ISA Confusion

[Pearno]

We're looking to put in an ISA server over the summer and I've got myself all confused about addressing and where to put it.

 

See, my problem is this: Normally, you'd want your ISA server between your Internet thing and your first switch (is that right?), but I can't put it there. See, our 100MB internet line also feeds three nearby schools who do not need, nor want, all their traffic going through our ISA server.

 

So, if I put the ISA server between this shared switch and our site's first switch, how does the addressing work? The ISA server's 'external' network card will still be on a local IP address. And the 'internal' card would be on the same local network. Surely this can't work?

 

I'm in a pickle. I've never used, seen, set-up or touched an ISA server before in my life, so I kinda need to pick this all up pretty sharpish...

 

(Does anything I've said even make sense?)

 

Thanks in advance...

[Mr_T]

What are you wanting to do with your ISA server ? if its just web content filtering it doesnt make alot of diference where it is on your network as long as all the machines have it set as there proxy.

[Pearno]

To be honest, I'm not really sure what I need it for! Our RBC provide adequate filtering, so it's not really that.

 

I'm putting a Sharepoint server in, and we need remote access to it. I was under the impression that I'd be using ISA server as a firewall, and to provide AD authentication to incoming requests...

[srochford]

Not sure I understand. Do you have any "public" IP addresses available? (ie not 192.168, 10.0 etc) If so, then you can give one of them to 1 card on the ISA server; the other card gets an IP on your internal network and you can publish the Sharepoint server through it - that's how our website works.

 

If you've got something providing NAT so that the only IP addresses you've got are private, non-routable then I don't think that you can do it.

 

Basically, you've got to be able to put a name "sharepoint.myschool.sch.uk" in a DNS which the public can find and it needs to have a public IP address. Whatever is on that IP address has to be able to then route requests to your internal server; ISA Server can do that.

[sidewinder]

We're also supposed to use "local" addresses provided by the LEA - we get a 172.20.x.x private range allocated to us.

 

On our ISA server, the external NIC is setup with one of those addresses.

The internal one is setup with a 172.16.x.x address and that is the range we use internally. Equally we could use 192.168.x.x 10.x.x.x, anything really.

 

I assume you're in a similar situation. You'll need to use the range you're currently using as "external" addresses and use a seperate private range internally.

 

An added bonus for us in using a private range is that we never run out. We're only allocated 255 addresses from the LEA and while we could get that increased, its nice not to have to keep asking

[Pearno]

Thanks sidewinder - that's exactly the answer I needed to hear...

 

Now all I need to do is dig out my Sharepoint/ISA for Dummies books, I'll be ready for the summer!

[tosca925]

On our ISA server, the external NIC is setup with one of those addresses.

The internal one is setup with a 172.16.x.x address and that is the range we use internally. Equally we could use 192.168.x.x 10.x.x.x, anything really.

 

 

How do you get on if the LEA want to remote into your network?

[sidewinder]

The only machines the LEA remote into are the 2 SIMS servers, and they have 2 NICs, one of which has an external address and goes directly into the admin side of the router. The other goes into the internal network so it they dont go through the ISA server at all

 

If it wasn't on a WAN that would be a security risk but as we mainly just use ISA for blocking and monitoring its not really an issue

[spc-rocket]

 

How do you get on if the LEA want to remote into your network?

 

 

This can be done by selecting a LEA assigned IP to the external NIC of the isa server and just using the server publishing rule to create the reverse NAT to the correct IP i.e. if you lea is using 172.10.30.5 to dial into say one of your server which on the internal range is 192.168.10.5 then you can use the method i stated above to do this. Its a just a matter of configuring a NAT routing relationship between the Internal and External networks.

 

Ash.

[sidewinder]

^ Might have to give that a go then in the summer

[zag]

You dont need an ISA server for remote access of sharepoint, just give it an external IP, change the authentication to basic and open up a port on the firewall. Its pretty simple to get working without any extra software and works just as it would inside the school.

 

EDIT: oops didnt read up, well thats how it works in our school, you should get your lea or isp to give you some external IP's they are very usefull