Printable View
Hi,
I have been tasked to connect users connecting to an ISA Server directly to a cisco router. This would inturn connect them to our network without having to load an VPN client on the client PC or making holes on the cisco side.
Anyone have any ideas? I have seen a doc on the net explaining what to change on the config of the ISA Server.
The link below:
http://www.tacteam.net/isaserverorg/...2/b2bnat-t.htm
if anyone can help, please let me know.
thanks in advance.
Maybe you can quote the link...not many of us click on them ;)
First thing is
You will need 2 NICs to use the ISA as a firewall...one goes to the router (external) and then one the goes to your network switch (internal)
What services are you going to be running..OWA and Remote Desktop???
MLF
Apologies for only posting link....
the URL only talks about making changes to ISA Server allowing VPN port numbers through and it then has a step by step instruction on how to do it.
Yes, this will be used for http,mail,RDP.
thanks for heads up on 2 nics. did not think it was necessary though? the ISA server will be connected to switch which in turn is connected to router or ISA server will be directly connected to router. Using a Cisco 800 series with ADSL port.
Two nic's won't be needed if your going from router -> switch -> isa, you just need to change your gateway to the ISA server. Are you going to be setting up the vpn on the ISA server, or through the cisco router?
edit: You might explain a bit more on what you're doing / trying to do also.
I have a client that I need to provide services for.
The requirements are:
- Mail ( here they can connect to my exchange server)
- Connectivity : ADSL connection to ISP, then VPN in to my network for services like mail(EXCHANGE), shared folders, applications based on my network.
- Internet Access
Now.....I am not quite sure if the client workstations will be making VPN connections directly to my network or with the ISA server act as the gateway and make the connection on their behalf.
Not sure if I covered everything .... let me know.
I understand that you dont require 2 nics in ISA...........Quote:
Two nic's won't be needed if your going from router -> switch -> isa, you just need to change your gateway to the ISA server. Are you going to be setting up the vpn on the ISA server, or through the cisco router?
But then what would be the point of running ISA as a firewall. :rolleyes:
The ISA would authenticate the user coming in and point them to the services required...NO???
We need way more info like the layout of the network...I dont really know what the question is???
Do you want to know what ports are required???
How are they going to access the exchange...through VPN or Outlook Web access...
To run applications you would need a terminal server or allow them to connect to a machine (which cannot be in use) and use remote desktop.
MLF
ISA does not require a second nic to authenticate users. If you use the ISA with one nic instead of two, you're just setting the ISA as your gateway, and possibly as a proxy server for web(if you're configuring that).Quote:
But then what would be the point of running ISA as a firewall.
The ISA would authenticate the user coming in and point them to the services required...NO???
Well if you dont have 2 nics...then you could just bypass the ISA altogether...
So what would be the point of running ISA......
MLF
It could all depend on your situation. If the client is going to bypass the ISA, they need to know of a gateway to bypass it with. In MY personal situation, we have an ISA server running for all of our employees, then a sonicwall for the servers, it all boils down to what it's needed for.
In reality, we need to know more about the OP's information before we can decide if he needs one or two nics.
nothing a quick scan would gleen
Yes the original poster needs to supply more info....and if he doesnt use the ISA for authentication...and doesnt want to use the cisco VPN client...........then I guess anyone coming in through the router will have access to the the internal network.....
Thats secure :eek:
MLF
If you don't currently have a hardware firewall instead of using a hacked together product like ISA, why not spend $650 on a Cisco ASA 5505?
Is like like a device that runs software to act as a firewall????Quote:
hardware firewall
Did you read the title of the thread???
:rolleyes:
MLF
You could make this statement with lots of hardware, and with his vpn and the cisco client, i think it would be a better assumption for him to get a PIX instead.Quote:
Originally posted here by Net2Infinity
If you don't currently have a hardware firewall instead of using a hacked together product like ISA, why not spend $650 on a Cisco ASA 5505?
edit: Anyways, i guess there shouldn't be any more assumptions untill the OP replys with some information.
