Solved

SBS2003 local network / internet access question!

Posted on 2007-11-26
7
469 Views
Last Modified: 2012-08-13
Hi,

Currently at an office there is a SBS2003 with AD and Exchange. It has two NICS. One for the WAN and one for the LAN.

It is a DHCP server and its IP Address is 192.168.16.2
On the other NIC, it has a public, static IP which is the MX server for the domain.
Computers on the network use 192.168.16.2 as their default gateway to route through to the internet. All is working fine.

The client however has decided to have a CISCO Vpn box installed with a new SDSL Line. the Cisco PIX will now have the static public IP on the outside interface and its inside interface is set to 192.168.16.253. The DHCP server is not active.

My Question is, I'm about to attach the Cisco to the SBS2003...do I now only use one of the NICS on the SBS2003? Also, what changes will I have to make to the DNS and DHCP server so that the clients will continue being able to access the internet? Surely a default gateway of 192.168.16.2 will no longer work?

Anything else I should be wary about before I start doing this?

Thanks in advance...
0
Comment
Question by:magnus911
  • 2
  • 2
  • 2
  • +1
7 Comments
 
LVL 18

Expert Comment

by:Don S.
Comment Utility
If you are going to use the Pix as your sole firewall, then you would not use the WAN interface on the SBS and you would need to change all the clients (and SBS) to use 192.168.16.253 as their gateway address.  Otherwise if you still want to go through the SBS to get to the Internet, then you must NOT use 192.168.16.x as an address on the PIX LAN interface.  Use pretty much any other private address range, change the WAN interface address on the SBS to something in that range, setup a static NAT entry in the PIX to point to the SBS server for the needed ports (needs to be done in any case), no other changes should be needed I don't think.
0
 
LVL 1

Author Comment

by:magnus911
Comment Utility
Thanks.

1) if i go with option 1, is there anyway that I can tell the SBS to give out 192.168.16.253 as the gateway when assigning automatic addresses with DHCP?
2) if not, and i go with option 2, how easy is it to change the inside address of the PIX, given that it's already been set up to be 192.168.16.253?

thanks!
0
 
LVL 12

Expert Comment

by:weareit
Comment Utility
Easiest is to use one NIC instead of both.

Disable the NIC that is called Network Connection (this should currently be configured as your outside NIC).  Then rerun the CEICW from the Server Managerment Console -->Internet and Email --> Connect to the Internet.
Click Next.
Choose Broadband and click Next.
Select the option for 'A local router device with an IP address' and click Next.
Enter in the relevent information (ISP DNS Servers and Router LAN Address [192.168.16.253]), select the checkbox for 'My server uses a single network connection for both Internet access and the local network' and click Next.  You will receive a message, clicking Yes will provide a help MMC snap-in talking about firewall configuration.
Choose the websites you want to allow access for and click Next.
From this point on you should not have to make any other changes or modifications so where possible choose Do Not Change and click Next.
When you get to the end click Finish and viola, your server is reconfigured.  DNS and DHCP should not need any further modifications.

-saige-
0
Free book by J.Peter Bruzzese, Microsoft MVP

Are you using Office 365? Trying to set up email signatures but you’re struggling with transport rules and connectors? Let renowned Microsoft MVP J.Peter Bruzzese show you how in this exclusive e-book on Office 365 email signatures. Better yet, it’s free!

 
LVL 12

Expert Comment

by:weareit
Comment Utility
I take back my last part, you will need to modify the DHCP Scope Options so that your router option uses the proper IP Address.

-saige-
0
 
LVL 18

Expert Comment

by:Don S.
Comment Utility
If the client computers are using the DHCP services of the SBS, then it's pretty easy to change the settings in the SBS DHCP server.  Just open up the DHCP MMC console and change the Gateway address on scope.

Make sure to re-run the IECEW after you change the address of the WAN interface (2) or Disable it (1)
0
 
LVL 7

Accepted Solution

by:
carcenea earned 250 total points
Comment Utility
There are a couple ways to do what you're saying but here is what I would recommend:

First of all, here is how you want your hardware configurations setup. Keep your server plugged into your local network the way it is now. Next, plug your VPN box in between you internet hookup and the NIC that has a static public IP.

Now give your VPN box nic that connects to the internet your static public IP that you had on your server. Then, change the static IP on your server to another local IP like 192.168.116.1 and the other NIC on your VPN box to 192.168.116.2.

Finally, on the VPN box, you need to tell it to forward all traffic inbound for port 25 to 192.168.116.1(server). That way you'll still receive your mail and none of your clients need any settings changed for them to access the internet.

Hope this helps!
0
 
LVL 1

Author Closing Comment

by:magnus911
Comment Utility
You were all right really but this was the preferred solution...
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

I wrote this article to explain some important DNS concepts that should be known to avoid some typical configuration errors I often see in forums. I assume that what is described here is the typical behavior of Microsoft DNS client. I don't know …
I’m often asked about newer and larger USB drives connected to SBS2008 and 2011 failing Windows Server Backup vs the older USB drives not failing. As disk space continues to grow and drive technology change SBS2008 and some SBS2011 end up with the f…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now