I am trying to understand how DMZs and ISA function together.

I would love to implement a Back to Back DMZ installations, but don't have the resources, so I had to go with the 3 NIC DMZ.

I have a ISA server with 3 NICs
Nic 1 public IP Range (T1 Connection)
Nic 2 192.168.1.0 (Clients)
Nic 3 192.168.2.0 (DMZ) Servers

I would like to make sure the servers in the DMZ can see the clients in (192.168.1.0) and
vice versa.

Will the ISA server handle this routing for me? Do I need to configure the RRAS service in W2K with static routes? After reading a few posts on here I felt like I needed to configure RRAS. I tried this, but it doesn't work, and I feels its because of the ISA server.

From what I understand so far is that ISA will take of this routing after I publish the servers in the DMZ through ISA.

AM I missing something? Am I confused?
I would greatly appreciate any help on this matter. Thanks for your time and help.

For TOM:
I see that you are a great help to everyone on this site. Thank You!
I also ordered your book last week. I am waiting on Amazon to ship it.
I can't wait to receive it!

Thanks,

John

------------------
John Johnson
Nashville, TN

Thanks for buying the book!

For a trihomed DMZ, the DMZ segment must have private IP addresses; you can't use public IP addresses.

The reason for this is that the information moved between the Internet and the DMZ is routed by the ISA Server. ISA does not change any packet headers, and just routes the packets. If you use public addresess on the DMZ, ISA cannot route the packets, because they must be translated. This breaks the DMZ.

HTH,
Tom

------------------
Tom Shinder
http://www.isaserver.org/shinder/

Get It Here

According to another of your posts, the DMZ needs public addresses in order for the routing to work ?

Translation is for private addressing isn't it ?

Or is my understanding of this way off ?

E.

Good eye! That way a typo! Indeed, for the trihomed DMZ to work, the machines on the DMZ must have PUBLIC IP addresses.

Good job!

Tom

------------------
Tom Shinder
http://www.isaserver.org/shinder/

Get It Here