Gentlemen,
we have an ISA server 2006 array (isasrv) , with two ISA servers (isasrv1 & isasrv2) with Network Load Balancing.
They are used almost exclusively as proxy servers with NLB enabled, so they have one ethernet configured for receiving the requests from the clients and the same for sending the request to the internet, and another ethernet for intra-array communication (synchronization etc).
The array had only one Configuration Storage Server (CSS), so we installed the component on the second one and started acting as an alternate CSS.
Then we shut down the 1st ISA server and let the array work only with the 2nd server. The array (with the isasrv2) seemed to work OK, and we could manage the policy (make changes, apply and they worked).
What we want to achieve now is to transfer the whole array in a new DMZ (that means change the IP address of the ISA servers and the array). But we want to do it one server at a time, so that the organization can continue working with the second ISA, perform the changes on the first and verify the configuration before transfering all the clients (using DNS) to the first ISA server. Then as a final step we are going to perform the same changes in the second ISA and attach it on the same subnet as member of the array again.
The steps we are planning to follow are these:
1. turn on the isasrv1 on a different switch, than the isasrv2 (so that they can not communicate)
2. change the IP address of the ethernet card
3. perform necessary changes in the NLB configuration (not sure excactly what to change here)
4. make changes in the policy (e.g. use an upstream proxy, change the networks, subnets, rules etc)
3. verify the new configuration by using a few test clients
(in all of the above steps we will continue using the same array name etc)
after verifying the first ISA server configuration we want to transfer all the users to work on the newly configured ISA.
Then we plan making the following changes on isasrv2:
1. transfer it on the same switch as the isasrv1
2. change the ip address of the Ethernet adapter to match the isasrv1 subnet
3. make the appropriate NLB settings changes
3. apply the same policy as the isasrv1 (will the export from the first ISA and import on the second work?)
4. start synchronizing again with isasrv1 and become again active member of the array
Any comment, suggestion, guide, link etc. from your experience would be much appreciated.
Start Free Trial
