+ Post New Thread
Results 1 to 7 of 7
Internet Related/Filtering/Firewall Thread, ISA 3 NIC failover question in Technical; Our connectivity is as follows; 1x SDSL connection and 2x ADSL connections. The SDSL is a 5 IP going directly ...
  1. #1

    Join Date
    Oct 2008
    Posts
    226
    Thank Post
    2
    Thanked 13 Times in 13 Posts
    Rep Power
    22

    ISA 3 NIC failover question

    Our connectivity is as follows; 1x SDSL connection and 2x ADSL connections. The SDSL is a 5 IP going directly to WAN side of ISA 2006. This is for our email, VPN, Web server and DNS server external requests. The ADSL connections go into a 3200 vigor 4xWAN router. The two ADSL are load balanced "UP" (WAN 1 & 2) and the SDSL on failover (WAN 3) if both the ADSL are down - the vigor pings "back" along each WAN to ensure connectivity to the internet rather than just ethernet link active. The 3200 is then the gateway for the clients (with filtering as a bridged proxy).

    however, I want to employ multiple MX records to ensure that if our SDSL connectivity goes down we wont lose out on our email. I am wondering what is the best idea, the cheapest would be to add another NIC and somehow configure ISA 2006 (I can install TMG if necessary) and connect this 3rd NIC to the DMZ of the vigor 3200. The more expensive would be to have another vigor box and "cross them over". I.e have a new vigor dual WAN box with WAN1 -> SDSL and WAN2 -> DMZ of the 3200 ADSL vigor then remove the SDSL from the WAN 3 of the 3200 to avoid a circular loop. I only plan on adding ONE of the ADSL external IP addresses to the MX record so that I can add a route for to the 3200 vigor for that ADSL line (although DMZ should take care of that anyway!)

    Bottom line. Can ISA failover a NIC based on connectivity (not simply ethernet link as the router would be live) such as ping. This will need to failover all external requests such as email, vpn etc and come back "live" once it has returned. Has anyone else done something similar?

    My guess is another vigor box so that all the rules in ISA simply send to its WAN side and the vigor decides which way that should go based on its own pings and routes. I would use the DMZ from the vigors in any case.
    Last edited by KK20; 27th June 2011 at 10:36 AM. Reason: slight mistake.

  2. #2
    Cools's Avatar
    Join Date
    Jan 2009
    Location
    Bedfordshire
    Posts
    498
    Thank Post
    24
    Thanked 62 Times in 57 Posts
    Rep Power
    26
    i take it all your internet goes to the isa server? on 2 diff nicks and 3rd one for LAN
    if so just add more then 1 ip to MX records on ya dns, and a just isa settings.


    Code:
    Subdomain	 Mail server	                               Priority	
                     mail.ilimits.co.uk.		                 1	
                     mail2.ilimits.co.uk.                        5
                     mail3.ilimits.co.uk                         10
    
    
    
    and add to dns A record
    
    Subdomain                          Address
    mail                                   ip of  sdsl
    mail2                                 ip of adsl 1
    mail3                                 ip adsl 2
    i hope it helps
    Last edited by Cools; 27th June 2011 at 11:27 AM.

  3. #3

    Join Date
    Oct 2008
    Posts
    226
    Thank Post
    2
    Thanked 13 Times in 13 Posts
    Rep Power
    22
    I know that bit. Its the "backend" i'm working on. I am wondering what people have done at the backend to accept the second IP. Effectively they are both the same server but with different entry points. After more googling I havent found anyone who has used ISA to failover NICs reliably, so it looks like another vigor box when I can afford one.

  4. #4

    Join Date
    Oct 2005
    Posts
    870
    Thank Post
    59
    Thanked 133 Times in 111 Posts
    Rep Power
    77
    @KK20 - You can use Forefront TMG to do this...

    "You can configure ISP redundancy to distribute outbound traffic between two ISP connections using failover between a primary and backup link, or load balancing and failover."

    Not used it myself... yet... but it's on the plan!

  5. #5
    bio
    bio is offline
    bio's Avatar
    Join Date
    Apr 2008
    Location
    netherlands
    Posts
    520
    Thank Post
    16
    Thanked 130 Times in 102 Posts
    Rep Power
    38
    Quote Originally Posted by KK20 View Post
    Bottom line. Can ISA failover a NIC based on connectivity
    Nope..ISA 2000/2004/2006 can not do this..However TMG can do this (ISP-R).

    bio..

  6. #6

    Join Date
    Oct 2008
    Posts
    226
    Thank Post
    2
    Thanked 13 Times in 13 Posts
    Rep Power
    22
    I have convinced the bean counter to give me another £300 for the venture and will be going down the hardware route. So far the vigor router has done exactly what I want it to do and it has "failed over" when the exchange had issues over the last weekend. So I have no reason to doubt a second one will do the same. It is a shame that TMG will only look at 2 WAN connections - it may be overkill but if I have 3 connections there is no reason why I cant failover onto all three if necessary (and just add the relevent MX weight in the DNS)

    Thank you for your replies though.
    Last edited by KK20; 30th June 2011 at 10:33 AM.

  7. #7
    Cools's Avatar
    Join Date
    Jan 2009
    Location
    Bedfordshire
    Posts
    498
    Thank Post
    24
    Thanked 62 Times in 57 Posts
    Rep Power
    26
    just use hardware unless you go down the linux route..
    DrayTek Vigor 3300v+ Multi-WAN Security VoIP Load Balancer w/ 2 Module Slots

    sell the vigor you have and get a new one.. we all like to upgrade..



SHARE:
+ Post New Thread

Similar Threads

  1. ISA 2006 question
    By Jobos in forum Windows Server 2000/2003
    Replies: 2
    Last Post: 25th February 2010, 11:28 PM
  2. ISA Server 2000 Question
    By Quackers in forum Wireless Networks
    Replies: 0
    Last Post: 11th December 2008, 02:13 PM
  3. VLAN and ISA question
    By localzuk in forum Wireless Networks
    Replies: 0
    Last Post: 23rd October 2007, 02:33 PM
  4. Question about redirection of default ISA url
    By tosca925 in forum Windows
    Replies: 0
    Last Post: 9th September 2006, 10:29 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •