What if I were to have multiple NIC's and multiple Networks defined within the ISA server. Bind all addresses to NICs other then "external" and essentially leave nothing on the NIC associated with the external zone?
The harder part then is that I have existing VPN tunnels which terminate on an existing firewall, these need access in to ISA also. Perhaps the External NIC on the ISA box just goes nowhere and all routes etc are out a "perimeter" network?
I'd really like to replace our layer-3 switch with the ISA box so I can easily do ACL's between the private subnets.
Maybe this is just asking for trouble and I should stick with keeping the ACL's on the L3 Switch (ugh, Dell switch ACL's) and leave ISA as a proxy/VPN only, rather then having it in line and protecting other networks.
Thanks Tom that is a good article. I am more interested in fig. 10 I think. We have some ipsec tunnels that terminate on the front end firewall and I would prefer not to NAT anything to them, it looks like I can define route relationships to networks within ISA even though they are part of the default external network?
With this, we will double NAT to the internet though right?
That's correct, sort of. When you define an ISA Firewall Network for a collection of addresses in front of an ISA firewall, it removes them from the default External Network.
Remember, the default External Network is defined as all IP addresses that are not used in the definition of any other ISA Firewall Network.
But you got it right -- you can create an ISA Firewall Network for that segment in front of the ISA firewall, and then create a ROUTE Network Rule between that Network and the Network behind the ISA firewall.