Welcome to ISAserver.org

problem with downlink

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2000 General] >> Installation >> problem with downlink

Page: [1]

Message

<< Older Topic Newer Topic >>

problem with downlink - 1.Apr.2004 10:42:00 AM

Guest

i have downlink thru dvb card via dish(satelite)
and uplink thru phone line
and i am trying to install isa but its not work
i dont know how to setup isa server thru downlink

Post #: 1

Featured Links*

RE: problem with downlink - 8.Apr.2004 7:11:00 PM

sniper

Posts: 687
Joined: 9.Aug.2001
From: OK, USA
Status: offline

robin,

that will not be possible since the outbound request does not go through ISA all packest coming back will be droped . All firewalls will exhibit this behavior.

(in reply to Guest)

Post #: 2

RE: problem with downlink - 9.Apr.2004 8:43:00 PM

mohsindabomb

Posts: 173
Joined: 27.Jun.2003
From: London, UK.
Status: offline

Chris and Robin,

Yes, this IS possible to use ISA with dvb-ip downlink. And yes, the outbound requests go through the ISA firewall. Of course they do, like any other normal request. But dvb-ip doesn't seem to work with ISA in your case Robin, cause ISA expects to receive the responses to these request on the interface from which the requests leave the ISA server. In technical lingo, the response ports are opened on that interface. So when the data arrives at the dvb-ip interface, ISA wont let it in. One simple solution to this is to include the autoconfiguration ip address of the dvb-ip interface in the LAT. That 169.254.x.x address!

Just put it in the LAT to make it work with dvb-ip. Rest of the configuration is same.

But I AM concerned about what security issues thi s might raise. Dr. Tom and Stefaan, could you please say something about the security issues with this configuration.

I'd be really interested in a discussion about this. Thanks.

And i hope what you just read helps you robin. Any problems? Let me know. I'm happy to help.

RedBull,
Digital Dominance.
http://www.digitaldominance.net

(in reply to Guest)

Post #: 3

RE: problem with downlink - 11.Apr.2004 4:43:00 AM

sniper

Posts: 687
Joined: 9.Aug.2001
From: OK, USA
Status: offline

Redbull

Thats why I said it would not work the purpose of an ISA server is security and hacking and slashing and adding 169.254 into the LAT is just crazy. Why use ISA at all in this case if you have to modify ISA in such a way to make it unsecure or weaker than normal

(in reply to Guest)

Post #: 4

RE: problem with downlink - 11.Apr.2004 10:07:00 AM

mohsindabomb

Posts: 173
Joined: 27.Jun.2003
From: London, UK.
Status: offline

Haha. Thanks for the response Chris. I enjoyed reading it. Yes, I agree with you it is crazy to include an untrusted interface in the LAT. Not a situation I'd allow on my network under any condition. But there is a way out. You can have a back-to-back ISA configuration with one ISA box receiving data from the dvb-ip interface and installed in a separate domain and another ISA box chained to the directly exposed ISA and installed in a separate domain. This could provide some security. But still, I'd hate to include that 169.254 thingie in the LAT, which is why I said I would welcome a discussion on this so we could probably discuss and agree on a configuration that works and provides security too. Everybody, any ideas?? Do write back, this is something I'd love to discuss.

--------------------
Thanks,

RedBull,
Digital Dominance Pakistan.
http://www.digitaldominance.net

(in reply to Guest)

Post #: 5

RE: problem with downlink - 11.Apr.2004 11:44:00 AM

mohsindabomb

Posts: 173
Joined: 27.Jun.2003
From: London, UK.
Status: offline

I was just wondering... All that data that is received on the dvb-ip interface by ISA has the ip address of the satellite company (the ip bound to dvb-ip's mac address at the satellite company's end) in the tcp/ip destination address headers and NOT the 169.254.x.x address. Still ISA lets all that traffic in, even though the primary connection is originated from outside, from the Internet (this is different from the data coming in in response to requests sent out). So actually ISA is letting connections come in that are connecting to an IP that is NOT on the lat. (the actual public ip bound to the dvb-ip mac is still OFF the lat.) This is a rather strange issue. We're seeing here that ISA doesn't actually dissect the tcp/ip headers and let information come in after comparing destination address and the LAT, it stupidly lets in whatever information is coming through an NIC that appears to be on the lat. The confusion starts from the fact that ISA doesn't know actually what IP is bound to the dvb-ip's mac. That's done at the satellite company's end. It simply thinks the ip for that interface is 169.254.x.x. But still it lets data come in from that interface that is NOT destined for 169.254.x.x. Haha. Pretty funny situation, inney? Any comments anybody, please do write.

(in reply to Guest)

Post #: 6

RE: problem with downlink - 19.Apr.2004 10:28:00 PM

amjad220

Posts: 5
Joined: 9.Apr.2004
Status: offline

Hello
Please do you give the complete configuration for DVB link through ISA.

Thanks

(in reply to Guest)

Post #: 7

RE: problem with downlink - 24.Apr.2004 1:12:00 PM

mohsindabomb

Posts: 173
Joined: 27.Jun.2003
From: London, UK.
Status: offline

Hi Amjad,

There are no special configuration options in ISA for DVB. You may want to contact your service provider if you're asking for dvb-ip card's configuration parameters.

(in reply to Guest)

Post #: 8

RE: problem with downlink - 24.Apr.2004 1:22:00 PM

mohsindabomb

Posts: 173
Joined: 27.Jun.2003
From: London, UK.
Status: offline

Hi Amjad,

In reply to your private message:

I cannot tell you the configuration for your dvb-ip card since I don't have that information. Your service provider will be able to provide you with configuration parameters for your dvb-ip interface.