I dont think there was any indication that he wasn't going to use the ISA for auth. As for the VPN client, i would guess he wants to setup a vpn between the remote site and his isa / cisco router.Quote:
Yes the original poster needs to supply more info....and if he doesnt use the ISA for authentication...and doesnt want to use the cisco VPN client...........then I guess anyone coming in through the router will have access to the the internal network.....
This is obviously way over my head :cool:
MLF
lol, well this is my understanding. Right now, his users connect to an ISA server (proxy, firewall, whatever). To access a VPN intranet, they have to use a Cisco VPN client (just a normal vpn, but it's used for cisco hardware). He wants to either 1.) setup a VPN from the ISA server to the Cisco equipment that the VPN is running through, or 2.) setup a VPN from cisco router -> cisco equipment.Quote:
Setting up the VPN on the ISA server is very simple, but unless you explain what ISA version you're using (2000 from the link, but that may just be for reference) then there isnt much i can do.
The PIX is esentially a router, firewall, and vpn solution in one. It's just like a router, as it has access lists to control information and translations / fixup to foward ports / protocols. The ASA the other person linked is esentially a complete security appliance. The only reason i could see him linking that is because of what he has heard / read on other forums about ISA server.
Thanks Zunger...
I WAS joking.............. ;)
Back to the question...what is the question????
Net2Infinity
Its not the application\device.....its the configuration and administration that makes them flawed....
MLF
Ok, well just guessing from the information in the orginal post, I would say that ISA is going to be used as the network gateway. I am no expert at ISA server, but I have set it up on a number of Small Business servers.
The configuration should be set up so that all users have to go out via the ISA server. Meaning that they shouldnt have direct access to the ASDSL router, or any hardware firewall/gateway.
Typically this is done via two NIC's in the ISA server, one for intranet, one for internet usage. All workstation get pointed to the ISA server for external access. The second NIC is configured as the local gateway. All incomming traffic (VPN) gets passed thru the ASDSL router, thru any hardware firewall, and authorized via the ISA VPN client. In most cases, ISA server acts like a hardware firewall, via the second NIC. There really isnt any reason to use both the router VPN and the ISA VPN.
Of course if you have youre gateway attached directly to the same switch as your LAN, then users can easily bypass all the ISA settings and security.
ISA server isnt junk, and lots of companies use it. It wasnt "hacked together".
Ok .......... looks like perhaps I need to give some more clarity on request.
One client has 2 sites
SITE A
----------
Cisco Router 877
ADSL Internet
Windows Client Computers
SITE B
-----------
Cisco Router 877
ADSL Internet
Windows Client Computers
Windows Server
ISA Server
SITE needs to access services on SITE B using the ADSL connection through the Internet. The other thing to remember is that BOTH sites IP Addresses will be DYNAMIC because they connect via ADSL network.
The ISA Server is connected to SITE B. We need SITE A to access services such as exchange, sharepoint, shared folders and certain business applications at SITE B.
We need to minimise cost so client wants ADSL and not diginet between 2 sites. They will not be making use of any VPN clients eg. Cisco VPN client. We need to create a LAN across a WAN using ADSL connectivity. The piece of software we have to configure this is an ISA server at B. ISA Server 2004 has been configured on a w2k3 Server box.
This server also needs to be configured to access services on my network. I also have business application required by the client.
I hope this info will clear things up a little bit.
Please help ......me running out of time................ :(
Sounds to me like you need a VPN. First thing you're going to need is some type of Dynamic DNS to setup a hostname to an IP. Im not sure of any, but i would bet someone else on these forums could help you there.
Of what i can see, the 87x series allows VPN's, so you're easiest / most secure way would be to go into the SDM and configure the VPN that way, instead of through the ISA server.
edit: Take a quick look through some of this - http://www.cisco.com/en/US/products/...tion_home.html
I would guess your 877 should have it.Quote:
Cisco Easy VPN Remote is now available on Cisco 800
I agree with the VPN between the two 800 series routers to address your connectivity issue. However, be aware that your connection speed will be the upstream speed of the DSL circuits.Not to mention you will have to share this 256k pipe with everyone that is surfing the internet at the locations.
