• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

Intra-array communications

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA 2006 General] >> General >> Intra-array communications Page: [1]
Login
Message << Older Topic   Newer Topic >>
Intra-array communications - 1.Apr.2009 9:55:05 AM   
teejayuu

 

Posts: 97
Joined: 7.May2008
Status: offline 		Hi

I am installing ISA 2006 EE and have already created 2 CSS server and 1 ISA server.  I just created the 2nd ISA Server and am struggling with the Intra Array Communication.

Each server has 3 NIC's
Internal: IP 10.1.1.240 & 10.1.1.243
NLB: 172.16.255.1 & 172.16.255.3
External: xx.xxx.xx.180 & xx.xxx.xx.182

Which card is used for Intra-array communication?  They are current set for the Internal, I would have thought that the NLB NIC's would be used.

Also, do I need to turn on Microsoft's Network Load Balancing component?

Thanks
Tony
Post #: 1
RE: Intra-array communications - 1.Apr.2009 9:59:44 AM   
Jason Jones

 

Posts: 4663
Joined: 30.Jul.2002
From: United Kingdom
Status: offline 		Hope this helps:

http://blog.msfirewall.org.uk/2008/10/resource-guide-for-using-microsoft-nlb.html

Cheers

JJ

_____________________________

Jason Jones | Forefront MVP | Silversands Ltd
My Blogs: http://blog.msedge.org.uk/ and http://blog.msfirewall.org.uk/

(in reply to teejayuu)
Post #: 2
RE: Intra-array communications - 1.Apr.2009 10:46:50 AM   
teejayuu

 

Posts: 97
Joined: 7.May2008
Status: offline 		Thanks Jason,  I'll read that tonight.  Just a point though - I've tried changing the intra-array communication IP address to my NLB card and get the following message

"DHCP cannot be used to assign IP addresses to VPN clients or remote endpoint servers on multiple-server arrays.
The error occurred on object 'VpnConfig' of class 'VPN Configuration' in the scope of array 'Relate Edge Array'."

How does VPN config tie into the Intra-array communication?

(in reply to Jason Jones)
Post #: 3
RE: Intra-array communications - 1.Apr.2009 11:14:22 AM   
Jason Jones

 

Posts: 4663
Joined: 30.Jul.2002
From: United Kingdom
Status: offline
quote:

ORIGINAL: teejayuu

Thanks Jason,  I'll read that tonight.  Just a point though - I've tried changing the intra-array communication IP address to my NLB card and get the following message

"DHCP cannot be used to assign IP addresses to VPN clients or remote endpoint servers on multiple-server arrays.
The error occurred on object 'VpnConfig' of class 'VPN Configuration' in the scope of array 'Relate Edge Array'."

How does VPN config tie into the Intra-array communication?


It sounds like you'd enabled your VPN or configured it incorrectly and its not related to the intra-array setup at all...

Cheers

JJ

_____________________________

Jason Jones | Forefront MVP | Silversands Ltd
My Blogs: http://blog.msedge.org.uk/ and http://blog.msfirewall.org.uk/

(in reply to teejayuu)
Post #: 4
RE: Intra-array communications - 1.Apr.2009 11:19:13 AM   
Jason Jones

 

Posts: 4663
Joined: 30.Jul.2002
From: United Kingdom
Status: offline 		The blog should cover most of what you need to setup a dedicated intra-array NIC (or provide links to the right documents).

The intra-array NICs don't do anything NLB wise, they just provide a dedciated link between the servers (and NLB should not be enabled on these NICs).

Shout if you have gaps in the blog...

Cheers

JJ 

_____________________________

Jason Jones | Forefront MVP | Silversands Ltd
My Blogs: http://blog.msedge.org.uk/ and http://blog.msfirewall.org.uk/

(in reply to Jason Jones)
Post #: 5
RE: Intra-array communications - 2.Apr.2009 6:10:34 AM   
teejayuu

 

Posts: 97
Joined: 7.May2008
Status: offline 		Hi Jason

Didn't get much of a chance to read up last night as football was on - probably should comment on another forum about that.

