The isa server is a back firewall which sits behind a cisco ASA for int1 and int2. I have web publishing rules setup and working on int2 and users are able to access resources from the internet without any issues. I have now been tasked with making resources available from int1, the requests come from a 10.X.X.X address as source which are NATed to a 192.168.250.X address on int1.
Posts: 51
Joined: 5.Dec.2008
From: Washington, DC
Status: offline
Which is your external interface. What interface has the default gateway. Also what is your network configuration on the listener publishing servers in N3 DMZ.
If "internet DMZ" is your external interface and you are publishing servers in the DMZ network (same as external int nw) it is not a good setup.
You might also need to check how the routing is in your ISA server. I believe the traffic is not hitting the correct interface.
Listener configuration is using external with ip 192.168.250.x (this is an ip on int1, N3 DMZ)
The default gateway is configured on int2.
You say this is not a good setup, I am not sure that it is not possible to publish servers on multiple networks?
I thought the issues maybe based around the requests coming from machines on the N3 network where source address is 10.x.x.x which is a reserved internal range?
Hope this makes sense as I am in a position where users are needing to hit a site ASAP
Posts: 51
Joined: 5.Dec.2008
From: Washington, DC
Status: offline
Customer requirement may supercede any infrastructure design, provided sufficient risk analysis are done.
When you have multiple NIC interface on ISA, the reverse proxying accepts the traffic coming on one interface and passes the same to another interface. In your case the traffic hits on int2 (or int1) and again goes through the same interface for the published webserver. ISA will identify the traffic as spoofed one and may block the traffic.
You can check the article below for disabling spoofing in ISA
Also the traffic coming to int1 for N3 DMZ will have the return traffic going through int2, since that is the default gateway. Unless your ASA does a source NAT for the incoming traffic to int1 and you have the route in ISA for the NAT IP back to ASA, it would not take a desired path.
That's why I meant the design is complicated in your setup.
Regards, Karthigeyan
< Message edited by yeskaygee1 -- 6.Aug.2009 8:21:46 AM >
Posts: 51
Joined: 5.Dec.2008
From: Washington, DC
Status: offline
Can you provide the settings on your listener - http / https, what kind of authentication, do you use any certs etc. Also what kind os authentication you use in the publishing rules.
|
My Subscription |
My Forums |
Address Book |
Member List |
Search |
FAQ |
Ticket List |
Log Out
Printable Version
All Forums >> [ISA 2006 Publishing] >> Web Publishing >> Web publishing rule created 
Web publishing rule created - 
New Messages
No New Messages
Hot Topic w/ New Messages
Hot Topic w/o New Messages
Locked w/ New Messages
Locked w/o New Messages
Post New Thread