Welcome to ISAserver.org

The North and South Nic Card Approach

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2000 General] >> Installation >> The North and South Nic Card Approach

Page: [1]

Message

<< Older Topic Newer Topic >>

The North and South Nic Card Approach - 4.Feb.2003 2:35:00 AM

pbanks

Posts: 9
Joined: 2.Feb.2003
Status: offline

[LIST] Hi,

I read on the site about relating the external network as North and the internal network as South. I dug that approach. Now for my question using that analogy. I know the South network card has to have the internal IP scheme of non routable adresses (LAT). When I configure the North card which is the external card, what IP excactly do I get from my ISP? Is it the one on the router itself (216.237.x.x)? That is my Cisco router's address. I'm not sure what the Subnet is.

Or should the ISA server have a mapped IP address in the router, kind of like my web servers and Exchange Server with an Internet external address and a non-routable internal address, but it's mapped? Does that make sense? I can clarify if needed. Thanks.

[/LIST] Paul

Post #: 1

Featured Links*

RE: The North and South Nic Card Approach - 4.Feb.2003 2:58:00 AM

AHIT

Posts: 1561
Joined: 22.Jul.2002
From: Sydney, Australia
Status: offline

Hi there PBanks and greetings from down under, [Cool]

I can't say I've ever heard of 'north south' type terminology but it does sorta make sense.
Indeed your 'south card' needs to have what is a reserved IP address. The range is 10.x.x.x, 192.168.x.x amongst others. See RFC1918 for more info.
As far as tyour 'north card', it's gateway should be the IP address of your router's ethernet port. The IP of the north card itself should be another IP within that address/subnet range. IF you're unsre, try going to http://ws.arin.net/cgi-bin/whois.pl and enteringthe IP of your router - depending on the ISP, and if you have static address's, they may have entered details showing the subnet allocated to you. Or if you can, just jump of the router and it'll tell you.

I'm not sure I quite follow what you mean by mapped address' in your 2nd paragraph but hopefully the above will be of some help.

(in reply to pbanks)

Post #: 2

RE: The North and South Nic Card Approach - 4.Feb.2003 3:20:00 AM

pbanks

Posts: 9
Joined: 2.Feb.2003
Status: offline

Thanks Tolk,

What I mean by "mapped in the router" is: when running a web server, your ISP gives you let's say 8 static IP (Internet) addresses. That address is mapped to an Internal address inside(say a 192.x.x.x). That way when someone goes to www.blah.com, they hit the 216.x.x.x IP and it is mapped to an internal adddress, 192.x.x.x. It's sort of like a rule that's in a PGP e-ppliance firewall or like Publishing rules in ISA.

So say my router is 216.237.x.x from the Internet. Is that the IP that I give the external card on the ISA Server? Again, this is the setup.

The Internet is a T1 box. Then a RJ 45 goes out into a 2514 Cisco Router. Then from the router (NAT) to the switch where everyone can see the connection. I think the only place the ISA server can go is after the router and before the switch.

Does this make sense and do I give the ISA server external card the address at the router, the subnet of that address, and preferred DNS like where my sites are hosted on the ISP's server? WHEW!

(in reply to pbanks)

Post #: 3

RE: The North and South Nic Card Approach - 4.Feb.2003 8:48:00 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Paul,

a very good article how to set the ISA interfaces correctly is http://www.isaserver.org/tutorials/Configuring_ISA_Server_Interface_Settings.html .

In your case the design should look like:

code:

PCs/SERVERS --- [Switch] --- [ISA] --- [Router] --- Internet

The external interface should be on the same networkID (subnet) as the Cisco LAN interface. In any case, don't apply NAT in the Cisco router. ISA server will take care of that.

HTH,
Stefaan

(in reply to pbanks)

Post #: 4

RE: The North and South Nic Card Approach - 5.Feb.2003 12:28:00 AM

pbanks

Posts: 9
Joined: 2.Feb.2003
Status: offline

Thanks. I guess I'm a little confused because when I had a PGP e-ppliance firewall, it had an IP address of the internal network behind the router. See, I'm not sure if I use an Internet address or an internal address for the External card. It's kind of confusing. Could we do some offline chating. Thanks.

