From ISA Server to Modern Reverse Proxies: The Evolution of Microsoft's Application Publishing Solutions

Summary: For over a decade, Microsoft's Internet Security and Acceleration (ISA) Server and later Forefront Threat Management Gateway (TMG) were widely deployed at the edge of corporate networks. They provided firewalling, reverse proxy services, web publishing, VPN access and application-aware security features that were particularly popular in Microsoft-centric environments.

Although TMG reached end-of-life many years ago, the architectural concepts behind it remain highly relevant. Modern reverse proxies, identity-aware gateways and Zero Trust access solutions have inherited many of the responsibilities once handled by ISA and TMG.

This article examines the history, evolution and eventual retirement of Microsoft's application publishing platforms, and explores the technologies that have replaced them.

Introduction

Every organisation faces the same challenge:

How can internal applications be made accessible to external users without exposing the internal network to unnecessary risk?

Today, administrators may reach for products such as Nginx, HAProxy, Cloudflare Tunnel, Web Application Proxy or Microsoft Entra Application Proxy. Twenty years ago, however, the answer was often Microsoft's Internet Security and Acceleration Server.

ISA Server and its successor, Forefront Threat Management Gateway (TMG), became staples of Microsoft infrastructure environments. They were particularly popular for publishing Exchange, SharePoint, Outlook Web Access, Remote Desktop Services and custom IIS applications.

While these products have long since disappeared, the problems they solved have not.

The Problem ISA Was Designed to Solve

The Early Internet Era

During the late 1990s and early 2000s, organisations increasingly needed to expose services to the Internet.

Common examples included:

• Corporate websites
• Webmail systems
• Partner portals
• Remote access solutions
• Intranet applications

At the same time, security concerns were growing rapidly.

Administrators needed a method of exposing selected services without placing internal servers directly on the Internet.

Beyond Traditional Firewalls

Traditional packet-filtering firewalls could permit or deny network traffic based on:

• Source address
• Destination address
• Port number
• Protocol

However, they lacked an understanding of the applications themselves.

Web traffic is not simply TCP port 80 or 443. Modern applications involve:

• Authentication
• Encrypted communications
• Session management
• URL routing
• Identity awareness

A new type of security device was required—one that understood applications rather than merely packets.

Microsoft Proxy Server

Origins

Before ISA Server existed, Microsoft offered Microsoft Proxy Server.

Released in the late 1990s, Proxy Server primarily focused on:

• Web caching
• Internet access control
• Basic proxy services

At the time, Internet bandwidth was expensive and often limited.

Caching frequently accessed web content significantly reduced external bandwidth usage.

Capabilities

Microsoft Proxy Server offered:

• Forward proxy services
• Web caching
• User access control
• Reporting and logging

For many organisations, this was their first exposure to proxy-based security architectures.

Limitations

As web applications became increasingly complex, Proxy Server struggled to keep pace.

Administrators required:

• Improved security controls
• Reverse proxy functionality
• VPN integration
• Application-aware publishing

The result was ISA Server.

Internet Security and Acceleration (ISA) Server

ISA Server 2000

Released as part of Microsoft's BackOffice family, ISA Server combined several previously separate technologies.

It provided:

• Firewall functionality
• Proxy services
• Web caching
• VPN services
• Application publishing

For many Microsoft-focused organisations, it became the primary Internet gateway.

ISA Server 2004

ISA Server 2004 represented a major architectural improvement.

New features included:

• Enhanced reverse proxy capabilities
• SSL bridging
• Improved authentication options
• Better logging and monitoring
• Granular publishing rules

This version significantly improved Microsoft's application publishing story.

ISA Server 2006

ISA Server 2006 refined the platform further.

It became especially popular for:

• Outlook Web Access
• Exchange publishing
• SharePoint publishing
• Remote access services

The management interface was widely praised for its clarity and consistency with other Microsoft management tools.

Why ISA Became So Popular

Several characteristics set ISA apart from competing products.

Exchange Publishing

ISA understood Microsoft Exchange exceptionally well.

Publishing Outlook Web Access became largely wizard-driven, reducing deployment complexity.

SSL Bridging

ISA could terminate, inspect and re-establish SSL connections.

This allowed:

• Security inspection
• Authentication
• Traffic filtering

without exposing backend systems directly to the Internet.

Integrated Authentication

ISA offered tight integration with:

• Active Directory
• Forms-Based Authentication
• Windows Authentication

Identity was becoming increasingly important.

Application Awareness

Unlike traditional firewalls, ISA understood HTTP and HTTPS traffic.

This enabled more intelligent publishing and security decisions.

Forefront Threat Management Gateway (TMG)

Microsoft's Security Vision

During the late 2000s Microsoft reorganised numerous security products under the Forefront brand.

ISA Server evolved into:

Forefront Threat Management Gateway (TMG)

TMG retained ISA's strengths while adding additional security capabilities.

New Features

TMG introduced:

• Enhanced malware inspection
• URL filtering
• Improved reporting
• Network inspection services
• Better HTTPS handling

Microsoft positioned TMG as a comprehensive edge security platform.

Strengths of TMG

TMG remained particularly valuable in environments running:

• Exchange Server
• SharePoint Server
• Office Communications Server
• Lync Server
• IIS Web Applications

Templates and publishing wizards simplified deployment considerably.

Why Administrators Loved It

TMG occupied a unique position within many infrastructures.

It combined:

• Firewall functionality
• Reverse proxying
• Authentication
• VPN services
• Application publishing

all within a single management console.

For administrators already comfortable with Windows Server and MMC-based tools, the learning curve was remarkably low.

