Welcome to ISAserver.org

Which external IP is used for the FW Client?

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2000 Firewall] >> Firewall Client >> Which external IP is used for the FW Client?

Page: [1]

Message

<< Older Topic Newer Topic >>

Which external IP is used for the FW Client? - 8.May2003 1:55:00 PM

wdekler

Posts: 64
Joined: 17.Sep.2002
Status: offline

I've been given access to a news server and they've restricted access by DNS. So I gave them the address ext.mycompany.nl which corresponds to the first external IP address of the ISA server.

This seems to work just fine from the server itself (packet filter for nntp & telnet session).
However, when I try to access the newsserver from the internal lan (192.168.*.*) it responds that I don't have access.

I'm curious what's going 'wrong' here... I'm using the fwclient, which is working fine and it shows newsreader traffic in the logs.

And I would expect this newsserver to only see the external ISA interface just the same as when using a packet filter.

This is clearly not the case, but I don't have access to this newsserver's logs so I can't see what's exactly happening here.

Any hints, suggestions?

thanks!

Wanne.

Post #: 1

Featured Links*

RE: Which external IP is used for the FW Client? - 8.May2003 9:37:00 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Wanne,

for outbound access the ISA should use the primary IP address on his external interface. I suggest you run a network monitor trace on the ISA external interface to find out what is really happening on the wire.

HTH,
Stefaan

(in reply to wdekler)

Post #: 2

RE: Which external IP is used for the FW Client? - 9.May2003 12:11:00 PM

wdekler

Posts: 64
Joined: 17.Sep.2002
Status: offline

Hi Stefaan,

I decided to give the news server manager a call... He gave me a web page to check for access.

The webpage displayed *.*.95.1 which is the primary external interface which has been granted access. No problem there... however, then I removed the proxy entry from Internet Explorer and accessed the page again.

Much to my surprise, the website now reports *.*.95.2 as the address being used! This explains why the access is denied but it's totally unclear why this happens? [Eek!]

I could ask them to change to the other address but I would really like to modify the firewall service to have it use the 95.1 number.

Is there a way to do this? I've checked the documentation but I don't see any option how you can change it.

thanks!

Wanne.

(in reply to wdekler)

Post #: 3

RE: Which external IP is used for the FW Client? - 9.May2003 10:12:00 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Wanne,

as far as I know, that shouldn't happen. So, there is to my knowledge no such configuration setting. How many IP addresses or assigned to your ISA external interface?

You said also "...displayed *.*.95.1 which is the primary external interface". Keep in mind that ISA server supports only one external interface, more precisely one default gateway.

HTH,
Stefaan

(in reply to wdekler)

Post #: 4

RE: Which external IP is used for the FW Client? - 12.May2003 9:30:00 AM

wdekler

Posts: 64
Joined: 17.Sep.2002
Status: offline

Hi Stefaan,

there are currently 4 ip numbers bound to the external interface (as you state, there's only one external interface).

If there's no setting, it's very strange that the FWservice started using 95.2 after a while (my newsserver access was working in the beginning).

Could it be a bug?

Wanne.

(in reply to wdekler)

Post #: 5