ISA Server Basic Configuration Cont??

I followed the explanation by keith_alabaster on question ID  22454299 on the basic configuration on ISA server 2006, the server has two nic cards, one is for internet access and the other is for handling internal traffic to our programs. The server allows users access to the internet depending on the proxy configuration or denies it by proxy misconfiguration on group policies, but now we want to use ISA server to allow limited access. What kind of network template should I use when configuring ISA? As soon as I install it the server loses internet access because I only declare the internal network the nic card without gateway nor dns info. I don't know how to declare the other card that allows the internet and has all the router info. Is there a second part to that question?
carloslasoAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Keith AlabasterEnterprise ArchitectCommented:
Depends on your configuration - If there is another firewall between ISA and the Internet then select the back-end firewall. If ISA is the first firewall that traffic will hit as it comes in through your router/gateway then select front-end.

The main difference is that as a front-end firewall ISA will provide the NAT function to 'hide' the internal IP addresses by default. To be honest, this is the option I always use when I do not have DMZ interfaces involved on the ISA itself.

Keith
0
carloslasoAuthor Commented:
So I should not declare the nic I use to handle internal traffic? Should I declare the one that has internet access as the internal and use the Front-end template?
0
Keith AlabasterEnterprise ArchitectCommented:
??

The NIC that has internet access is the external, the other is the internal. When you run the template, you will be asked to give ip addresses on the internal card only - and MUST include ALL internal addresses. So do NOT add all private addresses, just enter those relevant to your internal network.

For example, if you have 192.168.10.200 as the ip address on the uinternal nic, you would enter 192.168.10.0 - 192.168.10.255. All addresses includes the Network ID and the broadcast address. ALL IP addresses NOT entered into the LAT, when it prompts, will be treated as external from your inside network.
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

carloslasoAuthor Commented:
I configures ISA using the EDGE network template and i am able to ping yahoo and google but i cannot do anything more, i noticed that the DHCP server disconnects as soon as i close that window.
0
Keith AlabasterEnterprise ArchitectCommented:
The internal nic MUST have dns info - it must point to the internal dns server.
The internal nic does not have a default gateway.

The external nic MUST NOT have dns info
The external nic WILL have a default gateway of the external router.

The Internal DNS server MUST have its forwarders set to point at the external (ISP) dns servers.

What DHCP server? ISA nics (internal & external) should have static ip addresses or their respective subnets.
0
carloslasoAuthor Commented:
I will try some of those MUSTs and WILLs, I may have put something wrong there.

As for the DHCP server, is that needed to assign IPs to the PCs being protected or controlled by ISA Server or they also have to have Static IP Addresses?

I only have one server where I installed Windows 2003 and ISA 2006, is that allowed or should I have a different server just for ISA? If so, can it be installed on a virtual pc or a separate box (server) is required?
0
Keith AlabasterEnterprise ArchitectCommented:
OK - the dhcp server can set the internal client IP's - thats fine. I read your post as saying that the dhcp server was supplying the ISA server withis internal ip address.

ISA should not be run on a domain controller unless you are using windows SBS server. Best practice states that ISA should not be run on a virtual machine in a production environment but i have seen it done and it seems to work OK. MS will not support that installation though. Personally I always use a separate box for customers as it is best practice. In my test labs though? - always on Virtual PC (not virtual server).

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
carloslasoAuthor Commented:
I forgot to mention that I got Internet explorer to work on the server (not on the PCs), using the info on the last post of the following link: http://tinyurl.com/6cxgsm , but not firefox, tzo  and some other apps.  I still need to check some of the IPs that I may have put wrong in the DNS of the nics
0
carloslasoAuthor Commented:
I'm accepting this as an answer because all of what the author posted helped me get Internet to the server, Internet access to the rest of the programs can be investigated on different questions on this forum or using the search option.
0
Keith AlabasterEnterprise ArchitectCommented:
Thanks :)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Forefront ISA Server

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.