Welcome to ISAserver.org

Problems with communication DMZ and Internal

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2004 Firewall] >> DMZ >> Problems with communication DMZ and Internal

Page: [1]

Message

<< Older Topic Newer Topic >>

Problems with communication DMZ and Internal - 17.Feb.2006 3:19:53 AM

MikeRM2

Posts: 47
Joined: 13.Aug.2003
From: Virginia Beach, VA
Status: offline

Hello,
I am having a problem with ISA Server 2004. I have set up my network to include a DMZ, but I have no communication between the perimeter server and the main servers. I have 4 servers running, Server 1 runs the domain with AD, DNS, DHCP, DFS, and the Print Server. Server 2 also runs AD, SQL, DNS. These are both on the internal domain (192.168.0.x). Server 3 is my ISA Server, it is a tri-homed server with the following NIC connections, External (10.0.0.x), Perimeter (172.16.0.x), and Internal (192.168.0.x). The only thing running on this server is ISA. Server 4 is my perimeter server on the perimeter network (172.16.0.x), it runs my web server, Exchange, and is setup to be my backup server. All Internal and Perimeter NICs have the gateway of the ISA Server, on their respective IP addresses. My ISA server is set up with the following network rules: Perimeter - External, Perimeter (Source) External (Destination), Route; Perimeter - Internal, Internal (Source) Perimeter (Destination) Route; Internal - External NAT. It also contains the following access rules: DNS Perimeter to Internal Publishing Rule, Server 1 to Perimeter network with DNS Server protocol open; DNS Internal to External, Server 1 to Perimeter with DNS Server protocol open; Outbound DNS Internal DNS Server, Allow DNS protocol, Server 1 (Source), External (Destination); Inbound to Perimeter Web Server, Allow HTTP / HTTPS, External (Source), Server 4 (Destination); Inbound to Perimeter SMTP Server, Allow SMTP / SMTPS, External (Source), Server 4 (Destination); Internal to Perimeter communication, Allow ADLogon/DirRep / DirectHost (TCP 445) / DNS / Kerberos-Adm (UDP) / Kerberos-Sec (TCP) / Kerberos-Sec (UDP) / LDAP (TCP) / LDAP (UDP) / LDAP GC / RPC Endpoint Mapper (TCP 135) / NTP / Ping, Server 4 (Source), Server 1 (Destination). On all internal NIC and Perimeter NICs, NETBios has been enabled, it is disabled on the External NIC. I have been able to log Server 4 onto the Internal domain, and it has been added to AD and the DNS server. All the addresses are correct. I have done a nslookup of external websites from server 4 and they produce the correct information. Now I am unable to ping any websites from Server 4, it gives Destination Host Unreachable. I can ping any of the internal servers or client computers. I have looked in Network places and am unable to see Server 4 from the Internal servers, including the ISA server. Also I am unable to see any other server from Server 4. I am unable to activate or update Server 4, due to it's lack of connectivity. I am wondering what I have missed in my setup? I would appreciate any help.

Thank you

Post #: 1

Featured Links*

RE: Problems with communication DMZ and Internal - 20.Feb.2006 3:56:37 PM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Mike,

TMI!

Can you break it down for us?

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to MikeRM2)

Post #: 2

RE: Problems with communication DMZ and Internal - 20.Feb.2006 5:30:17 PM

MikeRM2

Posts: 47
Joined: 13.Aug.2003
From: Virginia Beach, VA
Status: offline

Alright, I'll see if I can break this down a bit:

                                                       Internet
                                                            |
                                                            |(10.0.0.X)
                                                       ISA Server ---------------Perimeter Server (172.16.0.X)
                                                            |
                                                            |
                                                            |
                                                            |
                                                       Internal Network (192.168.0.X)

Now I set up the rules as outlined in Chapt. 7 of ISA Server 2004 for Intradomain communication. I can log on from my perimeter server to the domain, and it registered with DNS as 172.16.0.X which is correct. But I am unable to see the perimeter server otherwise. I have no internet access on the perimeter server, and tried to publish updates through WSUS to the perimeter server to no avail. Basically, other than the AD login communication, I have no contact with the perimeter server. Hopefully this helps a little.

(in reply to MikeRM2)

Post #: 3

RE: Problems with communication DMZ and Internal - 26.Feb.2006 7:53:19 PM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Mike,

OK, what rules do you have in place to allow the communications that should be working but are not working?

Have you created all the required Network Rules?

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to MikeRM2)

Post #: 4

RE: Problems with communication DMZ and Internal - 28.Feb.2006 5:01:30 PM

elmajdal

Posts: 6022
Joined: 16.Sep.2004
From: Lebanese in Kuwait
Status: offline

have you doubled check your configuartion with this article :

Allowing Intradomain Communications through the ISA Firewall (2004)

http://www.isaserver.org/articles/2004perimeterdomain.html

_____________________________

Tarek Majdalani

Windows Expert - IT Pro MVP
Facebook : https://www.facebook.com/ElMajdal.Net

(in reply to MikeRM2)

Post #: 5

RE: Problems with communication DMZ and Internal - 21.Mar.2006 3:21:27 PM

MikeRM2

Posts: 47
Joined: 13.Aug.2003
From: Virginia Beach, VA
Status: offline

Ok Tom,

Sorry it has been so long, I have been away. But I am not sure what rules I have in place that are not working. I have 9 Firewall policy rules in place, and 5 network rules in place. I set most of them up following your book. I am just not sure where I went wrong, they should be working.

(in reply to tshinder)

Post #: 6

RE: Problems with communication DMZ and Internal - 21.Mar.2006 3:22:10 PM

MikeRM2

Posts: 47
Joined: 13.Aug.2003
From: Virginia Beach, VA
Status: offline

quote:

ORIGINAL: elmajdal

have you doubled check your configuartion with this article :

Allowing Intradomain Communications through the ISA Firewall (2004)

http://www.isaserver.org/articles/2004perimeterdomain.html

Tried don't work

(in reply to elmajdal)

Post #: 7

RE: Problems with communication DMZ and Internal - 26.Mar.2006 6:41:04 PM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Mike,

They do work. You need to review what you did differently than what was explained in that article.

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to MikeRM2)

Post #: 8