how to "ROUTE" between the 2 interfaces of ISA Server

Guys, if you know the way to solve this problem, please help me

I am building a testing environment for ISA Server.
The ISA Server has 2 network adapters. One adapter has IP address of 192.168.1.5, and the other has IP address of 192.168.123.5. The interface 192.168.123.5 is connected to the router that has internet connection. While, the interface 192.168.1.5 is connected to a switch that has another computer (192.168.1.6) connected.
The problem is: how can I do the routing between the interface 192.168.123.5 to the interface 192.168.1.5, and from that make the network 192.168.1.0 connect to the internet through the interface 192.168.123.5
I tried to set "ROUTE" relationship between the 2 network 192.168.1.0 and 192.168.123.0, but simply it can't work.
Many thanks

HEY! Dont spam the board...

one question, one thread.... delete one of the threads you have started..

Deleted 2nd thread (didn't even notice it originally) and put this in Network Sec as it seems more apropos for here.

When using route what is the error or result from it? And what is your routing table?

you don't mention which operating system you are running on the server.

If it's *nix then something like:

Code:

---

route add 192.168.1.0 192.168.1.5
route add 192.168.123.0 192.168.123.5

route add network (IP of NIC)

do a man route for more detailed info

---

For Windows - I haven't any idea, although it's likely to be similar in a DOS shell.

Check that the routing daemon / service is running.

Quote:

---

you don't mention which operating system you are running on the server.

---

Uhhh.. Simon, AFAIK, ISA (aka Internet Security and Acceleration Server) is a Windows only product. ;)

He'd just need to type route to show the command. The service in question would be RARAs (Routing and Remote Access Service). Is this service enabled, disabled or manual start?

as Industry Standard Architecture! lol

I've learnt something today. I was thinking along the right lines though! ;)

Thanks for that MsMittens.

Hi

I think, you can do this with your settings of the NIC's, see [1].
This is crucial in order to have your ISA work. For ISA configurations,
then see [2] - or ask a more specific question to the ISA.
I couldn't test the stuff I have written below, sorry.

ISA-Server:

"North"-Adapter: That's the NIC to your router:
IP: 192.168.123.5
Subnet mask: 255.255.255.0
Gateway: 192.168.123.1 *** assumption ***

Your south-adadpter, that's the NIC to the switch:
IP: 192.168.1.5
Subnet mask: 255.255.255.0
Gateway: empty!


Your client:
IP: 192.168.1.6
Subnet mask: 255.255.255.0
Gateway: 192.168.1.5

That should work for your purpose.

[1] http://www.isaserver.org/tutorials/C..._Settings.html
[2] http://www.isaserver.org/tutorials/I...iguration.html
(sorry, cannot fix this link...)


/edit: this reference[3] might also be interesting to you
[3] http://www.isaserver.org/tutorials/D...structure.html

Thanks a lot
I will try to do what you suggest tomorrow (now I'm at home)
Because I'm not sure how to deal with the matter. I read something related to "ROUTE" and "NAT" and from that I thought it can help.When I use "ROUTE", the ip addresses will not be hidden by the gateway. Thus, I tried "ROUTE", however, the computer 192.168.1.6 can't ping any computer in the network 192.168.123.0
Thanks sec_ware, I'll do what you suggest tomorrow

I'm confused if the ISA Server can send automatic routing updates to the router that the ISA Server is connected to.
That also confuses me when assigning the IP addresses for the 2 interfaces of the ISA Server. Should the 2 IP addresses belong to the same network, or should they belong to different network?
My colleage told me that I can only have 1 choice: making the external IP address and the interal IP address of the Server belong to the same network, so that I can put the ISA Server in between the router and the switch of our server network. It is because the router is connected to the internet, not the ISA Server.
Please help, thanks

Are there two different networks behind the router? If there isn't then your colleague is partially right. You can have IPs of the same subnet on either side:

IPs of same subnet
Internet <--->router<--->(ext ip)ISA(int ip)<--->LAN

IPs of Diff. Subnets
Internet <--->router<-DMZ->(ext ip)ISA(int ip)<--->LAN

HI buddies,


If i understand it correctly , the scenario is simple... pls correct me if i m wrong.




wkstn ----- switch --- ---------------- ISA ------------------------------------|X|---------Internet
192.168.1.0 192.168.1.5 192.168.123.5


this is perfectly all right, u r trying to run isa over a multihomed system, absolutely fine.
The easiest way , that i would do is -->

1 Try to see if my router is routing via protocol (probably rip) or nat.

2 simply type netsh in the cmd prompt on the ISA server OS ( which wud b something like 2000 or 2003 just a guess...)

