Tri Home DMZ NIC Config

[bradhiggins]

Hey all,

I have been doing some reading and to set up a tri home dmz, and I keep getting confused on one issue. I have a /28 CIDR address range from my ISP with netmask of 255.255.255.240 .

Am i able to just use these public IP's directly so 2 on ISA and the rest on my DNS and mail,
eg
INT NIC 192.168.0.1 255.255.255.0
EXT NIC ???.???.???.98 255.255.225.240
DMZ NIC ???.???.???.99 255.255.255.240

or do I have to further subnet them so the External and DMZ NIC's are on different subnets.

If so what is the easisest way in doing this.

Cheers

brad

 

[tek777]

Man, I have the exact same question. Let me know if you find out

here is an article if you have not already seen it.

http://www.isaserver.org/tutorials/ISA_Server_DMZ_Scenarios.html

 

[bradhiggins]

Thanks but I have already read umpteen articles but none gives specific NIC configurations or what packet filters required.

I had one response on another forum that said that yes they needed to be on different subnets and you can further subnet your /28 to a /29 creating 2 subnets and it doesn't affect your public IP's.

I got this configured and set up so that people internally can access the mail in the DMZ and with correct PAcket Filters.

The problem I had was I couldn't get internet connectivity to the servers in the DMZ zone through the ISA using the DMZ external NIC as the gateway on the DMZ machines.

IF you find out the answer can you let me know?

In the end I just put the DNS servers in the public subnet (They have nothing else on them but DNS) and published the mail server.

Cheers

Brad

 

[tek777]

Here is my setup now,

I have 1 Checkpoint firewall, that cannot be taken out (I am replacing it though). That is using the 255.255.255.240, and it has a local routing table to route certain IP addresses to private IPs. I was thinking, on the DMZ leg of the ISA, maybe I should try to use the subnet 255.255.255.0.

OK, maybe I can try the idea you had with the /29, I am curious to see if the router recognizes the new subnet. I will try that, thanks!

 

[tek777]

can you show me the post about the /29 subnet? Thanks

 

[bradhiggins]

Hey,

Here is the link to my post on the other forum :

http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=9;t=000713

THe guy who responded was very good, and also try using the isaserver.org messgaes boards as they often have solutions already.

Cheers Brad

 

[polke]

dmz and ext nic have to be on different subnets, otherwise isa will not route the requests. the easiest way to do it is - just chage your SM.