The SQL server IS acting as a back-end to the Web site. With your suggestion, does the web app point to the ISA server address or the SQL server address as the location of the DB. Also, does the ISA server pass the SQL authentication to the SQL server?