Welcome to ISAserver.org

Specifying an external IP to be used for outbound traffic

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA 2006 Firewall] >> General >> Specifying an external IP to be used for outbound traffic

Page: [1]

Message

<< Older Topic Newer Topic >>

Specifying an external IP to be used for outbound traffic - 25.Feb.2007 12:54:48 AM

jerrym

Posts: 2
Joined: 25.Feb.2007
Status: offline

I am new to the ISA Server and using forums so I apologize if this has already been addressed elsewhere but I could not find it.

I would like to configure ISA Server 2006 to send outbound SMTP traffic via a specific external IP address but I am not sure how.

The ISA Server will protect a few Exchange servers, each responsible for different email domains. Each domain is registered on the internet and their reverse lookup points to separate IPs, each on my external IP list. Unless I am mistaken, many organizations block email unless the reverse lookup of the email domain/IP can be verified.

It appears that by default ISA sends all outbound traffic via the first IP associated with the External network. That is fine for most traffic, but I need to specify that SMTP traffic from 'internal email server 1' goes out a particular IP associated with the External network. 'Internal email server 2' would use a different external IP.

Is this possible?

If it helps:

External Public IPs: x.x.x.1-x.x.x.14
Default outbound ISA traffic: x.x.x.1
Need outbound SMTP traffic from server1 to use x.x.x.4
Need outbound SMTP traffic from server2 to use x.x.x.5

I can do this with my current non-ISA firewall.

Thank you for your assistance.

Post #: 1

Featured Links*

RE: Specifying an external IP to be used for outbound t... - 25.Feb.2007 1:33:05 AM

elmajdal

Posts: 5103
Joined: 16.Sep.2004
From: Lebanese in Kuwait
Status: offline

Hi,

check this

quote:

when you have a NAT relationship from the Internal to the External network than all *outbound* traffic is sourced from the primary IP address assigned to the ISA external interface. This is by design and can *not* be changed in ISA 2000/2004/2006. The next version of ISA will have a more flexible NAT design.

Source : http://forums.isaserver.org/m_2002039398/mpage_1/key_/tm.htm#2002039398

HTH,
Tarek

_____________________________

Tarek Majdalani

MS Forefront Edge Security MVP
Website : http://www.elmajdal.net/ISAServer
New Section : http://www.elmajdal.net/Win2k8

(in reply to jerrym)

Post #: 2

RE: Specifying an external IP to be used for outbound t... - 25.Feb.2007 7:33:23 AM

ptlinva

Posts: 20
Joined: 16.Mar.2005
From: Rhoadesville, VA
Status: offline

I ran into this same issue.

Whenever a customer's colocated box would get flagged as a spamming server, it would block the IP address of our firewall and then the majority of our customers would have problems with thier mail just because of this one customer.

In the past, I would just move everyone over to a different IP address to get around the block temporarily. We do not promote or tolerate spam and our legitimate mail servers would still get flagged from time to time.

In all my research, there's no way to change that outgoing ip address.

Good Luck! If you find a way, be sure and let us konw.

Paul

(in reply to elmajdal)

Post #: 3

RE: Specifying an external IP to be used for outbound t... - 25.Feb.2007 2:07:39 PM

jerrym

Posts: 2
Joined: 25.Feb.2007
Status: offline

Thank you for your replies. It appears that this issue has been discussed at length and I just was not looking in the right place.

For now I will look into using a smart host per Thomas Shinder's posting - http://blogs.isaserver.org/shinder/2006/09/05/a-solution-to-the-static-nat-and-the-smtp-reverse-lookup-problem/

Hopefully, the next version of ISA will address this issue.

Thanks again.

(in reply to jerrym)

Post #: 4