ISA 2004 NAT Issues

Greetings Experts

I have an issue with ISA 2004.

I am running 2 identical sites using CISCO 800 Series ADSL routers.

Both sites have fixed IP addresses and both sites are running what we call in South Africa "uncapped ADSL".

The issue is:

Access to international sites from both servers time out, however if I connect a laptop directly to the routers I do not experience the timeout.

So, the issue would then have to be with the ISA Server.

If I do a traceroute to an international site I am able to get a proper response via a laptop connected directly.

When I do a traceroute from the ISA server I get an destination host unreachable.

When I do the same for a local site (20ms ping vs. 600ms ping) I have no problems.

Please assist

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.


OK, some checking first..

1. Did you properly declare your local subnets in ISA ?
2. By default, ISA blocks everything. Did you define the proper FW rule(s) for outgoing traffic ?
3. What DNS does your ISA server point to ? If internal, is redirection  properly configured ?

Please post the results here, and I'll be more than happy to assist.

Keith AlabasterEnterprise ArchitectCommented:
Open the gui.
Select configuration - networks
Open the internal network - select addresses
What ranges are in here? Are the classful?  ie whole sunets?

Click on monitoring - logging.
Click on start query.
Try your connection. What do you see in the log?

ryankahanAuthor Commented:
Greetings Experts.

My DNS is configured to point to my internal DNS which is connected to a seperate Diginet (Leased Line).

My Internal Network was autoconfigured on all private networks and I changed this configuration to match my actual internal network.

My tracert to "international" sites now appears better.

I usually timed out on a ping now I am getting 800ms to,
but then again I get the same response from my fixed line link.

My FW is configured for all outgoing traffic from the point from where I am doing the monitoring.

How do you know if your security is working?

Protecting your business doesn’t have to mean sifting through endless alerts and notifications. With WatchGuard Total Security Suite, you can feel confident that your business is secure, meaning you can get back to the things that have been sitting on your to-do list.

Keith AlabasterEnterprise ArchitectCommented:
800ms is awful (no offence). to the same site i am getting 50ms from the UK.

Can you clarify then if you still have an issue or is all OK?
ryankahanAuthor Commented:
The access has improved here, the reason for the awful ping is our biggest ISP here has a 64MBit link to the states and they are pushing most of our internet traffic through that line... The problem still persists at the 2nd site, the first site it has improved...
Keith AlabasterEnterprise ArchitectCommented:
OK, You have just caught me leaving for work; I'll hit it again tonight when I get back.
Keith AlabasterEnterprise ArchitectCommented:
Where does the diginet come into the equation? Does both sites have its own DNS server?
ryankahanAuthor Commented:
Perhaps I should elaborate:

I have 1 x DIGINET line = 384kbps
          1 x Uncapped ADSL = 512kbps

The diginet runs the email and the general browsing for the "floor staff"
The ADSL runs a incoming VPN and priority browsing for directors etc...

Keith AlabasterEnterprise ArchitectCommented:
On the ISA server, set the IE browser proxy settings to none. Now try accessing a site. Same results?

Click on monitoring - logging.
Click on start query.
Try your connection. What do you see in the log?

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Keith AlabasterEnterprise ArchitectCommented:
Thanks :)
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Software Firewalls

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.