How to access a computer in the DMZ

The last para should've started  'if you don't want to run the new network template...

i am  not sure if this works! happy attempt

static (inside, DMZ)  192.168.17.x 255.255.255.x 192.168.17.x 255.255.255.x 0 0

this will set communication between inside and DMZ for the mentioned network.

let me know.

sorry for the delay, the solution partially worked.

Raj, I followed your suggestion with the

'Create a New Network' wizard (Select Perimeter Network > Add Adaptor/Subnet) and create a Network rule to router traffic from the perimeter to internal network.

I am able to use a browser to goto http://192.168.1.3.  However, https://192.168.1.3:10000 does not work.

It seems that port 80 is the only one allowed across the network rule.

By default ISA will only allow SSL connections over port 443. You have to use the ISA Tunnel Port tool (ISA_tpr.js) - available from www.isatools.org to add a new tunnel port or range. You have to run the file from a command prompt to add a custom port/port range.

Syntax: isa-tpr.js /add MySSL 10000

You should also create a Firewall Policy to allow traffic from internal to DMZ. Allow "all outbound traffic" for "all users" to test and lock it down later as required.

(ISA_tpr.js)  Worked like a charm.  Thanks

Now there is just one more problem. Since the change, one of my server publishing rules stopped working.

TCP:5222 is getting denied.  This is the GTalk protocal used for my instant messaging server OpenFire.

the OpenFire server is on the same computer as ISA.  I created a server publishing rule for 5222 to the internal NIC.  This used to work, but now Monitoring shows that the connection is denied by the default rule.  I moved the rule to the top of the list just in case, but it still does not recognize the protocal and calls it unidentified IP Traffic.

I created a user defined Protocol "gtalk In", TCP Inbound 5222.

How do i trouble shoot that?  

It's not a good idea to host anything on the ISA Server. I recommend you move it off to a different server asap. If that is not an option, you can always create an access rule to allow port5222 in from External to localhost.

Thanks Raj,

The Server is an SBS 2003 server. so it has so many violations of common sense that i am surprised it has not failed out of its own embarrasement. currently it is running exchange, SQL, ISA, Fax, Web, PDC, Etc.  It is at the end of its life and will be replaced in the upcoming months, but I need the functionality now.

I will try the access rule.  So the rule should allow access from 192.168.1.200 (external) to 192.168.17.2 (internal)?

Do you know why it is labeled as unidentified traffic?  Shouldn't the defined protocol be labeled in the monitor?  My fear is that for some reason, ISA is not identifying the traffic correctly and therefor not applying the rule.

I am not sure what stopped the rule working, like you said SBS 2003 is a complex product and it will be hard to guess what went wrong.

The rule you have to create is a standard access rule allowing access from External (the network entity - not the IP) to localhost (network entity) or internal IP - depending on which adaptor the application is listening on.