Possible to "upgrade" Windows Server 2003's firewall to the Server 2008 version?

[scauffiel]

As the title says, I have a network with both 2003 and 2008 servers, obviously the 2008 firewall is much improved over the '03 version. Anyone know of any way to upgrade the '03 version to the '08? Probably not possible, but figgered I'd ask around...

Any thoughts are appreciated,
Steve

 

[theevilsharpie]

Even if by some chance you manage to safely remove the 2003 firewall and put the 2008 firewall in its place, it would be a completely and totally unsupported configuration, and you risk having you modifications overwritten by security patches, likely resulting in a server that's unable to boot.

In other words, not possible.

 

[Nothinman]

Yea, this is one of those things that might be interesting to try to make work if you have a lot of free time to waste but nothing you'd want to do to a system you actually care about and want to work properly.

Firewalls on servers never made much sense to me anyway. You should have a good border firewall like an ASA protecting them inbound and there shouldn't be anything erroneous installed to make unwanted outbound connections, so what's the point?

 

[theevilsharpie]

Firewalls on servers never made much sense to me anyway. You should have a good border firewall like an ASA protecting them inbound and there shouldn't be anything erroneous installed to make unwanted outbound connections, so what's the point?

If the threat is coming from within the internal network, an ASA won't do jack shit. Not that they do much, anyway.

 

[Nothinman]

If the threat is coming from within the internal network, an ASA won't do jack shit. Not that they do much, anyway.

And if it's attacking a valid service on that server it won't do jack shit either because you've made it exempt. If you're running random services that you don't want exposed, internally or externally, you're asking for trouble.

 

[scauffiel]

Yeah, preeeeeeetty much what I thought too, but figured I'd ask anyway. 🙂

S.

 

[theevilsharpie]

And if it's attacking a valid service on that server it won't do jack shit either because you've made it exempt.

This is true if you're using a simple packet filter (e.g. Windows Firewall, Cisco ASA, etc.), but any firewall worth a shit will also have intrusion prevention functionality that will catch and block such attacks.

 

[Nothinman]

This is true if you're using a simple packet filter (e.g. Windows Firewall, Cisco ASA, etc.), but any firewall worth a shit will also have intrusion prevention functionality that will catch and block such attacks.

Maybe, there's a lot of other variables involved as well. But do you really put a hardware firewall between all of your internal users and their servers as well?

 

[theevilsharpie]

Maybe, there's a lot of other variables involved as well. But do you really put a hardware firewall between all of your internal users and their servers as well?

Some of the companies I work with that faces fines or other punishments for data leaks do, and with even mid-range firewalls able to filter at near line-speed these days, it's not that expensive anymore.

Other servers I manage that don't warrant that level of protection run a software firewall with IPS capability, like Symantec Endpoint Protection.

 

[VinylxScratches]

We don't have any firewalls on any of our windows servers or linux ones.