controlling the Internet content that their employees see.

Since ISA Server forces everyone to log into it in order to access the Internet, this allows for very accurate reports to be generated on individual web surfing habits. It also allows for the creation of content filters that can be used to filter out web sites that a business owner might find objectionable (e.g. adult entertainment sites).

The downside to running ISA with SBS is that it takes SBS's already tremendous memory requirements, and makes them even larger. When running SBS Premium with all of its bits installed and operating, my partners and try not to configure systems with any less than 2.5 Gb of memory. (Otherwise these systems page like mad, and this can translate into slow web surfing via ISA Server.)

So to sum up:

If the business owner doesn't really care about where people are going on the Internet and isn't concerned about monitoring usage -- I would recommend saving yourself some hassle and memory, and using a single NIC with an external firewall.

On the other hand, if the business owner wants tight control over their employees Internet habits, then in my opinion running ISA Server with two NICs the perfect way to go.

Easier to configure is no reason to choose single nic over two nics. Lack of knowledge on how to configure ISA only means that training is needed. ISA offers so much more than simply a measure of control over what end users are capable of seeing of the Internet. It's about security. It's all about securing SBS.

Regarding Sonicwall, when Blaster came out networks protected by sonicwall were vulernable if the port was open. Network protected by ISA weren't because ISA is smart enough to know the difference between legitimate traffic on a port and malformed traffic. It's take intelligence to fight the bad guys.

This is also posted <a href=http://addicted-to-it.blogspot.com/2005/07/re-okay-lets-duke-it-out-one-nic-or.html>on my blog</a>.

As an SBS consultant, your biggest responsibility is conveying risk. At the end of the day, it's your customer's decision, your customer's data, and your customer's business that is at risk. So if you're out there accepting risk on behalf of the customer, without informing them of key decisions, you're simply not doing your job.

1 NIC or 2? I think it depends on your customer. Look at their environment, look at the budget, and then try to balance the needs of the customer with the needs of your employer. Customers are brining you in to help navigate confusing decisions on their behalf, and at the same time are trusting you to keep them in the loop on decisions that can have a material impact to their business. Beyond that, your employer is in business to make money. You can't risk loosing customers because you don't want to implement a 1 NIC install that is "less secure". And you typically shouldn't look at new installs from a break-even perspective. In most SBS environments that I've worked in, there's just not allot of money to throw around on high-end hardware. If you can do a 2-NIC install on a better platform great! But if the choice is between a 2-NIC install, and you/your employer making money, you've got to make money first to stay in business.

So bottom line... Actively communicate risk to your customer, balance the needs of your employer with the needs of your customer, and always protect your profit margin. After you take care of those things, then you can worry about the details.