Many smaller organizations may wish to install a DHCP server on the ISA firewall itself. This allows smaller companies the ability to automatically assign IP addressing information to hosts on the corporate network without requiring them to install the DHCP server on a separate server on the corporate network. Many of these companies may have only one other Windows Server on their network, and that server is often a Windows domain controller. Because there are potential negative security implications of putting a DHCP server on a Windows domain controller, we consider placing the DHCP server on the ISA firewall a viable alternative.

The ISA firewall has a System Policy that enables the firewall itself to be a DHCP client. There are two System Policy Rules are listed in Table 6.1.

The DHCP System Policy Rules allow DHCP requests from the ISA firewall, and DHCP replies from the Internal Network to the ISA firewall. These rules won't help us when we want to run the DHCP server on the ISA firewall itself because we want to allow...