Threat Management Gateway Replacing PIX

Really you would want to be on 2008 R2 but ordinary 2008 is OK as long as you have SP2 deployed also - minimum requierment.

If you are using the ISP-R features for load-balancing and failover then the FTMG's have to have a minimum of three nics installed (2 x external, one internal facing). Up to you where you put them in the topology but it is best practice to ensure that the external facing nics have a direct route to the Internet.

The main issue will be to ensure that nothing that sits between the FTMG array/pair has a route to the internal networks unless it passes through the FTMG boxes to get there. For example, if you have spare interfaces on the router sitting between FTMG and the Internet and you connect a spare interface to the internal network directly, you will likely end up with routing loops and spoofing issues.

Keith

Thanks Keith
Just to confirm it is 2008 R2 on both boxes.
What I have done is the following, both servers have a quad port card fitted, and 2 embedded NIC's, one of which will be used for ILO.
There are 2 cables coming from each quad port currently, the cables go to seperate 3560 routers and are teamed as one logical address for redundancy, thats my internal connection.
I have just cabled up 2 more lengths, the plan is to plug 1 cable into one of the 2 spare quad ports, or the remaining embedded one, not sure which is best, but anyway both these will now go directly to the modem, which has 3 spare ports. This will be the direct to external routes on both.

Can I with this planned topology, do the following.
Set up an array, assign it with a IP address and then configure it so that it balances the load and sends external out to the internet?

Both units would have their own addresses plus the shared VIP. You would have to use NLB on the internal to balance outbound across the two FTMGs. An array in itself does not provide load-balancing. If you have the Enterprise version then you can use integrated NLB - driven from within FTMG, else it is the good, old-fashioned, normal NLB approach.

Sorry been a while since I done this.
So I connect a cable from both servers T1 and T2 to the layer3 switches, assign them unique  ip addresses in the same subnet.
Then I NLB these 2 connections to become my cluster which has its own IP address
Then I also have a cable from each server going to the modem, this will be using I guess a DHCP apipa address ?

Then use TMG to connect all the above, but also config the layer 3 switches to route traffic to the shared NLB address? (currently routing to PIX ip address)?

Hang on I'm probably making this more complex than it needs to be. Okay

I have installed nlb on both servers, how do you get to integrated nlb?
I think there's an issue with nlb on the 2 internal ips because as I mentioned they are teamed to form 1 logical ip each and I don't think you can nlb teamed connections though I'll try and see if the service packs and updates for tmg2010 help.
I guess if I do get the internals balanced that's my shared VIP, then I can route traffic out to the Internet and then incoming I can copy my pix configs over so that .xxx goes to exchange etc xxy goes to sharepoint

Sorry appreciate ypur help, it's a small setup but complex for me lol

Will go with unteamed option for now