Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

ISA Gateway

Posted on 2006-03-30
21
Medium Priority
?
380 Views
Last Modified: 2012-05-05
Hello experts,

Have a slight problem with the following network config I am testing -
                       
                 internet
                 
                  router
                     |   < subnet 1
                   pix
                     |   <subnet 2
                   isa
                     |   <subnet 3
                   lan

My DNS server is on lan. I have a rule on ISA to allow all access to PIX internal, but DNS cannot get to the internet. ISA can hit internet. I am not sure how to configure the gatways on ISA - does anyone have any ideas? PIX is natting everything. ISA is set to route.

Ciderspine.
0
Comment
Question by:Ciderspine
  • 11
  • 9
21 Comments
 
LVL 3

Expert Comment

by:dglenp
ID: 16348374
I have a similar setup in a production environment that works fine.

Is your DNS server using forwarders?

Can you post the "ipconfig /all" output from the DNS box and the ISA box?

BTW, www.isaserver.org is a good resource for configuration info.
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 16348990
Is this isa2000 or isa2004?
0
 

Author Comment

by:Ciderspine
ID: 16349154
It's isa2004.


Nodes on the lan can ping ISA internal and external but cannot ping PIX internal.
ISA can ping all subnets and internet.

DNS is just forwarding to root servers.

Thanks,

Ciderspine

0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 16350079
What rule have you put in to allow traffic to pass?

1. To allow ping, you need to have allowed icmp traffic specifically to pass through ISA or have allowed all protocols in which case ICMP is allowed anyway.
2. What sort of client are you using? Secureclient, web proxy, isa firewall client?
0
 

Author Comment

by:Ciderspine
ID: 16351428
I have allowed all protocols through ISA
I am running Secureclient - ie. all nodes' gateways point to ISA internal interface.

I have no idea what's wrong. I have checked everything and still doesn't work.

Ciderspine
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 16351461
Open the gui.
click on mintoring - logging.
Click on start query.
What rule is showing deny in he log  when you now try and ping from a client?
0
 
LVL 51

Accepted Solution

by:
Keith Alabaster earned 2000 total points
ID: 16351464
PS. Does the PIX know it has a route to your internal subnet?
0
 

Author Comment

by:Ciderspine
ID: 16351485
This is my where I am so far:

                                  Internal          External
       DNS  >----------------------->ISA>------------------------------->PIX>------------------------Router                        
       10.0.3.2/24         10.0.3.1/24   10.0.2.2/24            10.0.2.1/24   10.0.1.2/24                 10.0.1.1/24
GW  10.0.3.1      GW  10.0.2.1                             GW  10.0.1.1
DNS 127.0.0.1    DNS 10.0.3.1


As I said, ISA can ping internet. DNS (anything on LAN) can ping Int and Ext of ISA, but cannot ping Internal of PIX and beyond? Can anyone see anything obviously wrong with my config?

Thanks,
Ciderspine.                            
0
 

Author Comment

by:Ciderspine
ID: 16351501
"PS. Does the PIX know it has a route to your internal subnet?" PIX has route to subnet of ISA external. Is that what you mean?
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 16351505
Your call.

The monitoring option will identify if ISA is blocking. If you want to post I can help. If you don't want to...
As I say, your call.
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 16351510
No, it was route to isa internal.

10.0.3.0
0
 

Author Comment

by:Ciderspine
ID: 16351529
No, PIX doesn't have route to internal. I thought ISA took the traffic from there on. Should I add that route to PIX?

Will post the monitoring in a mo.

Thanks.
0
 

Author Comment

by:Ciderspine
ID: 16351592
Uninstalled/reinstalled ISA and all working now - strange. I'll leave the question open for a while in case problem comes back. I'll give you the points Keith because you're always helping me out.

Thanks.

Ciderspine.
0
 

Author Comment

by:Ciderspine
ID: 16351637
Found out what's causing the problem. If I configure ISA to route instead of nat it doesn't work. If I configure ISA to nat is works. Should ISA be natting or routing? I assumed it should route not nat as the PIX is doing the natting?

I am configuring this under Networks>Network Rules Tab>Internet Acces>Network Relationships.

Ciderspine
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 16351753
If your route, then the routes need to be in place, same as any other network traffic. If you NAT, in the normal ISA way, then you won't ned the routes as ISA will deal with it. Both are perfectly acceptable methods; you just need to do the whole thing depending on which way you want to go.

Regards
keith
0
 

Author Comment

by:Ciderspine
ID: 16352149
I am confused. This is how I thought it worked:


In route mode, ISA sends traffic to PIX internal, PIX substitutes ISA IP for PIX global and nats it out to internet. When packet returns, PIX looks up xlate slot and forwards traffic back to ISA interface, which PIX has a direct route to. This is where I am confused - would ISA not receive the packet on it's External interface, and just pass it to its Internal interface which it has a direct route for?

Thanks.
0
 

Author Comment

by:Ciderspine
ID: 16352240
Aha! I think I understand.

If ISA is routing, then PIX will see the packet coming from (in my case) 10.0.3.0 network, and PIX doesn't know how to route to that network. But if ISA is natting, PIX sees it from 10.0.2.0 network which it has a direct route to.

Have I got that right?

Thanks.
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 16353665
Your coming on in leaps and bounds Ciderspine :)
0
 

Author Comment

by:Ciderspine
ID: 16353779
Thanks to you and other experts.

It was your comment "PS. Does the PIX know it has a route to your internal subnet?" that pointed me in the right direction. You knew what the problem was all along - you just wanted me to learn for myslef! lol

Cheers Keith - penny wouldn't have dropped without your help.

Ciderspine
0
 

Author Comment

by:Ciderspine
ID: 16353792
One last question if I may - which, if relevant, is faster - ISA to route or nat?

0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 16353805
Routing (in my view) is quicker as there is are less steps involved. In addition, routing 'can' have benefits if you are using some of the video/audio products such as Netmeeting and the like.

However, I also like the double NAT scenario sometimes. it depends on the quality of the equipment on the outside. With a PIX, there are no issues so routing internally is fine.

Cheers
keith
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Sometimes you might need to configure routing based not only on destination IP address, but also on a combination of destination IP address (or hostname) and destination port number. I will describe a method how to accomplish this with free tools. …
I'm a big fan of Windows' offline folder caching and have used it on my laptops for over a decade.  One thing I don't like about it, however, is how difficult Microsoft has made it for the cache to be moved out of the Windows folder.  Here's how to …
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
In a question here at Experts Exchange (https://www.experts-exchange.com/questions/29062564/Adobe-acrobat-reader-DC.html), a member asked how to create a signature in Adobe Acrobat Reader DC (the free Reader product, not the paid, full Acrobat produ…

571 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question