On Tue, Nov 3, 2009 at 1:05 PM, [email protected]
<[email protected]> wrote:
> I have two networks.
Following is a network topology diagram. Do I have it right?
+--10.0.0.1 (Internet gateway)
|
|= 10.0.0.0/24 (Network A)
|
+--10.0.0.8 (Server XYZ)
|
+--10.0.0.254 (VPN gateway)
~
VPN
~ |
+-- 192.168.111.1 (VPN gateway)
|
|= 192.168.111.0/24 (Network B)
|
+--192.168.111.200 (PC-A)
> * Trace routing to ServerXYZ from PC-A mostly resulted in 3 hops. And
> about 20% of the time resulted in 4 hops (the extra hop ended up being the
> 10.0.0.1 gateway).
On Tue, Nov 3, 2009 at 1:32 PM, [email protected]
<[email protected]> wrote:
> Which might explain why changing ServerXYZ to have a static route for
> 192.168.111.0/24 via the 10.0.0.254 gateway, and bypassing ISA (10.0.0.1),
> fixed the issue?
I'm guessing that either (1) ISA is screwing things up or (2) you're
seeing the effects of ICMP Redirect messages.
Classically, if an IP router forwarded a packet back out the
interface it came in on, it would send an ICMP Redirect message to the
source address. The sender could thus learn a better route to the
destination. Implementation was spotty even at the best of times, and
relatively recently, ICMP Redirect has tended to be ignored since it
is easily spoofed. But Windows may still honor ICMP Redirect by
default.
Or even better, maybe ISA is unaware of ICMP Redirect, but the
Windows network stack still implements it. ;-)
Any which way, I would want to avoid sending packets back out the
interface they came in on.
If I were designing this network-- well, I wouldn't use ISA. ;-)
But if I had to use ISA, I would ask, why aren't you terminating your
VPN with ISA?
If I had to use ISA but also had to use a different box for the VPN,
I would add an interface (network card) to the ISA box, put the VPN
box on a different IP network, and use routing on the ISA box to
direct traffic appropriately. I would do this for a number of
reasons, but relevant to the current discussion is that it would avoid
the need to configure static routes to 192.168.111.0/24 everywhere on
10.0.0.0/24.
If you must keep the current topology, you'll prolly spend lots of
time managing static routes on all your boxes. And pulling your hair
out.
-- Ben
~ Finally, powerful endpoint security that ISN'T a resource hog! ~
~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