Are you having problems with dvb-ip or ISA? Does it work fine without ISA? Are you trying to support internet access on the ISA box or the internal hosts? How are your clients configured? Need a bit more information to tell you anything useful.

(in reply to Guest)

Post #: 9

RE: problem with downlink - 24.Apr.2004 1:37:00 PM

mohsindabomb

Posts: 173
Joined: 27.Jun.2003
From: London, UK.
Status: offline

Hi Amjad,

You have my attention already. Please do me one courtesy of replying here on the board instead of private messaging me since you have chosen not to accept private messages which makes me switch between PM and the board to write to you.

When using DVB-IP, you have three types of configuration:

-1- Having the ip of your service provider on your uplink interface
(If this is your configuration you don't need to do anything in ISA to make all downloads land on the dvb-ip interface. Everything comes through the dvb-ip interface automatically).

-2- Connecting through VPN.
(Same as above. You need not do anything)

-3- Proxy based.
(If this is your configuration, you have to create a new routing rule and configure it to route requests to your service provider's upstream proxy server).

I hope this helps. And please reply on the board this time.

(in reply to Guest)

Post #: 10

RE: problem with downlink - 11.May2004 9:55:00 PM

amjad220

Posts: 5
Joined: 9.Apr.2004
Status: offline

I tried every possible solution to resolve the problem but all in vain.

Thanks every one for giving me help.

...

(in reply to Guest)

Post #: 11

RE: problem with downlink - 13.May2004 1:14:00 AM

epsilon

Posts: 2
Joined: 13.May2004
Status: offline

following redbull replies,i just have the following remarks:
1)The dvb-ip can be assigned a private IP from the remote isp..via a dhcp server (since it compare it with MAC it should do a reservation via dhcp)...so what if we assigned the dvb-ip a static ip 10.x.x.x? ISA just need here to do routing from that ip to the NIC connected to internal network...so we dont have to include that 169.x.x in LAT...routing IP enabled would be enuff...since the returned back packets reach their dvb destinations without IsA intervention (unless playing with outcoming ip listener on dvb ip)...but in case of penta it could sometimes be unreachable by the extern company..so you'd feel like you are working on modem...the upstream proxy is used to send modem's packets to the remote ISP but that didnt mean it would expect the returned ip to the same source...theorically all extern nic are reachable (i guess privilege is given to nic not in LaT)..so dvb would be the 1st nic receiving packets...in case of the current problem: i guess it's related to DNS resolving...and the way it forward demands..so before going so far would you pls try to access the web by just typing IPs?? if u succeed..try clearing your dns cache ...

(in reply to Guest)

Post #: 12

RE: problem with downlink - 15.May2004 7:46:00 AM

s_sulaimany

Posts: 1
Joined: 8.May2004
From: Iran
Status: offline

Hi Everyone

Could you tell me about a good resource related to this discussions?

(in reply to Guest)

Post #: 13

RE: problem with downlink - 15.May2004 9:33:00 AM

mohsindabomb

Posts: 173
Joined: 27.Jun.2003
From: London, UK.
Status: offline

Hi Epsilon,

Thanks for writing. I've been working with many Rx providers including SingTel, PCM, Falconstream, Teleglobe and a few others. I've used Penta, broadlogic, c2b2 as well as a few other dvb cards but so far I've never seen the dhcp configuration you told me about. You ALWAYS have to provide the mac of your dvb-ip card to the Rx provider so the mac can be bound to the ip at their end. In this scenario the Rx provider is acting as the switching station that maps IPs to macs and the communication is based on mac addresses once the switching station resolves the ip to the mac.

And yeah, I was wrong about calling ISA stupid at letting in all information from an interface on the LAT. That's the default behavior. I don't know what I was thinking when I wrote that. [Big Grin]

And by the way, I don't really understand how you could assign a 10.x.x.x and get by with it. All traffic coming in from an interface NOT on the LAT, will be subject ISA's firewall policies. And that traffic wouldn't be allowed in. For inbound access from untrusted interfaces you create packet filters or publishing rules. None of which would be helpful here. And the problem here isn't DNS. I've tested it a lot many times. You have to convince ISA to allow incoming traffic from an untrusted interface which is really an absurd idea. ISA 2004 allows access polices on all interfaces so I suggest you try using that so you can keep your network secure while maintaining service usability. Glad to hear your thoughts by the way. Finally somebody welcomed my idea of a discussion. [Smile]

(in reply to Guest)

Post #: 14

RE: problem with downlink - 16.Jul.2004 9:37:00 AM

rogozinskiy

Posts: 17
Joined: 16.Jul.2004
From: Kazakhstan
Status: offline

quote:
Originally posted by cgregory:
robin,

that will not be possible since the outbound request does not go through ISA all packest coming back will be droped . All firewalls will exhibit this behavior.

It's possible - http://support.microsoft.com/?id=284811

(in reply to Guest)

Post #: 15

RE: problem with downlink - 21.Aug.2004 9:47:00 AM

y_mmohd

Posts: 40
Joined: 7.Aug.2004
From: lebanon
Status: offline

Hi To all,
I have an internet connection with 3 network cards. One upload lies line, one download penta card, and the third one for local connection.

I'm using isa as a firewall.
Is there another solution than putting the external ips in the LAT?
I hope to send me to my email.
my emial is: y_mmohd@yahoo.com

Wating your reply.
Thanks

(in reply to Guest)

Post #: 16

RE: problem with downlink - 12.Aug.2007 5:46:03 AM

pooyeshco

Posts: 2
Joined: 12.Aug.2007
Status: offline

i have downlink thru dvb card via dish(satelite)
and uplink/downlink thru phone line
and i am trying to install isa in such way that we could send via phone line and recieve both from phone line and the dvb card.

Would you please help me doing so?
(ISA 2000)

(in reply to y_mmohd)

Post #: 17