Access Internal Website from External Website

[william-swc]

Hi

 

We already have a public ip address which points to e.g. http://www.ourdomain.ac.uk. We don't want to purchase additional public ip addresses as:

1) we've been told we don't have to by our sharepoint engineers

2) we have to purchase them from our supplier in blocks of a certain number

 

We have created internal subdomains in the example sharepoint.ourdomain.ac.uk and staff.ourdomain.ac.uk. Both of the subdomains point to websites on internal webservers. The domain http://www.ourdomain.ac.uk points to our webserver on the dmz.

 

Is it possible, using host headers and DNS to allow the subdomains to be accessible from the internet without purchasing additional public ip's, and if so how do we go about implementing the solution?

 

We use Microsoft servers running the latest version of IIS.

 

Thanks

[glennda]

Are the sub-domains and domain on the same server? of so you can put it behind an ISA server which will - on the same ip address send data for sub.domain.ac.uk to one server and domain.ac.uk to another - but they have to sit behind the isa server e.g they have internal addresses 192.168.*.* and then the ISA has the public address.

 

Any request on the pubic ip for sub.domain.ac.uk gets sent to 192.168.0.2 and and traffic for http://www.domain.ac.uk gets sent to 192.168.0.3

 

Is that the kind of this you are after??

 

Also it might be able to forward them to the same internal ip but different ports

 

Toby

[ascott2]

+1 on the ISA route. That is our setup. Only one external IP address, which goes to the ISA box. The ISA then determines where to send the internal request to, using web listeners and firewall rules.

[william-swc]

Hi Toby,

 

That's sounds like a plan! The subdomains are on two different internal servers and then http://www.ourdomain.ac.uk is on a different server again on the DMZ.

 

If I have picked you up correctly you would recommend bringing the server on the dmz back in to the internal network, forward the current public ip address to the ISA server and let the ISA server decide where to send the traffic?

 

What about security? how will that work? The Sharepoint servers on the subdomain use integrated authentication to validate users, the website on the dmz uses anonymous.

 

Also is the ISA server on the dmz or is it also internal?

 

Sorry for all the qu's,

 

Thanks for your help so far

William

[wesleyw]

ISA should be in the DMZ as for Sharepoint when publishing it through ISA you can use any authentication method you wish and this will pass those login credentials through. You will need to setup sub domain names with your provider this may cost though. e.g. http://www.school.ac.uk you've got pointing to 200.200.200.200 sharepoint.school.ac.uk will also need to be resolved to this IP address ISA then translates the header to an internal server works really well and it means if you are using 443 then one wildcard SSL is all thats needed!

 

Wes

[glennda]

Basicly your isa server needs two network cards 1. External address 2. internal address have all your subdomains plus actual domain sent to that one external address. All webservers have internal addresses only and sit behind the isa as such. ISA then does all the work with sending to the right servers on the inside - the ports etc should make a difference aswell as the need to login

 

Toby