Hi, very new ISA user here. We have a blade system here, with 2 network cards on each server. Both are internal cards, so I am wondering - Do I need an external card and address, or can I set up my ISA server with just these 2 internal cards/addresses? Thanks!!
Thanks for the quick response! I do realize best practice is to have one internal address and one external, but can you use ISA with just an internal address? Thanks!!
Posts: 6022
Joined: 16.Sep.2004
From: Lebanese in Kuwait
Status: offline
Configuring ISA with a single NIC makes you loose many of the features provided by ISA , read the following :
quote:
Configuring ISA Server with a Single Network Adapter Configuration Problem: There are a number of issues associated with the configuration of ISA Server on a computer with a single network adapter. Cause: The causes include:
•Multi-network firewall policy. In single network adapter mode, ISA Server recognizes itself (the Local Host network). Everything else is recognized as the Internal network. There is no concept of an External network. The Microsoft Firewall service and application filters operate only in the context of the Local Host network. (ISA Server protects itself no matter what network template is applied.) Because the Firewall service and application filters operate in the context of the Local Host network, you can use access rules to allow non-Web protocols to the ISA Server computer. This has implications for running applications located on the ISA Server computer.
•Application layer inspection. Application level filtering does not function, except for Web Proxy Filter for Hypertext Transfer Protocol (HTTP), Secure HTTP (HTTPS), and File Transfer Protocol (FTP) over HTTP.
•Server publishing. Server publishing is not supported. Because there is no separation of Internal and External networks, ISA Server cannot provide the NAT functionality required in a server publishing scenario.
•Firewall clients. The Firewall Client application handles requests from Winsock applications that use the Firewall service. This service is not available in a single network adapter environment.
•SecureNAT clients. SecureNAT clients use ISA Server as a router to the Internet, and SecureNAT client requests are handled by the Firewall service. Because the Firewall service is not available in a single network adapter configuration, such requests are not supported.
•Virtual private networking. Site-to-site virtual private networks (VPNs), and remote access VPNs are not supported in a single network adapter scenario.
Thanks again for the info. There are 2 NIC cards on the blade. What if the internal one was on the subnet of the internal network, and the "external" NIC was not really a true external address but a separate subnet? For instance, 192.1.?.? being our internal network and making the external NIC 192.168.?.?.......Thanks in advance!!
Posts: 6022
Joined: 16.Sep.2004
From: Lebanese in Kuwait
Status: offline
Hi again,
ISA NICs have to be on different Networks. as u said if the internal on 192.168.x.x , u need to have your External or any other NIC on a different Network ID, such as 10.x.x.x etc...
Is there a router infront of your ISA and the Internal NIC of the router has the Network ID 192.1.x.x ?
Yes, the ISA server is behind the router, with the router having a 192.1.?.? address. So you are saying 2 different subnets would not cut it? Because we would put the router and isa server in the 192.168 subnet, while the internal network is in the 192.1 subnet.I appreciate your patience in answering!
Okay, hopefully this is my last question!! lol I always thought the network ID was the 192.1, with the subnet being the .1 (for instance), then the host. So if I have a 192.1 and a 192.168, aren't they 2 separate network ID's?