Could you please help me with this configuration? We have the following routers: RTR1---RTR2---RTR3---RTR4---ISA200RTR5 Routers from 1 to 4 are windows 200 routers only without isa and the last one router5 is isa router so all traffic go from there We need to give public ip address to users in router1 I know we can create DMZ in isa with public ip address and isa will act as router for them. But in this scenario how I can do this? Can I? Any idea? Regards Hanan
assuming RTR1 through RTR4 are on the internal network, you can assign public IP's to the LAN assigned behind RTR1, BUT those public IP's will *not* be visible external because ISA 2000 is always doing NAT between internal (LAT) and external (non-LAT).
Thank you for your reply I agree with you that isa 2000 do always NATing and isa 2004 do routing and NATing. But if you have tom book ISA SERVER BEYOND page 70 Configuring a trihomed DMZ, TOM said in this page: When you configure isa server as trihomed DMZ you are creating a routed connection between the external interface and the DMZ segment. the packets moving between the external interface and DMZ segment are not subject to the firewall or web proxy service's access policies, you cannot control inbound and outbound access to and from the DMZ. You can't take advantage of the protection you would receive by NATing between the external interface and DMZ segment.
So what is that mean? Unless that mean that isa nat the public ip address anyway but no access policy will be apply to this connection and it will act as router for this segment but still nat the public ip address? Could you explain what I should understand from this???
in a trihomed DMZ scenario, ISA is only doing routing and IP packet filtering between external and DMZ. No other access policies are applied to that traffic. So, a DMZ interface and the networks behind them must be considered as non-LAT members.
However, make sure you do NOT configure a default gateway on the ISA DMZ interface. Instead, you should explicitely define persistent static routes on ISA for all the destinations reachable through the ISA DMZ interface.