Publishing two terminal servers on single ISA box

[HMCTech]

We have one of our ISA boxes publishing our email and accepting and forwarding email, also publishing a terminal server for staff on its default port. Now we want to bind a second IP address to the ISA's external card and set up a rule for the second terminal server to listen on the second IP address.

 

Earlier in the day we tried but it caused everying to not work. And emails were not incoming.

 

We added a second IP address to the NIC, in the ISA protocols added a new network with the start and end address being the IP address. another rule for the second IP address. And changed the two published terminal server policies to listen on the new network we created instead of just "External". Not sure what went wrong and why this didnt work?

Edited September 29, 2008 by HMCTech

[srochford]

I don't know that you can't do it with 2 IP addresses but it's much easier to do it with two ports.

 

When you set up the listener, tell it not to use port 3389 for listening but (eg) 5001 for the first, 5002 for the second and so on

 

When an external user goes to connect they connect to address 1.2.3.4:5001 or 1.2.3.4:5002 etc

 

You then don't "waste" IP addresses and it's all fairly straightforward.

[SYNACK]

Just a guess but what version of ISA is it, if it is standard then it may be an issue with the way that you set it up as it only supports a single external network, as long as the external ips are in the same subnet you should be able to use more than one ip address with just the standard version so long as they are all included in the one external network.

[HMCTech]

I don't know that you can't do it with 2 IP addresses but it's much easier to do it with two ports.

 

When you set up the listener, tell it not to use port 3389 for listening but (eg) 5001 for the first, 5002 for the second and so on

 

When an external user goes to connect they connect to address 1.2.3.4:5001 or 1.2.3.4:5002 etc

 

You then don't "waste" IP addresses and it's all fairly straightforward.

 

We chose to do it with two ip addresses because of the setup we want. One address and url is for a group and another ip and url is for another. We want them seperate in as much of a way as possible.