3 prompt changes to netsh > type ? u will know the way to do it :-)

I hope thins will help you resolve your issue.

Explaination -> the router is fine and ISA is a multihomed system, using NETSH a hidden part of winodws 2k and later systems , you will be able to configure your device as router and that will automatically route your connected networks :-).

I m sure there can be better ways of doing it, but you might want to try this option if its only about testing.

regards

Now, I am a bit confused :D

Isn't the idea of the ISA to "check" the packages (whatever it is) before sending
it further ( usually intensiv "testing" from the outer world (north) to the inner world (south) )?

A very silly question, but currently I cannot test an ISA, and I do not know the"impact"
of installing an ISA by heart that well: Does a route like you describe not eventually bypass the
ISA server, such that its whole idea is gone? Actually, I don't think so, see below.
*end of very silly question* :)

Isn't the strategy to define within ISA how different "parts" of the network are in relation
to each other (of course, it might be that the ISA internally just creates a route according to
your suggestions)? Then any connection issue now is due to the configuration of the ISA.
It might be helpful if you could tell us, what exactly you want to test (just the firewall, or ... )?

Sorry, that I mess up that problematic even more.


/edit: Try also to configure your router to send everything (maybe after
its interal packet filtering if there is any) to the north-NIC of the ISA-Server, ie 192.168.123.5.

hi sec,

-- i know a bit about ISA , if i understand correctly, it monitors traffic for web request and applications and not the network. ( its not working at layer 3).

-- ISA will watc we requests, traffic on web (as much as i go , again i m not microsft expert ) so any request to internet that will go to ISA , it will actually check it.

-- You have to send data from internal network to external world, simply a route command to add

route add soure mask dest .. should do.

-- We have an internal network and an external network , so actually we will have to Translate the internal network so that it can go to the external network.. (NAT).

Perhaps if we get the complete info. like os ver. , router model, i could try and recreate it and let him know.

rgds

Thanks all for your help
Actually, I'm doing this testing so that I can implement the real ISA Server system for my company's server network.
ISA Server 2004 is running on Windows 2003
At my company's server network, all the IP addresses of the servers are public (not private addresses like what I'm testing).
And there is a problem I'm not so sure: some of you suggest that I type the command "route...", I wonder where I can type that command? It is because when I tried creating the relationship as "ROUTE" between the internal network and the external network, I saw that the internal network can connect to the external network and connect to the internet. And I guess I also have to do this action: adding a static route to the router, indicating the gateway that leads to the internal network. I'm not so sure if I have to specify this static route when using the ISA Server, or the ISA Server will automatically talk to the router. Anyway, I'm still testing on that.
Weekend coming so fast.
Have a nice weekend everyone

Whats the Default gateway?
Whats your subnet mask?

Sounds like you dont have the gateway set properly

For my testing case, the default gateway leading to the internal network is the external (north) interface of the ISA Server 192.168.123.5
Should I set this static route at the router above the ISA Server ?

Now my internal network (192.168.1.0)can access to the internet through the external network (192.168.123.0), but there is no DNS, although I defined the DNS Server address just as defined at the external gateway. Also, the external nework couldn't connect to the internal network, although it can ping only the internal interface of the ISA Server
Anyone know how to troubleshoot?
Thanks

Hi,
I hope MsMittens or someone can help me in this:
When the 2 interfaces of the ISA Server are assigned to the 2 IP addresses that belong to the same subnet, the internal network couldn't connect to the external network. And as a result, the internal network couldn't connect to the internet.
I specified the relationship as "ROUTE" between the internal network and the external network.
And I also asked about this matter in the ISA Server forum, but an expert guy answered that the 2 interfaces of the ISA Server must belong to 2 different network ID's. That really breaks my heart, because my company's server network has the public IP addresses which belong to only 1 network (subnet mask is: 255.255.255.248)
Please help, thanks

Below are the methods that I think of, but ISA Server couldn't do the routing
1) (router)***.208.240.1<--->***.208.240.2(ISA Server)***.208.240.3<--->Internal network (public IP addresses in the network ***.208.240.0, subnet mask: 255.255.255.224)
2) (router)192.168.1.1<--->192.168.1.2(ISA Server)***.208.240.1<--->Internal network (public IP addresses)

Anyone who knows the way?
Thanks