Paul

(in reply to pbanks)

Post #: 5

RE: The North and South Nic Card Approach - 5.Feb.2003 10:53:00 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Paul,

don't be confused! [Wink]

One of my major design rules is to avoid NAT as much as possible. ISA is already doing NAT by design. So, if you are owner of a public routable networkID (216.237.x.x/??), then there is no reason whatever why you should also do NAT in the Cisco router.

How many public routable IP addresses did you get from your ISP?

HTH,
Stefaan

(in reply to pbanks)

Post #: 6

RE: The North and South Nic Card Approach - 6.Feb.2003 3:40:00 PM

pbanks

Posts: 9
Joined: 2.Feb.2003
Status: offline

Thanks Stefaan,

I see why you have a 5 star rating. I have 8 public IP addresses. I should have plenty left. This is not made very clear in the information I've read on ISA. One thing I've noticed is that I needed to use a crossover cable from the router to the card. I probably didn't have the right IP information in the TCP/IP control panel. Another question. Should I have my ISP put a record of the ISA Server's name in DNS? And if it is a stand-alone server, do I have to run Active Directory on it?

Would the scenario play out like this?

North or external card:
IP address: LAN 192.168.0.47 WAN 216.237.220.195(from ISP)
Subnet: 255.255.255.0 (LAN subnet)
Defaut Gateway: 192.168.0.254 (Router address to Internet)

If this is correct, then I would set this ISA Server up as if it were a web server or an Exchange Server exposed to the Internet? Is this a correct assumption? Thanks for all your help.

Paul [Big Grin]

[ February 06, 2003, 03:43 PM: Message edited by: PBanks ]

(in reply to pbanks)

Post #: 7

RE: The North and South Nic Card Approach - 7.Feb.2003 8:15:00 PM

paulk

Posts: 22
Joined: 23.Jul.2001
From: Montreal, QC Canada
Status: offline

I think you are just confusing yourself with a lot of stuff you don't need.

I think what ppl are try to get at is:

Assume your router's address is 216.237.220.194 and you have 8 ip addrs, then

North or external card:
IP address: 216.237.220.195
Subnet: 255.255.255.248 (ie your router's subnet)
Defaut Gateway: 216.237.220.194 (Your router)

Effectively you turn off any routing and NAT functionality in your router.

Put another way, the only private ip addresses you use are south of your ISA box.

All your web, email, etc servers are also south of your ISA box but look to the outside world like they are at 216.237.220.195, so yes, your external DNS should show your www, MX etc as being at 216.237.220.195. You tell ISA how to route incoming requests to them using the "Publishing" section in ISA.

Of course, this is the very simpliest configuration - a better one would include the servers in a DMZ.

[ February 07, 2003, 08:20 PM: Message edited by: paulk ]

(in reply to pbanks)

Post #: 8

RE: The North and South Nic Card Approach - 8.Feb.2003 3:28:00 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Paul,

assuming you have 8 public routables IP's, 'paulk' is very right! The North or external interface of ISA *and* the Cisco router should be on the same public routable networkID.

HTH,
Stefaan

(in reply to pbanks)

Post #: 9

RE: The North and South Nic Card Approach - 8.Feb.2003 10:31:00 PM

pbanks

Posts: 9
Joined: 2.Feb.2003
Status: offline

Thanks guys. I'm going to try it this weekend. Have a good one.

Paul

(in reply to pbanks)

Post #: 10

RE: The North and South Nic Card Approach - 8.Feb.2003 10:45:00 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Paul,

good luck and if you have any further questions, don't hesitate to ask them in the forums. We will help as much as we can! [Smile]

Stefaan

(in reply to pbanks)

Post #: 11

RE: The North and South Nic Card Approach - 14.Feb.2003 5:02:00 AM

Bob O

Posts: 1
Joined: 13.Feb.2003
From: New Jersey
Status: offline

I have also read the article about the North South NIC Card configuation. The concern I have is that I am using SBS 2000 and ISA is already installed and it says that is running. I know it is not configured correctly. What steps should I take.

(in reply to pbanks)

Post #: 12