In addition I find it odd that I got "Negd" for supposedly seeing products instead of answering the question. I contributed by offering a different solution to the posed problem, I am sorry that you took offense to my solution. I don't see anywhere that I indicated that I would sell anybody anything. Anyways, any self respecting security professional wouldn't run any firewall on any Microsoft platform.
Yes as stated you will have some issues with your connection due the upstream\downstream loads and the limitations of your connection...you may want to consider having a dedicated vpn connection and another one for surfing .....use the cisco's to maintain the vpn connection...that should keep it somewhat secure
I still dont understand the purpose of the ISA....or the nature of the apps....
Once the vpn is established site A will be able to get mail from the exchange on Site B...slowly..and basic file sharing....but you wont be able to run an app over vpn. Is it a SQL based app??...you may need to use the vpn for SQL replication....again chewing bandwidth...
All depends on the application and the number of users we are talking about here. You may want to consider a web based app like Share Point....
As for dynamic IPs ...just ask your ISP to get a static for each end....this will help keep your connection consistant...and reliable.
Care to elaborate on that.......and yes I want facts...not just your opinion :rolleyes:Quote:
Anyways, any self respecting security professional wouldn't run any firewall on any Microsoft platform.
BTW.....dont whine about getting negged....cause it will just get you more
From what I can see.....it was a small one (neg)...wait til you get a full whack from a senior... :D
MLF
We want to offer this solution because the cost of diginet connectivity between the sites is hellish expensive in our country. ADSL is about the cheapest solution.
You are correct in saying that we can make use of SDM to conf VPN tunnels. My question then is how many tunnels do we create bearing in mind that they need to have a VPN connection to my network and one to theirs. Remember we are passing through the ADSL internet network so we need the connections to be VPN.
Suddenly, I think I've lost myself...... :(
the request I sent earlier is the jist of it. My competitor has offered a similar solution but using a linux instead of windows. We want to make use of windows.
You want to use windows for what???
The client, The server, the applications????
What business applications....
???
:confused:
MLF
I need to create a site to site VPN connection across an ADSL connection using ISA 2004. That's all I can tell you. That's all I have been given to go on. The request is basically to get the ISA Server connected to the Cisco router without having to use 3rd party VPN software or creating a VPN connection from the client workstation.
dont know what else to tell you. They have accounting packages which run off a central server. They have files which are shared between the two sites. We will be hosting the mail and website. We are going to provide them with exchange instead of pop mailboxes.
Well...you need more info...
Follow your link then...have the cisco forward the required ports to the ISA.....
And good luck
MLF
You're only going to create 1 VPN tunnel. On Both routers, you are going to setup the ip to connect to, the key, along with the type of encryption and anything else. In reality, you don't _need_ the ISA server, unless you are using it as a gateway or proxy server on the local side of the intranet.
My understanding is you have cisco 877 ------- {internet} ----- cisco 877 ----{intranet}---ISA
You're going to create a VPN connection from the 877 to the other 877. You have to find a program (theres some free out there) that will give you a static DNS hostname to your DYNAMIC IP. Unfortunately, to do this, you will need a static translation that makes your ISA (or another desktop) the IP of the IP given to you by your ISP so the software can detect the IP automatically, and your vpn tunnel won't come crashing for an extended period of time everytime an IP changes.
edit: Did the person you talk to specifically say to create a connection between the ISA and the other 877? I would definately suggest NOT doing that and doing it from 877 to 877 since both items are cisco equip on the end. If you had ANOTHER ISA server on the other side, then that might be different.
there is only one ISA server on the B Side.
Zunger you know cisco well?
fairly well, but i've never setup a VPN on a router (only PIX's) or ever used EasyVPN. I would start reading on it, then ask questions as you get to things you don't know. The *DM on the cisco routers should make it pretty easy to setup.