ISA in DMZ with PIX
Posted on 2008-01-30
Im trying to setup an ISA 2006 Ent box in a configuration I have never done before and Im running into problems.
We have two PIX firewalls with a screened DMZ, the idea is to replace the inside PIX with ISA. I have setup ISA with two NICs and everything appears fine on the ISA, except I cant publish anything!! Access rules (outgoing) work fine, however when I try to access services on the LAN (192.168.0.0) network I always get denied. No matter what publishing rules I put in when I look in monitoring the traffic always gets caught by the default enterprise rule, and thus denied.
One thing I wasnt sure of is whether I have to specify the DMZ network in ISA, or do I treat this as the External network like I would normally (if the outside NIC was on the internet)?? I have tried specifying the DMZ network and changing the publishing rules/listeners to suit but makes no difference.
After wrestling with it for a while I decided to go back to basics, and tried the following experiment:
I setup a laptop on the LAN (192.168.0.100) with the telnet server service running, and created a publishing rule to allow the telnet server traffic from anywhere (listening on external) to 192.168.0.100. I connected my other laptop to the DMZ switch with the following NIC settings
(note the laptop running telnet has the settings IP 192.168.0.100/255.255.255.0/192.168.0.254 and correct DNS entries)
So I tried to telnet to 192.168.0.100 and looked in the monitor, I see that it was getting denied saying network rules denied. So I thought this was weird as I had never had to create a network rule for publishing before ??? & So I created a network rule to NAT from External to Internal and tried again. This time I get FWX_E_POLICY_RULES_DENIED even though the rule is in there and setup correctly.
Just to note that the default enterprise policy is set to be applied AFTER the array policy also. I also tried changing the setting where requests appear to come from the ISA or original client still no joy.
Could someone give me some clues on this, what Im trying to do isnt rocket science but it just doesnt work!!