TMG 2010 web publishing with two Internet Connections

[rjm]

Hi guys,

 

Im after abit more advice. Our TMG server has two internet connections that are in Failover Only mode on the ISP Redundanct Tab.

 

My issue is we cannot access a published web server when both connections are active. When the 2nd reduntant connection is disabled it works instantly. I also have Exchange 2007 OWA published through the same TMG server, but access to this works regardless of the 2nd connection being active. Now the external IP address for the site in question is linked to the Primary network connection, as is the OWA, so I cant understand why having the 2nd redundant connection active would cause the published site not to work.

 

I have compared both access rules for OWA and the published site and they are the same, other than the details of ther server they are hosted on, and their relative host names etc.

 

One last thing, when I remove the gateway address from the 2nd redundant connection, it works instantly, so it appears the request comes in using the external IP through the primary internet connection, but then tries to reply and go out on the 2nd redundant connection causing it to time out.

 

Any ideas would be greatly appreciated.

 

Cheers

 

Rich

[SYNACK]

Split DNS inside? You may need to look at your DNS and your routing/interface costs

[rjm]

Hi mate,

 

Thanks for your reply. In our Domain DNS I have an "Host A" entry for mail. which runs the OWA, and one for webserver. Also, both names are registered with our domain name provider so resolved on the internet to the relevant external IP addresses. I am looking at Routing in TMG but that seems to be static and just picks up addresses from the NICs in the TMG server.

 

Thanks for your help.

[SYNACK]

Each interface has a cost specified in the advanced IP options, it depends on the binding order of the interfaces and the cost/metric of the interface as to which route is chosen. You need to make sure that the TMG is using internal DNS server so that the address that the TMG uses is the internal one. You could should check that TMG rules point to the site directly via internal IP rather than using DNS anyway.

[rjm]

Where can I find the cost? I have looked in the advanced options in network connections, and verified the primary internet connection is above the backup secondary connection, which it is. Both internet connections use the ISP DNS servers relevant to that connection. The internal LAN nic on the TMG server points to our internal DNS servers, which have both mail. and webserver. entries specified. The TMG rule specified the site name and IP Address, and when I run the "Test Rule" I get success and green ticks.

[SYNACK]

Both internet connections use the ISP DNS servers relevant to that connection. The internal LAN nic on the TMG server points to our internal DNS servers, which have both mail. and webserver. entries specified.

 

External NICs should not have DNS entries from the ISPs, this should be handled by fowarders on your internal DNS. All DNS should point internally.

 

The Cost/metric is specified under the IP4 advanced setting under each connection in Windows network adapter managment. Usually this is set to automatic metric. Lower metrics indicate preffered routes.

[rjm]

Both external connections and the internal LAN connection are all set to automatic metric. Should I change this? I still cant get my head around why mail. works regardless of the secondary connection, but webserver. doesn't... How can I set the forwarders in DNS when both connections are from different ISPs and therefore use different DNS servers from each other? Thanks for your help with this!

[SYNACK]

DNS servers should be accessable from another ISP anyway. Go into the DNS server properties and add the fastest DNS server first and the the others afterwards in the fowarders list.

 

The metric on your external interfaces should probably be identical but you may want to push them up to 4 or 5 so that the internal connection always takes precidence. It should do this anyway but it may help. I think that getting DNS sorted on the the TMG will help too. If it still does not work try making the metric on the primary one lower than the secondary.

[rjm]

Hi mate, I have changed the DNS entries on both connections to point to our two internal DNS Servers. Both internal servers have the external DNS servers for our ISP listed. I have also changed the Metrics in both connections, making the primary connection lower than the secondary redundant connection. The Lan is still priority though. After both of these changes, im still getting the same issue. Mail. works but webserver. doesn't. Disable the redundant connection and webserver. works instantly. I really have no idea what is causing it...