We help IT Professionals succeed at work.

ISA Gateway

Ciderspine
Ciderspine asked
on
Medium Priority
399 Views
Last Modified: 2012-05-05
Hello experts,

Have a slight problem with the following network config I am testing -
                       
                 internet
                 
                  router
                     |   < subnet 1
                   pix
                     |   <subnet 2
                   isa
                     |   <subnet 3
                   lan

My DNS server is on lan. I have a rule on ISA to allow all access to PIX internal, but DNS cannot get to the internet. ISA can hit internet. I am not sure how to configure the gatways on ISA - does anyone have any ideas? PIX is natting everything. ISA is set to route.

Ciderspine.
Comment
Watch Question

Commented:
I have a similar setup in a production environment that works fine.

Is your DNS server using forwarders?

Can you post the "ipconfig /all" output from the DNS box and the ISA box?

BTW, www.isaserver.org is a good resource for configuration info.
Keith AlabasterEnterprise Architect
CERTIFIED EXPERT
Top Expert 2008

Commented:
Is this isa2000 or isa2004?

Author

Commented:
It's isa2004.


Nodes on the lan can ping ISA internal and external but cannot ping PIX internal.
ISA can ping all subnets and internet.

DNS is just forwarding to root servers.

Thanks,

Ciderspine

Keith AlabasterEnterprise Architect
CERTIFIED EXPERT
Top Expert 2008

Commented:
What rule have you put in to allow traffic to pass?

1. To allow ping, you need to have allowed icmp traffic specifically to pass through ISA or have allowed all protocols in which case ICMP is allowed anyway.
2. What sort of client are you using? Secureclient, web proxy, isa firewall client?

Author

Commented:
I have allowed all protocols through ISA
I am running Secureclient - ie. all nodes' gateways point to ISA internal interface.

I have no idea what's wrong. I have checked everything and still doesn't work.

Ciderspine
Keith AlabasterEnterprise Architect
CERTIFIED EXPERT
Top Expert 2008

Commented:
Open the gui.
click on mintoring - logging.
Click on start query.
What rule is showing deny in he log  when you now try and ping from a client?
Enterprise Architect
CERTIFIED EXPERT
Top Expert 2008
Commented:
PS. Does the PIX know it has a route to your internal subnet?

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts

Author

Commented:
This is my where I am so far:

                                  Internal          External
       DNS  >----------------------->ISA>------------------------------->PIX>------------------------Router                        
       10.0.3.2/24         10.0.3.1/24   10.0.2.2/24            10.0.2.1/24   10.0.1.2/24                 10.0.1.1/24
GW  10.0.3.1      GW  10.0.2.1                             GW  10.0.1.1
DNS 127.0.0.1    DNS 10.0.3.1


As I said, ISA can ping internet. DNS (anything on LAN) can ping Int and Ext of ISA, but cannot ping Internal of PIX and beyond? Can anyone see anything obviously wrong with my config?

Thanks,
Ciderspine.                            

Author

Commented:
"PS. Does the PIX know it has a route to your internal subnet?" PIX has route to subnet of ISA external. Is that what you mean?
Keith AlabasterEnterprise Architect
CERTIFIED EXPERT
Top Expert 2008

Commented:
Your call.

The monitoring option will identify if ISA is blocking. If you want to post I can help. If you don't want to...
As I say, your call.
Keith AlabasterEnterprise Architect
CERTIFIED EXPERT
Top Expert 2008

Commented:
No, it was route to isa internal.

10.0.3.0

Author

Commented:
No, PIX doesn't have route to internal. I thought ISA took the traffic from there on. Should I add that route to PIX?

Will post the monitoring in a mo.

Thanks.

Author

Commented:
Uninstalled/reinstalled ISA and all working now - strange. I'll leave the question open for a while in case problem comes back. I'll give you the points Keith because you're always helping me out.

Thanks.

Ciderspine.

Author

Commented:
Found out what's causing the problem. If I configure ISA to route instead of nat it doesn't work. If I configure ISA to nat is works. Should ISA be natting or routing? I assumed it should route not nat as the PIX is doing the natting?

I am configuring this under Networks>Network Rules Tab>Internet Acces>Network Relationships.

Ciderspine
Keith AlabasterEnterprise Architect
CERTIFIED EXPERT
Top Expert 2008

Commented:
If your route, then the routes need to be in place, same as any other network traffic. If you NAT, in the normal ISA way, then you won't ned the routes as ISA will deal with it. Both are perfectly acceptable methods; you just need to do the whole thing depending on which way you want to go.

Regards
keith

Author

Commented:
I am confused. This is how I thought it worked:


In route mode, ISA sends traffic to PIX internal, PIX substitutes ISA IP for PIX global and nats it out to internet. When packet returns, PIX looks up xlate slot and forwards traffic back to ISA interface, which PIX has a direct route to. This is where I am confused - would ISA not receive the packet on it's External interface, and just pass it to its Internal interface which it has a direct route for?

Thanks.

Author

Commented:
Aha! I think I understand.

If ISA is routing, then PIX will see the packet coming from (in my case) 10.0.3.0 network, and PIX doesn't know how to route to that network. But if ISA is natting, PIX sees it from 10.0.2.0 network which it has a direct route to.

Have I got that right?

Thanks.
Keith AlabasterEnterprise Architect
CERTIFIED EXPERT
Top Expert 2008

Commented:
Your coming on in leaps and bounds Ciderspine :)

Author

Commented:
Thanks to you and other experts.

It was your comment "PS. Does the PIX know it has a route to your internal subnet?" that pointed me in the right direction. You knew what the problem was all along - you just wanted me to learn for myslef! lol

Cheers Keith - penny wouldn't have dropped without your help.

Ciderspine

Author

Commented:
One last question if I may - which, if relevant, is faster - ISA to route or nat?

Keith AlabasterEnterprise Architect
CERTIFIED EXPERT
Top Expert 2008

Commented:
Routing (in my view) is quicker as there is are less steps involved. In addition, routing 'can' have benefits if you are using some of the video/audio products such as Netmeeting and the like.

However, I also like the double NAT scenario sometimes. it depends on the quality of the equipment on the outside. With a PIX, there are no issues so routing internally is fine.

Cheers
keith
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.