The Beginning of the End

Changing Industry Trends

During the early 2010s, the industry began shifting toward:

• Cloud services
• Software-as-a-Service
• Federated identity
• Mobile access
• Zero Trust principles

Microsoft's strategic focus increasingly moved towards Azure and Microsoft 365.

The Forefront Retrenchment

Over time, several Forefront products were discontinued or repositioned.

TMG's development effectively ceased as Microsoft's security investments moved elsewhere.

End of Life

Mainstream support ended in 2015.

Many organisations continued running TMG for years afterwards, often because it "just worked."

Unfortunately, unsupported Internet-facing infrastructure eventually becomes a security liability.

Life After TMG

Web Application Proxy (WAP)

Microsoft introduced Web Application Proxy as part of Windows Server 2012 R2.

Rather than replacing every feature of TMG, WAP focused specifically on:

• Reverse proxying
• Application publishing
• AD FS integration
• Authentication

It represented a much narrower scope than TMG.

Strengths

• Microsoft-supported
• Integrated with AD FS
• Suitable for Exchange and SharePoint publishing
• Familiar Windows administration experience

Limitations

WAP is not a firewall.

It lacks many features formerly provided by ISA and TMG, including:

• URL filtering
• Malware inspection
• Forward proxy services
• Comprehensive edge security functions

Microsoft Entra Application Proxy

Microsoft's modern replacement strategy revolves around identity-centric access.

Entra Application Proxy enables internal applications to be securely published using outbound connectors.

Advantages include:

• No inbound firewall ports
• Multi-factor authentication
• Conditional Access
• Identity-aware access control
• Zero Trust alignment

This reflects a significant shift in architectural thinking.

Modern Alternatives

Nginx

Nginx has become one of the most widely deployed reverse proxies worldwide.

Common uses include:

• SSL termination
• Load balancing
• API gateways
• Application publishing

For many organisations, Nginx now fulfils the reverse-proxy role previously occupied by TMG.

HAProxy

HAProxy is renowned for:

• Performance
• Reliability
• Layer-7 routing
• Load balancing

It is frequently used in enterprise and cloud-scale environments.

Apache HTTP Server

Apache remains a capable reverse-proxy solution through modules such as:

• mod_proxy
• mod_ssl
• mod_rewrite

Kemp LoadMaster

Kemp LoadMaster became a particularly popular choice among former TMG administrators.

Features include:

• Reverse proxying
• Authentication integration
• SSL offloading
• Load balancing
• Application publishing

It is especially strong within Microsoft environments.

F5 BIG-IP

F5 appliances provide enterprise-grade:

• Reverse proxy services
• Web application firewall capabilities
• Authentication services
• Traffic management

Many large organisations migrated from TMG to F5 platforms.

Citrix NetScaler

NetScaler offers:

• Application delivery
• Remote access
• Reverse proxying
• Authentication services

It became another common TMG successor.

Cloudflare Tunnel

Cloud-native publishing solutions have grown increasingly popular.

Cloudflare Tunnel enables secure application publishing without exposing inbound services directly.

Microsoft Entra Application Proxy

For organisations heavily invested in Microsoft 365, Entra Application Proxy is often the most Microsoft-aligned modern solution.

Comparing Architectural Approaches

Capability	ISA/TMG	WAP	Nginx	Kemp	Entra App Proxy
Reverse Proxy	Yes	Yes	Yes	Yes	Yes
Pre-Authentication	Yes	Yes	Optional	Yes	Yes
SSL Offload	Yes	Yes	Yes	Yes	Managed by Service
Integrated Firewall	Yes	No	No	Limited	No
Identity-Aware Access	Limited	AD FS	Optional	Optional	Native
Zero Trust Alignment	No	Partial	Partial	Partial	Strong

Design Lessons from ISA and TMG

Security Has Moved Up the Stack

Traditional security models focused on network boundaries.

Modern architectures increasingly focus on:

• Users
• Devices
• Identities
• Applications

rather than simply IP addresses.

Identity Has Become the New Perimeter

TMG represented an early step toward identity-aware access.

Modern solutions have expanded this approach considerably.

Authentication, authorisation and conditional access now drive many security decisions that were once made at the network layer.

Application Awareness Matters

One of ISA's greatest strengths was its understanding of applications.

Modern reverse proxies continue this philosophy through:

• Layer-7 inspection
• API awareness
• Authentication integration
• Traffic routing intelligence

Technology First, Models Later

Administrators often remember ISA Server as a firewall product.

In reality, ISA and TMG reflected the practical needs of organisations at the time. Networks increasingly revolved around web applications, identity systems and encrypted communications.

Long before terms such as Zero Trust became popular, ISA and TMG were already applying application-aware and identity-aware concepts at the network edge.

The technologies came first.

The models and buzzwords arrived later.

Conclusion

Although ISA Server and Forefront TMG have been retired for many years, their influence remains visible throughout modern infrastructure design.

The products solved a genuine problem: providing secure access to internal applications while reducing exposure to risk.

Today's solutions may look different, but they continue the same evolutionary journey.

The path from Proxy Server to ISA, TMG, Web Application Proxy and modern identity-aware access platforms tells the story of a broader shift in security architecture—from protecting networks to protecting applications, identities and data.

Related Topics

• Reverse Proxy
• Web Application Proxy
• Microsoft Entra ID
• Zero Trust Architecture
• Load Balancing
• SSL Offloading
• Application Publishing
• Identity-Aware Proxy

References

• Microsoft ISA Server Documentation
• Microsoft Forefront TMG Documentation
• Microsoft Web Application Proxy Documentation
• Microsoft Entra Application Proxy Documentation
• Nginx Documentation
• HAProxy Documentation
• Kemp LoadMaster Documentation
• F5 BIG-IP Documentation
• Citrix NetScaler Documentation