ISA and 2 Internet Routers

[anthonymel]

Objective of St Mary’s Tech Plan 2005-2008

1) Gigabit Backbone-fiber optics
2) Teacher Training
3) LCD’s in more rooms
4) Discovery Channel Service
5) Full T1-Internet Connection


Here at the high school I'm planning to have two full T-1 lines installed. One for administration computers and the other for the rest of the school.

The ISA server is the default gateway for all machines. Is there a way on that server to have the administrations PCs use one router and connection and the rest of the school use other router and connection?

I know of how to do this with DHCP with user class IDs but in this case I want every computer to hit the ISA server first.

Thanks,

Anthony

 

[Knutern]

Hi,

as far as I know: No.

It's possible to enter more than one default gateway. However, only the first entry will be used as long as it is not detected as dead. Default Gateway Behavior for Windows TCP/IP

What you could do however, is to have two ISA Servers. One for school users and the other for admin-users. Then, to make sure only admin-users are granted access, create access rules which require authentication. You could also create access rules which determines access based on Source IP address, but this is less secure, because a user might be able to use one of the "priviledged" IPs and thereby gain access.

HTH

Cheers
Knutern

 

[anthonymel]

Well if I use DHCP class ids I can hand out ip addresses based on a network card's class id. I would create a script and configure those computers used by admins to have a class id called admin. Then deploy the script through AD and computer logon. When is asks the DHCP server for an address it will see that it belongs to the class named admin and it will get an ip address and default gateway based off that class.

I can have it point to the ISA server that is behind the admin internet router. Then I would do the same for students but on the student ISA server. That way it will always go the right ISA server which would then forward the packets out to the net.

Which way would work better?

Anthony

 

[SpiritedTechnologies]

I think thats a good idea anthony, but coupled with either an extra NIC card on the ISA and proper VLAN setup. You shouldn't need 2 ISA's for 2 T's worth of traffic! Segment your Admin and Student pop by vlan, much easy to manage.

What is it if a man inherits the whole world but loses his soul? -Jesus