So I decided to upgrade my primary firewall here at bmonday(dot)com to ISA2004. I've been running ISA2000 for a long time, and I've been really happy with it. But there were some new features available with 2004, so I figured I'd upgrade and check it out.
The installation went pretty smoothly until about halfway through my installation process it had a problem reading a file off my CD. So I ended up aborting the installation and copying the CD to the local disk before trying the installation again.
The abort seemed to go alright, it even said it was backing out all the changes. So I toyed with the suspect CD in another machine for a few minutes before deciding it was not going to work, and then I copied the binaries to the firewall's local disk and started up the installation again.
The first sign of trouble was when the ISA2004 installation program no longer recognized that I had ISA2000 installed. It no longer offered to upgrade me. “That's odd,” I told myself. So I thought maybe the installation program had forgotten to restart the services after I aborted the initial installation, and that was maybe the problem. So I go into the Program Files directory to look at Services and notice that my ISA program group is GONE.
WTF, mate?
Apparently, when I aborted the installation originally, it didn't bother to restore my original ISA2000. Instead, it left my “firewall” system completely exposed, while giving me this BS about “backing out changes”. For a half hour, while I dinked around with a bad CD, my main Internet gateway was sitting there with its pants down.
Now luckily, I have another firewall appliance sitting between my firewall and my Internet connection, so the exposure was minimal. But I shudder to think what would happen in this scenario for people who are relying on ISA to protect entire networks.
Silently remove the old firewall software, and then not restore it if the upgrade fails. There oughta be a law.