• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

Replacement solution for Rainwall.

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA 2006 General] >> Installation and Planning >> Replacement solution for Rainwall. Page: [1]
Login
Message << Older Topic   Newer Topic >>
Replacement solution for Rainwall. - 29.Apr.2008 7:11:06 AM   
huntingj

 

Posts: 7
Joined: 12.Oct.2006
Status: offline
We currently run ISA2004 with Rainwall/Rainconnect and are looking at replacing this since EMC no longer support the product. I wonder if anyone can confirm whether the following solution would work as a replacement to provide resilience across the servers and resilience across the dual ISP feeds?

The proposed solution is:

Install 2 x ISA2006 EE Servers with NLB enabled on all 'internal' & 'perimeter' networks. Hopefully this does the Rainwall bit.

Connect 2 x ISP feeds (on different networks) to each ISA server's External interface (one server one external connection) and do not enable NLB for the External network. This hopefully doesn't break the multiple gateway issue that isn't supported on ISA.

Finally, use a 3rd party external DNS load-balancing solution e.g. TZO to provide DNS failover capabilities for external access. (Hopefully this does the Rainconnect bit).

My only concerns are the potential issues with not load-balancing the External networks. I know ISA logs an NLB inconsistency message if all networks are not load-balanced.

Hopefully someone can confirm if this will work or shed some light on an alternative solution.

Many thanks.
Post #: 1
RE: Replacement solution for Rainwall. - 8.May2008 3:06:25 AM   
deepstar

 

Posts: 8
Joined: 25.Apr.2008
Status: offline
quote:

ORIGINAL: huntingj

We currently run ISA2004 with Rainwall/Rainconnect and are looking at replacing this since EMC no longer support the product. I wonder if anyone can confirm whether the following solution would work as a replacement to provide resilience across the servers and resilience across the dual ISP feeds?

The proposed solution is:

Install 2 x ISA2006 EE Servers with NLB enabled on all 'internal' & 'perimeter' networks. Hopefully this does the Rainwall bit.

Connect 2 x ISP feeds (on different networks) to each ISA server's External interface (one server one external connection) and do not enable NLB for the External network. This hopefully doesn't break the multiple gateway issue that isn't supported on ISA.

Finally, use a 3rd party external DNS load-balancing solution e.g. TZO to provide DNS failover capabilities for external access. (Hopefully this does the Rainconnect bit).

My only concerns are the potential issues with not load-balancing the External networks. I know ISA logs an NLB inconsistency message if all networks are not load-balanced.

Hopefully someone can confirm if this will work or shed some light on an alternative solution.

Many thanks.


Hello,

I don't know what rainwall or rainconnect do, but I will just assume that you have 2 ISA servers connected to all the same networks, except different external networks (different ISPs).

For traffic generated from clients behind the ISA servers on the internal networks (I assume they are for clients) to the outside, this setup will not be a real problem. Depending on your affinity settings, each client connection will use a different NAT'ed IP address (no affinity setting), or the same NAT'ed IP for every connection from a single client (single affinity).

Traffic between internal and perimeter networks should also be no problem.

For traffic from the external networks to the perimeter networks, this will be a problem because of assymetric routing. Suppose a connection comes in on IP 1.2.3.4 on ISA1 to some perimeter server. This server sends packets to the default gateway (the NLB address of both ISA servers) and then has a 50% chance (depending on NLB parameters of course) that the connection will actually succeed. This is because when the perimeter server sends traffic to the outside, it might go through ISA1 or ISA2. If it goes through ISA1, it will succeed, otherwise, the connection will be dropped.

I don't see a clean solution here if ISA can't handle 2 uplinks.

BTW, it's probably a good idea to provide a dedicated network between both ISA servers for intra-array traffic. In the setup you described, the only networks not using NLB are the external networks, which means intra-array traffic will be routed around the internet.

kind regards,
-- Steven

(in reply to huntingj)
Post #: 2

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA 2006 General] >> Installation and Planning >> Replacement solution for Rainwall. Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts