Solved

Threat Management Gateway Replacing PIX

Posted on 2011-02-21
7
480 Views
Last Modified: 2012-05-11
Hi I am installing on a brand new infrastructure, 2 new TMG 2010 servers, running on W2008 Standard.
Each server has its own IP of course. The plan is to create an array of TMG to allow redundancy and load balancing.

Currently we have a PIX, which is being removed. This is connected to a modem, and also to a switch (2960). Routing was moved recently from the PIX to the core 3560.
PIX therefore currently supplys just internet access.

Can I do the following? The 2 TMG's are also on the layer3 3560. They are not connected directly to the modem. Can I connect the modem to the router, and then control firewall via TMG array? If so how?
Or should the 2 TMG servers be connected to the modem?

Bruce
0
Comment
Question by:Croftkey
  • 5
  • 2
7 Comments
 
LVL 51

Expert Comment

by:Keith Alabaster
Comment Utility
Really you would want to be on 2008 R2 but ordinary 2008 is OK as long as you have SP2 deployed also - minimum requierment.

If you are using the ISP-R features for load-balancing and failover then the FTMG's have to have a minimum of three nics installed (2 x external, one internal facing). Up to you where you put them in the topology but it is best practice to ensure that the external facing nics have a direct route to the Internet.

The main issue will be to ensure that nothing that sits between the FTMG array/pair has a route to the internal networks unless it passes through the FTMG boxes to get there. For example, if you have spare interfaces on the router sitting between FTMG and the Internet and you connect a spare interface to the internal network directly, you will likely end up with routing loops and spoofing issues.

Keith
0
 

Author Comment

by:Croftkey
Comment Utility
Thanks Keith
Just to confirm it is 2008 R2 on both boxes.
What I have done is the following, both servers have a quad port card fitted, and 2 embedded NIC's, one of which will be used for ILO.
There are 2 cables coming from each quad port currently, the cables go to seperate 3560 routers and are teamed as one logical address for redundancy, thats my internal connection.
I have just cabled up 2 more lengths, the plan is to plug 1 cable into one of the 2 spare quad ports, or the remaining embedded one, not sure which is best, but anyway both these will now go directly to the modem, which has 3 spare ports. This will be the direct to external routes on both.

Can I with this planned topology, do the following.
Set up an array, assign it with a IP address and then configure it so that it balances the load and sends external out to the internet?
0
 
LVL 51

Expert Comment

by:Keith Alabaster
Comment Utility
Both units would have their own addresses plus the shared VIP. You would have to use NLB on the internal to balance outbound across the two FTMGs. An array in itself does not provide load-balancing. If you have the Enterprise version then you can use integrated NLB - driven from within FTMG, else it is the good, old-fashioned, normal NLB approach.

0
Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 

Author Comment

by:Croftkey
Comment Utility
Sorry been a while since I done this.
So I connect a cable from both servers T1 and T2 to the layer3 switches, assign them unique  ip addresses in the same subnet.
Then I NLB these 2 connections to become my cluster which has its own IP address
Then I also have a cable from each server going to the modem, this will be using I guess a DHCP apipa address ?

Then use TMG to connect all the above, but also config the layer 3 switches to route traffic to the shared NLB address? (currently routing to PIX ip address)?
0
 

Author Comment

by:Croftkey
Comment Utility
Hang on I'm probably making this more complex than it needs to be. Okay

I have installed nlb on both servers, how do you get to integrated nlb?
I think there's an issue with nlb on the 2 internal ips because as I mentioned they are teamed to form 1 logical ip each and I don't think you can nlb teamed connections though I'll try and see if the service packs and updates for tmg2010 help.
I guess if I do get the internals balanced that's my shared VIP, then I can route traffic out to the Internet and then incoming I can copy my pix configs over so that .xxx goes to exchange etc xxy goes to sharepoint

Sorry appreciate ypur help, it's a small setup but complex for me lol
0
 

Accepted Solution

by:
Croftkey earned 0 total points
Comment Utility
Going to abandon the teaming as its making eveything more complex than required.
0
 

Author Closing Comment

by:Croftkey
Comment Utility
Will go with unteamed option for now
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

There are three types of ISA client that can be configured - these can be individual clients or multiples of a client on each PC or server SecureNAT. A SecureNAT client for ISA server is a client machine, work station or server, that has its defa…
So the following errors occurs in 2 ways that I am aware of at this stage, and you receive one of the following error messages: ERROR 1. When trying to save a rule: No Web listener is specified for the Web publishing rule Autodiscovery Publishin…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now