Having installed ISA 2006 and patched it with SP1, there was a need to use it as web proxy/cache solution. The Internal networks were defined as 10.100.8.*;10.100.9.* etc during installation.
The dual homes ISA server has a public ip of (2.42.211.241) on the outside interface on which I intend to NAT outgoing traffic.
The two interfaces of the cisco router 1800 series are already on public IPs.
What do I do now??
Configure Ips on the router interfaces and then
define dynamic routing by using rip and define two networks ( 1.111.229.0 & 2.42.211.0) ? or use static route commands?
Second, on ISA , I create a rule: Allow > HTTP/HTTPS > Internal > External > All users ( I don't want to authenticate yet, though I'll enable LDAP later)
Then what?
Consider me a novice pls...and guide step wise...
Thanks in advance!!
Network Diagram
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Eric, would implement this in about an hour and send an update, I was wondering though, wuld my clients that would technically be called as SecureNet clients, talk to my ISA is I push the IP of 10.10.8.166 within IEs LAN proxy server settings via my Group Policy?
I cannot make all my Internet bound traffic pass through the ISA just yet!!
If you just set the default gateway of your clients to 10.10.8.166 they will be SecureNat clients. Using SecureNat your clients will be able to access any internet services that you allow on your firewall, you won't be able to use authentication on any of the rules as SecureNat clients don't authenticate. You will need to create your rules for 'All users'.
If you set the ISA server address as your clients proxy address they will be Web Proxy Clients. This allows you to use authentication on HTTP, HTTPS and FTP firewall rules.
Thanks for clarification Eric. Problem is, I cannot set 10.10.8.166, as a DG for my clients spread across 10.10.*.* subnets.
As of now, I only need to take the web traffic of 10.10.20.* and 10.10.30.* subnets, outside via this ISA. For all my subnets including these, their DG points to another campus LAN core switch where all my application servers reside...and there is a filrewall too for internet connectivity. The reason for bringing in this ISA to take off some of the internet bound traffic off that other link.
So, I guess, my option is to only use my clients as 'Web proxy Clients' and can use authentication with my 2003 AD by enabling LDAP. If my domain name is ab.company.local, what would be my LDAP context to be filled in?
I don't want to make this ISA as part of domain, for soon, I need to shift this to a DMZ area for publishing my OWA, once this thing starts working.
I am implementing your steps now...!!
Hi Fahim,
When you say your clients are spread across 10.10.x.x subnets, do you mean you are using 255.255.255.0 net masks, or 255.255.0.0 net masks? The clients will need to be on the same subnet as the internal NIC of the ISA server unless you are routing between clients and ISA server.
If your clients already have a default gateway of another router somewhere, I'm not sure whether setting them to use your ISA as a web proxy would work. I guess that HTTP/HTTPS/FTP traffic might be routed via ISA by the web proxy client, and all other traffic would go to your DG? Not sure about this.
Business Accounts
Answer for Membership
by: EricTVikingPosted on 2008-09-25 at 12:57:02ID: 22573287
Hi Fahim, If you setup ISA as an edge firewall, that will get you most of the way there. ISA Server -> Configuration -> Networks -> Templates -> Edge Firewall
Follow the wizard entering your internal address range (i.e. 10.10.x.x) and choose a basic rule set to get you started.
If you then go to ISA Server -> Configuration -> Networks -> Network Rules Tab, you should see an Internet Access rule that relates your internal network to external with a NAT relationship.
Not sure about the setup of the Cisco as that's not my area of expertise, but I would have thought a static route between 1.111.229.0 & 2.42.211.0 would do the job.