• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

How to build an ISA firewall lab with Virtual PC 2004

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2004 Firewall] >> Network Infrastructure >> How to build an ISA firewall lab with Virtual PC 2004 Page: [1] 2   next >   >>
Login
Message << Older Topic   Newer Topic >>
How to build an ISA firewall lab with Virtual PC 2004 - 2.Jan.2005 8:56:00 PM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
This thread is for the How to build an ISA firewall lab with Virtual PC 2004 article.

Thanks,
Stefaan

[ January 02, 2005, 10:30 PM: Message edited by: spouseele ]

< Message edited by spouseele -- 13.Jun.2006 8:37:35 PM >
Post #: 1
RE: How to build an ISA firewall lab with Virtual PC 2004 - 2.Jan.2005 10:32:00 PM   
Matthijs Hoekstra

 

Posts: 11
Joined: 19.Sep.2002
Status: offline
Stefaan,

You might want to change the picture url's. They are all pointing to mydocuments folder on your c: drive.

(in reply to spouseele)
Post #: 2
RE: How to build an ISA firewall lab with Virtual PC 2004 - 3.Jan.2005 12:24:00 AM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi Matthijs,

thanks for pointing this out! It should be corrected by now.

Thanks,
Stefaan

(in reply to spouseele)
Post #: 3
RE: How to build an ISA firewall lab with Virtual PC 2004 - 3.Jan.2005 12:57:00 AM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Stefaan,

GREAT article!

Thanks!
Tom

(in reply to spouseele)
Post #: 4
RE: How to build an ISA firewall lab with Virtual PC 2004 - 7.Jan.2005 6:29:00 PM   
JowMeieng

 

Posts: 2
Joined: 7.Jan.2005
Status: offline
Hello,

I am having trouble configuring an ISA firewall lab with Virtual PC 2004. I have followed the instructions of this article http://www.isaserver.org/pages/article_p.asp?id=1312

I have created 3 virtual machines an ISA, WEB and a Client. ISA machine has 2 network adapters an Internal and external using the specified IP addresses Internal ű 192.168.33.1 External ű 192.168.22.1. The WEB and the CLIENT machine only have one Net work adapter using the specified IP addresses WEB ű 192.168.33.2 and CLIENT ű 192.168.22.2. I am trying to test a request to the web server from the client. When I try to access the web-192.168.33.2 on ISA machine I am getting a 403 Forbidden error. Has any one created this same scenario and might know how to fix it so that I can make the request from the Client to the Web.

Any help would be great.

Thank you

(in reply to spouseele)
Post #: 5
RE: How to build an ISA firewall lab with Virtual PC 2004 - 8.Jan.2005 5:22:00 PM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi Jow,

what did you configure *exactly* so far?

Did you create two Loopback Adapters on the host machine, one for the Internal and one for the External network?

According to your info, the Internal network is 192.168.33.0/24 and the External network is 192.168.22.0/24. Right?

Also, the Web server seems to be on the Internal network and the Client on the External network. Is this correct?

So, your scenario is you want to test the publishing of a Web server. What is the relation between the Internal and the External network, route or NAT? Can you ping from the ISA server both the Web server and the Client? Do you have a DNS infrastructure in place? What access rule or publishing rule did you configure? ...

HTH,
Stefaan

(in reply to spouseele)
Post #: 6
RE: How to build an ISA firewall lab with Virtual PC 2004 - 30.Jan.2005 3:56:00 AM   
willabr

 

Posts: 16
Joined: 19.Jan.2003
From: USA
Status: offline
Dag Stefaan

I would like to have an isolated virtual network running on my workstation. The network will emulate an internet, a local LAN with a perimeter. Additionally I would like to have a WAN connection.

SoÓ. I think I need the following virtual setup

A windows 2003 server running ISA 2004
This will have the following characteristics:

One physical NIC (Intel) and Three Loopback connections.

Internal -> physical interface : 10.2.1.1/24
External -> Loopback1 : 39.1.1.1/24
Perimeter -> Loopback2 : 172.16.1.1/24

(I did not have the MAC address problem?, I looked and they were different so I left them as they were)

Next:
The ActiveDirectory Server (with DNS/DHCP) : 10.2.1.2/24

XP Client: DHCP (Range 10.2.1.100-10.2.1.105/24) Using the 10.2.1.1 as its default gateway.

ThatĂs the Internal Network, Now for the External (not really external just going through the ISA external interface)

Windows 2003 Web Editions

WWW.LAB2.COM -> 39.1.1.2/24

Now that IĂve set this up here is my question:

I have one rule: let every thing through, (for now anyway),
The problem, I can not ping the default gateway from the XP Client on the same subnet as the gateway loopback.

I'm confused on which interface the client and the AD will use for the Internal network. And which interface will be used for the ˘External÷ web server.

By ˘interface÷ I mean Loopback connector.
I have had some success, but not what I would like. Is the above possible?

Tot straks!

(in reply to spouseele)
Post #: 7
RE: How to build an ISA firewall lab with Virtual PC 2004 - 30.Jan.2005 4:46:00 AM   
willabr

 

Posts: 16
Joined: 19.Jan.2003
From: USA
Status: offline
I got it, I did not get the "switch" analogy right away, once I did everything fell into place.

Dank U wel, Miner

(sorry for my poor dutch!)

(in reply to spouseele)
Post #: 8
RE: How to build an ISA firewall lab with Virtual PC 2004 - 30.Jan.2005 12:23:00 PM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi Bruce,

glad to hear you could solve your problem on your own! And yes, the "switch" analogy is crucial to fully understand the power of the virtual networking offered by VPC 2004.

BTW --- your dutch isn't that bad. The word 'Miner' should just me spelled as 'meneer'. [Wink]

Thanks,
Stefaan

(in reply to spouseele)
Post #: 9
RE: How to build an ISA firewall lab with Virtual PC 2004 - 17.Mar.2005 8:39:00 PM   
Guest
Thank you for the article. However, I am trying to do this setup using Virtual Server 2005 and it appears that these instructions do not work. I have followed the article to a 'T' but cannot get the virtual client PC's to communicate with the virtual server, nor vice-versa.

Virtual Server:
Windows 2003 Server Standard
Broadcom Net adapter (real) - External Network: 192.168.5.2 (gateway is 192.168.5.1, internet works fine)
Loopback Adapter #1: 192.168.2.1
Loopback Adapter #2: not configured

Virtual Client #1:
Windows XP Pro SP2
Loopback Adapter #1: 192.168.2.10
NO INTERNET, NO NETWORK COMMUNICATIONS WHATSOEVER

Virtual Client #2:
Windows 2000 Pro SP4
Loopback Adapter #1: 192.168.2.11
NO INTERNET, NO NETWORK COMMUNICATIONS WHATSOEVER

The client PC's cannot even speak to each other using the same network adapter.

What am I doing wrong?

TIA...

(in reply to spouseele)
  Post #: 10
RE: How to build an ISA firewall lab with Virtual PC 2004 - 18.Mar.2005 8:58:00 PM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi Brian,

I never tested it on Microsoft Virtual Server 2005, but according to one of my colleagues, it should work equally well. See also http://www.microsoft.com/windowsserversystem/virtualserver/overview/vs2005tech.mspx .

You need to install the Microsoft Loopback Adapter and enable the Virtual Networking Service on the host OS. Then assign that Loopback Adapter to the guest OS's.

HTH,
Stefaan

(in reply to spouseele)
Post #: 11
RE: How to build an ISA firewall lab with Virtual PC 2004 - 27.Apr.2005 5:26:00 PM   
Berner

 

Posts: 1
Joined: 27.Apr.2005
Status: offline
Hi

I'm new to ISA and am trying to configure a lab from scratch. I would be grateful if anyone has seveloped stefan's doc into a full walkthrough guide. Any help would be appreciated.

Thanks

Berner

(in reply to spouseele)
Post #: 12
RE: How to build an ISA firewall lab with Virtual PC 2004 - 27.Apr.2005 9:20:00 PM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi Berner,

what do you mean with "a full walkthrough guide"? [Confused]

My article explains in detail the theory behind and how to build an ISA firewall lab on the basis of the advanced networking features of Virtual PC. If you need to know how to use Virtual PC in general, check out the Virtual PC help file and http://www.microsoft.com/virtualpc . For more how to's about ISA server 2004, check out the many articles on this site, the ISA help file and http://www.microsoft.com/isaserver .

HTH,
Stefaan

(in reply to spouseele)
Post #: 13
RE: How to build an ISA firewall lab with Virtual PC 2004 - 25.Jun.2005 4:13:00 PM   
Guest
I keep getting "Setup failed while registering ISA server filters" during installation of ISA 2004 on a virtual PC 2004. Also if use VMWare I get the same. No mater the number and type of network addapters.

The host PC is Media Center wirh SP2

ANy one knows how to fix this?

(in reply to spouseele)
  Post #: 14
RE: How to build an ISA firewall lab with Virtual PC 2004 - 26.Jun.2005 9:42:00 AM   
Rickymag

 

Posts: 509
Joined: 26.Nov.2003
From: SA
Status: offline
ISA will only insatll on Server software base OS not media center.

RM

Media Center is great [Smile]

(in reply to spouseele)
Post #: 15
RE: How to build an ISA firewall lab with Virtual PC 2004 - 4.May2006 10:36:08 PM   
quinla02

 

Posts: 1
Joined: 4.May2006
Status: offline
Hello,

I followed the instructions on how to build an virtual test lab for ISA.I have configured the internal on 192.168.20.1, the perimeter on 192.168.30.1 and the external on 192.168.1.10 (which connects to my home router(192.168.1.5) and out to the internet).

I was wondering what gateways I should use for each adapter.

Any help would be really appreciated.

Thanks
Andy.

P.S Does anyone know of a website with a tutorial on configuring Virtual PC for a test exchange lab.




(in reply to Rickymag)
Post #: 16
RE: How to build an ISA firewall lab with Virtual PC 2004 - 5.May2006 11:41:09 PM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi Andy,

once you have created the adapters on the host operating system and assigned them to the ISA virtual machine, you follow the standard ISA networking setup as explained in many articles on this site, the ISA help file and of course Tom's book http://www.amazon.com/exec/obidos/ASIN/1931836191/isaserver/.

To summarize, ISA supports only one default gateway and that must be set on the ISA external interface only. Therefore, all other interfaces don't have a default gateway.

HTH,
Stefaan

(in reply to quinla02)
Post #: 17
RE: How to build an ISA firewall lab with Virtual PC 2004 - 13.Jun.2006 9:45:59 AM   
MDAIIIUser

 

Posts: 2
Joined: 12.Jun.2006
Status: offline
Stefaan

1) Thanks!
2) Think you need to correct the link in first post it seems to give me a 404 (does not open new window, maybe???)

I have spent 2 days trying to set up a Virtual lab and Failed big tiime.
Well Failed in the sence I could not set it up the way I wanted nor the way its depicted when I try to use an XP client.

Please, Please Stefaan correct me if I am worng and Pease Please add this information to you How to so that it will stop other users falling into the same trap if and only if I am right that is.

Law # 1
On a VM XP client the only network you CAN EVER use on your LOOPBACK addapter is 192.168.0.xxx
Thus setting up an external XP DMZ client on a 172.16.0.0/24 and or an internal Client on a 10.10.10.0/24 will fail as you will NEVER get connectivaty
(even if you set up a isa server and define your default getway).
 
http://blogs.msdn.com/virtual_pc_guy/archive/2005/10/04/477195.aspx
 
Law #  2
If you have a Wireless adapter on your VM Host don't try to use it within a VM PC.
it can work but it might not and if it does not then you will spend to much time working it out.
 
Case:
I have a laptop hosts that connects to the internet via its wierless addapter to my home router (works fine)
I set up a VM, use that adapter as its LAN addapter and try to obtain an ip address (wont work)

http://blogs.msdn.com/virtual_pc_guy/archive/2005/10/13/479773.aspx

------------------------------------

So I am still faced with the problem of setting up a lab (internal 10.10.10.0/dmz 172.16.1.0/ external) using a XP client in each segment and being able to connect to the internet via a isa server. And it seems the answer is in.

http://www.amazon.com/exec/obidos/ASIN/1931836191/isaserver/.

and is use VMware.

Chapter 4 / section 2 /
We do not want to give the impression that we believe that VMware is a superior to Virtual PC as an operating system virtualization option. Microsoft uses Virtual PC extensively in their own testing and training environments. We have tested ISA firewalls on the Virtual PC platform and found virtual machine performance actually appeared slightly better. However, VMware has better support for the networking scenarios we typically try to reproduce in our labs, and so for testing firewall scenarios, it provides a slightly better option.

Please somebody tell me I am wrong,

MDAIIIUser

 

(in reply to spouseele)
Post #: 18
RE: How to build an ISA firewall lab with Virtual PC 2004 - 13.Jun.2006 6:04:14 PM   
MDAIIIUser

 

Posts: 2
Joined: 12.Jun.2006
Status: offline
UPDATE on day three.

My goal was to create a Lab using VertualPC on my laptop with a wifi adapter using the guidelines from:
http://www.isaserver.org/articles/VPC2004_ISAlab.html

I wanted an internal and a dmz as well as connectvaty to the internet from a 3 headed ISA server.

I think I have got the infra sorted out.

Here is my layout and it seems to work. (I have not configured the ISA server!!!)

Host
MYPC -> XP /sp2
        -> Micrsoft VirtualPC Build 5.3.582.27 (thats with the SP)
        -> Sony Vaio laptop VGN-SZ1XP 2gig ram, 100 gig disk
        -> Internal adapter (Wired) disabled
        -> wifi adapter connect to adsl router HOME with dhcp in 10.10.10.0/24
        -> Internet connectivaty works
        -> Added 2 new Microsoft loopback adapters to this host

Loaded VPC
created the following 4 hosts
adding each adapter one by one as I need to correct the missing mac addresses in most cases.

Internal Network
AD1  -> 2003/SP1 Domain controller 
      -> DNS for mynamespace.com
      -> VPC Addapter -> Local only
      -> Fix Ip 10.100.100.100/24
          GW: None
          DNS 10.100.100.100 
      -> Renamed adapter LAN

XPLAN -> XP Workstation / SP2
        -> Joined to mynamespace.com domain
        -> VPC Addapter -> local only
        -> Fix IP 10.100.100.10/24
            GW: None
            DNS 10.100.100.100 
            Rennamed adapter LAN
  
        -> Changed default Firewall settings to allow ICMP (Ping)
             Control Panel -> Network and Internet Connections -> firewall -> Advanced
                ICMP -> Settings -> Allow incoming echo requests -> tick -> ok -> ok

External Network (DNZ)
XPOUT -> XP Workstation / SP2
         -> VPC Addapter -> Microsoft Loopback addapter #2
         -> Fix IP 192.168.0.10/24 
             GW: None
             Rennamed adapter DMZ
         -> Changed default Firewall settings to allow ICMP (Ping)

IAS6    -> 2003/sp1 (will become my IAS)
         -> VPC Adapter 1: Shared Networking NAT
         -> IP dynamic
             DNS 192.168.0.254
             Renamed addapter HOME (my HOME network connected to ADSL) 
   
         -> VPC Adapter 2: Local only
         -> Fix Ip 10.100.100.1/24
             GW: None 
             DNS 10.100.100.100 
             Renamed adapter LAN

         -> VPC Adapter 2: Microsoft loopback adapter #2
         -> Fix IP 192.168.0.1/24 
             GW: None
             Rennamed adapter DMZ

It seems to work but only as I have NOT added ISA (Smle)

Tests on:
Internal network
Ping AD1 <-> XPIN <-> AS6 <-> AD1 = OK Both IP and DNS name
    XPOUT / Internet Fails (which is correct)

External Network (DNZ)
XPOUT
PING IP Only XPOUT <-> ISA6 = OK
     PING Internal network / Internet Fails (which is correct)

ISA6
PING ISA6 <-> AD1 <-> XPLAN <-> ISA6 = OK Both IP and DNS name
    (XPLAN will only work with xplan.mynamespace.com will need to work out how to fix that)
PING IP only ISA6 <-> XPOUT = OK
    Internet works; Microsoft update works.

So the short version is
You can make a Virtual lab with an
internal 10.100.100.0/24
DMZ 192.168.0.0/24
Use XP as your clients and have internet over a shared NAT connection which uses a wifi adapter

Or in my case UNTILL you install ISA6 that is.

Hope that helps

Thanks spouseele / Stefaan   for your guidlines
Thanks Bill Grant for staying with me and pointing me in the correct direction
http://www.microsoft.com/windowsxp/expertzone/newsgroups/reader.mspx?&guid=&sloc=en-us&dg=microsoft.public.virtualpc&p=1&tid=f0398848-d095-4aee-bbd2-8fb453badd44
      

(in reply to MDAIIIUser)
Post #: 19
RE: How to build an ISA firewall lab with Virtual PC 2004 - 13.Jun.2006 8:58:14 PM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi MDAIIIUser,

the link in the first post has been updated and should work now. Thanks for pointing that out!

Stefaan


(in reply to MDAIIIUser)
Post #: 20

Page:   [1] 2   next >   >> << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2004 Firewall] >> Network Infrastructure >> How to build an ISA firewall lab with Virtual PC 2004 Page: [1] 2   next >   >>
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts