What is the DHCP router when you have an ISA2004?

[eejit]

Before we installed our ISA2004 box, DHCP used to give out the IP address of the router as the Router option. Now that we've installed the ISA we've set the LAN ip address of that as the router/gateway. Is that how everyone else does it?

 

Everything does seem to work under that setup, but if you do a "netdiag" from anywhere, you get the "[FATAL] NO GATEWAYS ARE REACHABLE" message. I guess that may not be a problem, but I'm just looking for some 'best practice' advice I guess.

 

Thanks.

[eejit]

What do you guys set as your DHCP gateway? Is the router's LAN the correct thing to do?

[ChrisH]

My Linux Box has 2 cards one in the range of the cisco router in the 10.X.X.X range and one for my local lan range 192.X.X.X . The clients are pointed the 192.X.X.X range.

The Linux box has one gateway which is the router in the range 10.X.X.X .

[Westbrooke]

This is easy to answer with pictures, but I'll stick to words for now!

 

The default gateway is the address of the device that knows how to get places not on the LAN, in most cases the firewall or internet router.

 

I am assuming that you have a single LAN - no routers on your internal network!

 

Before you had a proxy server, each workstation would have accessed the internet directly to get web pages. This means it needed to know how to get to the router, which would have sent packets on to the right place.

 

With a web proxy, each PC only needs to know how to get to the proxy server, which is on the LAN so that is easy. The proxy server is then the only server that needs to know about the outside world, so it will need an accurate default gateway set.

 

In other words, if all services use a proxy server, then the default gateway on PCs on the LAN is not relevant, so can be blank or wrong!

 

Of course, you can use ISA server as a router, firewall and/or proxy so setups can get a lot more complicated!

 

Note you also need to have DNS proxied somewhere for things to still work, but that would be pretty standard setup (your internal DNS server will be a DNS forwarder)

 

(NB - a better design is to have the proxy in a DMZ, so there is a firewall between the LAN and the proxy, and again between the proxy and the outside world. However, removing the direct link between internal machines and the internet is a GOOD THING)

 

Hope that helps!

[Ric_]

Indeed a pic is the best way to describe the setup.

 

For a simple installation:

* Set the ISA server LAN-side NIC as the gateway

* Add your upstream proxy details (where appropriate)

* Remember to setup the HTTP rules! (For testing you can open all protocols but do NOT forget to tighten up again!)