We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you a podcast all about Citrix Workspace, moving to the cloud, and analytics & intelligence. Episode 2 coming soon!Listen Now

x

ISA 2004 NAT Issues

ryankahan
ryankahan asked
on
Medium Priority
304 Views
Last Modified: 2013-11-16
Greetings Experts

I have an issue with ISA 2004.

I am running 2 identical sites using CISCO 800 Series ADSL routers.

Both sites have fixed IP addresses and both sites are running what we call in South Africa "uncapped ADSL".

The issue is:

Access to international sites from both servers time out, however if I connect a laptop directly to the routers I do not experience the timeout.

So, the issue would then have to be with the ISA Server.

If I do a traceroute to an international site I am able to get a proper response via a laptop connected directly.

When I do a traceroute from the ISA server I get an destination host unreachable.

When I do the same for a local site (20ms ping vs. 600ms ping) I have no problems.

Please assist

Comment
Watch Question

Commented:
Hi,

OK, some checking first..

1. Did you properly declare your local subnets in ISA ?
2. By default, ISA blocks everything. Did you define the proper FW rule(s) for outgoing traffic ?
3. What DNS does your ISA server point to ? If internal, is redirection  properly configured ?


Please post the results here, and I'll be more than happy to assist.

Cheers
Keith AlabasterEnterprise Architect
CERTIFIED EXPERT
Top Expert 2008

Commented:
Open the gui.
Select configuration - networks
Open the internal network - select addresses
What ranges are in here? Are the classful?  ie whole sunets?

Click on monitoring - logging.
Click on start query.
Try your connection. What do you see in the log?

regards
Keith
ISA MCT

Author

Commented:
Greetings Experts.

My DNS is configured to point to my internal DNS which is connected to a seperate Diginet (Leased Line).

My Internal Network was autoconfigured on all private networks and I changed this configuration to match my actual internal network.

My tracert to "international" sites now appears better.

I usually timed out on a ping now I am getting 800ms to www.google.co.za,
but then again I get the same response from my fixed line link.

My FW is configured for all outgoing traffic from the point from where I am doing the monitoring.

Regards
Keith AlabasterEnterprise Architect
CERTIFIED EXPERT
Top Expert 2008

Commented:
800ms is awful (no offence). to the same site i am getting 50ms from the UK.

Can you clarify then if you still have an issue or is all OK?

Author

Commented:
The access has improved here, the reason for the awful ping is our biggest ISP here has a 64MBit link to the states and they are pushing most of our internet traffic through that line... The problem still persists at the 2nd site, the first site it has improved...
Keith AlabasterEnterprise Architect
CERTIFIED EXPERT
Top Expert 2008

Commented:
OK, You have just caught me leaving for work; I'll hit it again tonight when I get back.
Regards
keith
Keith AlabasterEnterprise Architect
CERTIFIED EXPERT
Top Expert 2008

Commented:
Where does the diginet come into the equation? Does both sites have its own DNS server?

Author

Commented:
Perhaps I should elaborate:

I have 1 x DIGINET line = 384kbps
          1 x Uncapped ADSL = 512kbps

The diginet runs the email and the general browsing for the "floor staff"
The ADSL runs a incoming VPN and priority browsing for directors etc...

Enterprise Architect
CERTIFIED EXPERT
Top Expert 2008
Commented:
On the ISA server, set the IE browser proxy settings to none. Now try accessing a site. Same results?

Click on monitoring - logging.
Click on start query.
Try your connection. What do you see in the log?

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
Keith AlabasterEnterprise Architect
CERTIFIED EXPERT
Top Expert 2008

Commented:
Thanks :)
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.