Solved

ISA Server behind PIX 515

Posted on 2004-08-20
7
262 Views
Last Modified: 2008-11-18
Ok lets let the dumb questions fly!  I gotta learn somehow right?
I have been handed a fun little project, this compnay has a PIX 515 and wants to install ISA server to monitor its users.  How do I setup the NIC card on the ISA box to see the interent through the PIX.  Assuming that this is how I have to go about it.  ISA is not installed yet and I have two NIC cards in the machine where ISA is going to be installed.
0
Comment
Question by:SoonersFan
  • 3
  • 3
7 Comments
 
LVL 36

Accepted Solution

by:
grblades earned 250 total points
ID: 11852964
Hi SoonersFan,
ISA can act as a router/firewall but as you already have a very good PIX firewall I would not use the ISA in this manner aswell as it will just complicate the configuration and wont give you any benefit.

What I would do is only configure the ISA server with a single network interface and set it with a fixed IP address on the network with the default gateway set to the PIX's IP address.
Then configure the web browser of everyones machine to use the ISA server as the proxy server.
Then configure the outbound access-list on the PIX to enable web access from the ISA server only.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 11853937
I second grblades' suggestion. Use the ISA as a standalone, single nic proxy server only. If you have Windows 2003 and the ISA 2004, the proxy reports are so detailed it'll knock your socks off.. and setup is very simple with the wizards in 2004.
0
 

Author Comment

by:SoonersFan
ID: 11855472
"Then configure the web browser of everyones machine to use the ISA server as the proxy server."

I did this and it is working from a web browser standoint but it isnt showing anythign in ISA as far as a connection.

"Then configure the outbound access-list on the PIX to enable web access from the ISA server only."

Can you give me an example of what this woudl look like and where.  I don't know much about the PIX at all.

Thanks
0
VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

 
LVL 36

Expert Comment

by:grblades
ID: 11855610
Assuming you don't already have an access list to restrict outbound traffic which is the default and therefore everything is permitted you could add something like:-

access-list inside_in permit tcp host 10.0.0.1 any eq www
access-list inside_in permit tcp host 10.0.0.1 any eq https
access-list inside_in permit tcp host 10.0.0.1 any eq ftp
access-list inside_in deny tcp any any eq www
access-list inside_in deny tcp any any eq https
access-list inside_in deny tcp any any eq ftp
access-list inside_in permit ip any any
access-list inside_in permit icmp any any
access-group inside_in in interface inside

This allows the machine with IP 10.0.0.1 to access the web and ftp. Substitute this IP with the IP address of your ISA server.
The next 3 lines deny web and ftp directly from any other machine so they have to go via the ISA server.
The remaining two lines permit everything else.

Ideally you should not have the last two lines but should just permit everything that you wish to allow. This can be a bit time consuming to work out and it is best to implement in stages.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 11855620
Which version ISA are you using?

Your pix config would restrict all outbound web access to only the Proxy's IP address.
Proxy IP address = 192.168.1.100

PIX config:

access-list proxy_restriction permit tcp 192.168.1.100 any eq www
access-list proxy_restriction deny tcp any any eq www
access-list proxy_restriction permit ip any any
access-group proxy_restriction in interface inside

0
 
LVL 79

Expert Comment

by:lrmoore
ID: 11855633
damn! I'm typing too slow today...
0
 
LVL 36

Expert Comment

by:grblades
ID: 11855664
There must have only been seconds between us.
At least we both gave the same answer ;)
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
anyconnect password change 2 33
Cisco VSS or VCP on GNS3 or IOU 3 81
Auto Smartport macro for Dell and HP laptops 2 54
RDP ISR4321 Cisco Router 7 23
I have been asked to explain on many, many occasions the correct way to setup network cards and DNS settings on ISA Server 2004, 2006 and forefront Threat management gateway (FTMG) and have willing done so. I have also promised my self everytime tha…
This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now