Microsoft Forefront Threat Management Gateway

» see microsoft.com/tmg as it lived, on the wayback machine

~ the goodbye ~

Most people met this product from the wrong side of it. You typed an address and the page did not load. What came back was a gray page in a system font telling you the request had been denied by policy. Somewhere in the building there was a Windows server doing that, and for about fifteen years the odds were good that the server was running some version of what eventually got named Forefront Threat Management Gateway.

It began as Microsoft Proxy Server, developed under the codename Catapult and shipped in late 1996 for Windows NT 4.0, with the lifecycle records dating general availability to January 1997. Version 1.0 was thin. It shared one internet connection with a LAN and cached what came back, and it had a clever trick for Novell shops: a WinSock translation client that let a browser on an IPX network reach the web with no TCP/IP on the wire at all. Version 2.0 followed in December 1997.

In 2000 it was renamed Internet Security and Acceleration Server, which is the name most administrators still use for it. The ISA years, from 2000 through 2006, were when this thing was simply the default: if a company ran Windows and had an internet connection, the edge of that network was very often an ISA box, sometimes bought preinstalled on OEM hardware as an appliance. One license gave you a firewall and a caching proxy in the same box, and it understood Exchange and SharePoint better than anything a network vendor could sell you.

Then Microsoft folded it into the Forefront security brand and shipped Forefront TMG 2010 on 1 December 2009. The brand was canceled three years after that. The TechNet post went up on 12 September 2012: no further development, and no more sales after 1 December 2012. Mainstream support ended on 14 April 2015 and the extended tail ran out on 14 April 2020, which is the last date on which this product officially existed.

I never administered one. I met it the way almost everyone met it, as the thing in the path, and you only ever learn a proxy's name on the day it tells you no. That is the strange shape of infrastructure software: it can be in front of millions of people for a decade and be recognized by almost none of them.

~ the chronicle ~

~ the lineage ~

Three names for one continuous product is unusual and it is the reason this death is hard to date. Proxy Server 1.0 and 2.0 aged out in 2002 and 2004. ISA Server 2000 reached end of life on 12 April 2011, by which point almost nobody was still running it. The Medium Business Edition that shipped inside Windows Essential Business Server lost mainstream support on 12 November 2013. Every one of those is a small ending, and none of them is the ending.

The real one is the September 2012 announcement, because that is when Microsoft said out loud that it was not building this anymore. What made it notable at the time was the absence of a migration path. Forefront Endpoint Protection went to System Center and Forefront Identity Manager survived under a new name, but the gateway had no successor product to point at. Customers were told to look at third parties or at what would eventually become Azure Application Proxy.

~ the next chapter ~

The category did not die, it moved. Everything TMG did at the edge of a building is now sold as a service somewhere else: reverse proxy and pre-authentication went to cloud identity products, and web filtering became a subscription from a security vendor with points of presence in fifty cities. Nobody buys a license and racks a server for this in 2026.

What went with it was the idea that a company's internet boundary was a physical place you could walk to. TMG was the last widely deployed Microsoft product built on that assumption, and it stopped being sold in the same window that Office 365 was teaching everyone the boundary had moved. A firewall that lives in a rack cannot protect a laptop in a cafe, and by 2012 the laptop in the cafe was the whole problem.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »