I am an ISA newbie and this is my scenario. My organization purchased an ISA server to Reverse Proxy our Exchange and web servers. The ISA server's External interface is in the DMZ off a PIX with the Internal interface on our server subnet. Our Exchange server is on the same subnet as the Internal interface (the 'on subnet' network). Multiple subnets are behind the Internal interface. No other workstations or servers internal to ISA will be passing traffic through ISA. All subnets have a route entry on the ISA server and are defined as part of the Internal Network (capital N). My problem is when I configure Exchange as a SecureNAT client to publish OWA and SMTP, all internal Outlook clients stop working. I have read other posts on the message boards and have found the following solutions: 1. Place a layer 3 device between Exchange and ISA. 2. Define Subnet network objects and create access rules allowing traffic to and from each Subnet. 3. ISA 2004 book p. 340 - install firewall client on Exchange and configure with a default gateway other than ISA.
Will installing the firewall client on Exchange work if all other workstations do not have it installed, and will not be using ISA as a gateway? Has anyone had a similar problem and found any of these solutions to work? Any input would be appreciated. (Obviously a solution would be to use ISA for all the computers on our network, but this is not politically possible at this time)
quote:Originally posted by jbrown04: I am an ISA newbie and this is my scenario. My organization purchased an ISA server to Reverse Proxy our Exchange and web servers. The ISA server's External interface is in the DMZ off a PIX with the Internal interface on our server subnet. Our Exchange server is on the same subnet as the Internal interface (the 'on subnet' network). Multiple subnets are behind the Internal interface. No other workstations or servers internal to ISA will be passing traffic through ISA. All subnets have a route entry on the ISA server and are defined as part of the Internal Network (capital N). My problem is when I configure Exchange as a SecureNAT client to publish OWA and SMTP, all internal Outlook clients stop working. I have read other posts on the message boards and have found the following solutions: 1. Place a layer 3 device between Exchange and ISA. 2. Define Subnet network objects and create access rules allowing traffic to and from each Subnet. 3. ISA 2004 book p. 340 - install firewall client on Exchange and configure with a default gateway other than ISA.
Will installing the firewall client on Exchange work if all other workstations do not have it installed, and will not be using ISA as a gateway? Has anyone had a similar problem and found any of these solutions to work? Any input would be appreciated. (Obviously a solution would be to use ISA for all the computers on our network, but this is not politically possible at this time)
Thanks.
Hi James,
Do you have a network diagram? If you have multiple networks located behind the default Internal interface of the ISA firewall, then there has to be a layer 3 aware device controlling routing between all those networks. You can configure the default gateway on those devices to use the layer 3 device to simplify things, depending on your setup. But a picture of your design will determine the best and easiest way to go.
Posts: 478
Joined: 3.Jun.2003
From: Albuquerque NM USA
Status: offline
Hi James,
Just a few quick points to check:
1. The ISA firewall's default gateway should be the inside interface of your PIX; the other interface should not have a default gateway. 2. The ISA firewall should have static routes to subnets 2, 3, and 4. 3. The Exchange server's default gateway should be the inside interface of the ISA firewall. 4. The Exchange server should have the same static routes to subnets 2, 3, and 4 as the ISA firewall, since you don't have a router in between them, and you don't want the ISA firewall to mediate this traffic.
|
My Subscription |
My Forums |
Address Book |
Member List |
Search |
FAQ |
Ticket List |
Log Out
Printable Version
All Forums >> [ISA Server 2004 Firewall] >> Network Infrastructure >> BOOK Network behind a Network p.340 
BOOK Network behind a Network p.340 - 
New Messages
No New Messages
Hot Topic w/ New Messages
Hot Topic w/o New Messages
Locked w/ New Messages
Locked w/o New Messages
Post New Thread