How the Firewall Service Works

The Firewall client captures an API call and redirects it to the Firewall service, which makes the actual call. That is, there are actually two connections: one on the private network from the client to the ISA server and one over the Internet from the Internet host to the ISA server.

The Firewall service consists of two parts: a dynamic-link library (DLL) running on the Firewall client and a service running on the ISA Server computer.

When ISA Firewall client software is installed on the computer, it installs two .dll files. The files intercept Winsock API calls from applications on the client and forward them to the ISA Server computer by using a control channel.

The control channel manages remote Winsock messages, and is designed to do the following:

• Deliver the Local Address Table (LAT) to the client. The LAT determines whether a destination is on the local network.
• Establish TCP connections from the client to the ISA Server. This channel is used to build the virtual connection while attempting to connect with a remote application.
• Furnish UDP communications to and from the ISA Firewall client and with the ISA Server.

The ISA Firewall client .dll is initialized when the first Winsock connection is attempted. Then a control channel with the ISA Firewall service is established, and then designated as active through the channel. Finally, the LAT is copied from the server to determine which networks are on the Internet and which are local.

Note  The Firewall service of ISA Server makes use of a Windows Sockets 2.0 layered service provider (LSP) architecture. For more information on LSPs, see MSDN.