Enable IP Routing on ISA Server to Increase Performance

Internet Security and Acceleration (ISA) Server maintains secondary connections for secure network address translation (NAT) clients in Kernel mode, which can improve data throughput for protocols that use secondary connections. Secondary connections for secure NAT clients are only supported if an application filter that can process the protocol is installed on ISA Server.

For example, File Transfer Protocol (FTP) uses the secondary connection over port 20 to transfer data. Because the primary connection is enabled only if the requirements for all applicable rules are met, and the secondary connection is established only after the primary connection is established, there is no need to inspect the traffic for this connection.

To use this feature, enable Internet Protocol (IP) routing on ISA Server. This enables ISA Server to pump data for secondary connections in Kernel mode, which saves processing time and increases performance.

This functionality also requires that the application filter that processes the traffic be able to process Kernel-mode data pumping. All of the application filters that are provided with ISA Server support this feature.

You must enable IP packet filters before you can enable IP routing. This maintains the security that is provided by the firewall. Make sure that your custom IP packet filters do not allow unintended incoming traffic. To enable IP forwarding:

1. Start the ISA Management utility.
2. Open the array node whose behavior you want to change by clicking the array node's name.
3. Open the Access Policy node.
4. Right-click the IP Packet Filters folder, and then click Properties.
5. On the General tab, click to select the Enable Packet filtering and Enable IP routing check boxes.