Anyway, have read up both your blog/associated links today as well as the text I am using and I think I see where my confusion lies.

quote:

Each server has 3 NIC's
Internal: IP 10.1.1.240 & 10.1.1.243
NLB: 172.16.255.1 & 172.16.255.3
External: xx.xxx.xx.180 & xx.xxx.xx.182


The text I am following has an NLB Network on 172.16.255/.0/24, whereas if should read:
quote:

Each server has 3 NIC's
Internal: IP 10.1.1.240 & 10.1.1.243
Intra-Array Communication: 172.16.255.1 & 172.16.255.3
External: xx.xxx.xx.180 & xx.xxx.xx.182


The NLB is on the Internal and External networks if I read everything right.

(in reply to Jason Jones)
Post #: 6
RE: Intra-array communications - 2.Apr.2009 9:02:51 AM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline 		That's correct. Enable NLB on the default Internal and External ISA Firewall Networks, but not on the intra-array Network.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to teejayuu)
Post #: 7
RE: Intra-array communications - 2.Apr.2009 9:21:04 AM   
teejayuu

 

Posts: 97
Joined: 7.May2008
Status: offline 		Hi Ton and thanks

I have got it all set up now, but one server is working fine (ISA3) and the other (ISA) has an error message 'Unable to retrieve data from :ISA3". I think this have something to do with the Intra-Array communication.

The services tab of monitoring shows (ISA1):

Network Load Balancing ISA1 Running
Network Load Balancing ISA3 Stopped

When I highlisght ISA3 there is nothing in the Tasks tab to Start NLB, yet in ISA3 both servers are running. How do I get NLB running on ISA1?

Thanks
Tony

(in reply to tshinder)
Post #: 8
RE: Intra-array communications - 2.Apr.2009 9:28:30 AM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline 		Hi Tony,

Are the intra-array addresses set for the DIPs of both firewalls?

Is name resolution configured so that each firewall in the array is resolved to it's internal address and that the intra-array addresses are also resolvable?

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to teejayuu)
Post #: 9
RE: Intra-array communications - 2.Apr.2009 9:50:12 AM   
teejayuu

 

Posts: 97
Joined: 7.May2008
Status: offline 		Tom

Not sure what you mean by DIP's if you mean VIP then no. The Intra-Array communication is set for the Intra-Array NIC (172.16.255.1 & 3).

I cannot ping by either server by IP (172.168.255.1 or 3) - do I need to add these to my DNS?

(in reply to tshinder)
Post #: 10
RE: Intra-array communications - 2.Apr.2009 1:15:19 PM   
Jason Jones

 

Posts: 4663
Joined: 30.Jul.2002
From: United Kingdom
Status: offline 		Did you not do the config detailed in Question 9 of the blog article?

I am assuming here that you have installed the CSS role the array members themselves?

Cheers

JJ

< Message edited by Jason Jones -- 2.Apr.2009 1:17:19 PM >

_____________________________

Jason Jones | Forefront MVP | Silversands Ltd
My Blogs: http://blog.msedge.org.uk/ and http://blog.msfirewall.org.uk/

(in reply to teejayuu)
Post #: 11
RE: Intra-array communications - 3.Apr.2009 3:18:41 AM   
teejayuu

 

Posts: 97
Joined: 7.May2008
Status: offline 		Jason,  both CSS roles are not installed on array members but on seperate servers.  I have just checked and both are now up and running - now to get the rules working

Thanks to both you and Tom

< Message edited by teejayuu -- 3.Apr.2009 3:28:45 AM >

(in reply to teejayuu)
Post #: 12
RE: Intra-array communications - 9.Apr.2009 8:59:47 AM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline 		Good to hear you got it working and thanks for the follow up!

Tom

_____________________________

Thomas W Shinder, M.D.

(in reply to teejayuu)
Post #: 13

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA 2006 General] >> General >> Intra-array communications Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts