Excellent, Excellent post! Thank you. Your topology map is exactly what we have, yes.
As to why we aren't terminating VPN with ISA, there are reasons involved... Long and drawn out. Suffice to say that it is out of my hands, and the solution currently in place DOES work (as long as we remember to add the static routes) and suits the needs of the company. I even ran into this problem (pings work, everything else is hit/miss) a year or so ago and the solution was the same (static route on the server(s) involved) and I thought to myself, "I had better remember to add static routes in the future on new servers", haha. Your comments about ICMP redirects were exactly what I was looking for too, as soon as you mentioned it, the lightbulb went off in my head from a year ago. Your suggestion about adding the extra NIC to ISA and putting the VPN routers off that NIC is valid and I like that idea. But since I'm not the 'main' network support person, it's really up to them. I can pass along the idea. It sure would save me grief. JR Original Message: ----------------- From: Ben Scott [email protected] Date: Tue, 3 Nov 2009 13:59:35 -0500 To: [email protected] Subject: Re: Network Q On Tue, Nov 3, 2009 at 1:05 PM, [email protected] <[email protected]> wrote: > I have two networks. Following is a network topology diagram. Do I have it right? +--10.0.0.1 (Internet gateway) | |= 10.0.0.0/24 (Network A) | +--10.0.0.8 (Server XYZ) | +--10.0.0.254 (VPN gateway) ~ VPN ~ | +-- 192.168.111.1 (VPN gateway) | |= 192.168.111.0/24 (Network B) | +--192.168.111.200 (PC-A) > * Trace routing to ServerXYZ from PC-A mostly resulted in 3 hops. And > about 20% of the time resulted in 4 hops (the extra hop ended up being the > 10.0.0.1 gateway). On Tue, Nov 3, 2009 at 1:32 PM, [email protected] <[email protected]> wrote: > Which might explain why changing ServerXYZ to have a static route for > 192.168.111.0/24 via the 10.0.0.254 gateway, and bypassing ISA (10.0.0.1), > fixed the issue? I'm guessing that either (1) ISA is screwing things up or (2) you're seeing the effects of ICMP Redirect messages. Classically, if an IP router forwarded a packet back out the interface it came in on, it would send an ICMP Redirect message to the source address. The sender could thus learn a better route to the destination. Implementation was spotty even at the best of times, and relatively recently, ICMP Redirect has tended to be ignored since it is easily spoofed. But Windows may still honor ICMP Redirect by default. Or even better, maybe ISA is unaware of ICMP Redirect, but the Windows network stack still implements it. ;-) Any which way, I would want to avoid sending packets back out the interface they came in on. If I were designing this network-- well, I wouldn't use ISA. ;-) But if I had to use ISA, I would ask, why aren't you terminating your VPN with ISA? If I had to use ISA but also had to use a different box for the VPN, I would add an interface (network card) to the ISA box, put the VPN box on a different IP network, and use routing on the ISA box to direct traffic appropriately. I would do this for a number of reasons, but relevant to the current discussion is that it would avoid the need to configure static routes to 192.168.111.0/24 everywhere on 10.0.0.0/24. If you must keep the current topology, you'll prolly spend lots of time managing static routes on all your boxes. And pulling your hair out. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ -------------------------------------------------------------------- mail2web LIVE Free email based on Microsoft® Exchange technology - http://link.mail2web.com/LIVE ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
