Welcome to ISAserver.org

Subnet Routing Issues

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA 2006 Firewall] >> Network Infrastructure >> Subnet Routing Issues

Page: [1]

Message

<< Older Topic Newer Topic >>

Subnet Routing Issues - 17.Oct.2007 2:03:09 AM

JasonFeusner

Posts: 10
Joined: 11.Sep.2007
Status: offline

Network layout is:
192.168.16.1 - Server 1 DNS - Active Directory - Domain Controler
192.168.16.2 - Server 2
192.168.16.3 - Server 3
192.168.16.4 - Server 4
192.168.16.5 - Server 5 (ISA 2006) 2nd nic connected to T1 internet
192.168.16.6 - Server 6
192.168.16.7 - Server 7
192.168.16.8 - Server 8
192.168.16.9 - Server 9
192.168.16.15 - Cisco 1700 connected to Point to Point remote office 192.168.3.0 -255.255.255.0

All clients on 192.168.16.0 subnet can access all servers and internet via ISA server, The issue is when any client at the remote offce tries to access any server in the corporate office, the packet seems to be getting to the servers but not returned from the servers. I have set a route in isa (route add 192.168.3.0 Mask 255.255.255.0 192.168.16.15 -p) it in itself did not solve the problem but i tried adding the same route to each individual server and it seemed to solve the problem. By adding the routes to each server all i am doing is bypassing the isa server, I know this work around is not correct and would like to solve this before i convert the other remote offices from vpns to point to points.

Thank you
Jason.

Post #: 1

Featured Links*

RE: Subnet Routing Issues - 17.Oct.2007 9:34:41 AM

justmee

Posts: 505
Joined: 14.May2007
Status: offline

Hi Jason,
If I correctly understand this:
ISA's Internal interface is connected to 192.168.16.0/24?
And its internal interface IP address is 192.168.16.5?
Therefore ISA Internal Network definition is 192.168.16.0/24 meaning ISA is directly connected to this subnet.
And you have on ISA's Internal network a Cisco router 192.168.16.15. This router is connected to subnet 192.168.3.0/24.
You have added on ISA a route: route add 192.168.3.0 Mask 255.255.255.0 192.168.16.15 -p.
This is not enough. You need to add subnet 192.168.3.0/24 to ISA's Internal Network definition.
And it will work just fine.
I have assumed that clients on 192.168.16.0/24 have set as their default gateway ISA's IP address from its internal NIC(192.168.16.5).
Regards!

< Message edited by justmee -- 20.Oct.2007 7:44:06 AM >

(in reply to JasonFeusner)

Post #: 2

RE: Subnet Routing Issues - 17.Oct.2007 1:29:20 PM

JasonFeusner

Posts: 10
Joined: 11.Sep.2007
Status: offline

Thanks for the reply.
Yes, you are right on the network layout.
I read the document and I had everything setup correctly, The problem has never been with pinging. It seems when any requests, RDP, HTTP, HTTPS, ect are sent to the servers the packet gets to the server but some where on the return route it gets hung up at the ISA server.

(in reply to justmee)

Post #: 3

RE: Subnet Routing Issues - 18.Oct.2007 4:55:13 AM

justmee

Posts: 505
Joined: 14.May2007
Status: offline

And is still not working.
What I can say is that I quite think I know about what you are talking.
If you take a look at ISA's live logging you will see your packets being dropped by ISA from Internal to Internal.
I saw this once on a network behind network scenario.
Don't know why is that.
Even more weird if you create a rule from Internal to Internal(which is plain stupid) it will start working, at least in my case did.
I solved this by a new frew install.
Something is fishy but I do not know what.
For people who think I have f*****-up ISA configuration, well I did not, the config was the same on both installs(if they believe me or not, guess what: I do not care).
I know this won't help you solving your problem. Sorry.

(in reply to JasonFeusner)

Post #: 4

RE: Subnet Routing Issues - 18.Oct.2007 12:24:21 PM

JasonFeusner

Posts: 10
Joined: 11.Sep.2007
Status: offline

Ok...
That was the dumbest fix that i have every used with ISA, but it worked. It must be a bug in ISA. I would have never thought to try that!!

Thanks again.. It worked!

(in reply to justmee)

Post #: 5