Re: Think outside the GUI challenge #1

Just realized a C&P error in the final illustration.
This is the corrected version:

When we add the new route definition, Windows now understands that some 
internal routing is required and forwards the packet this way:
|------------------------------------|-----------------------------------|
|           Ethernet Header          |              IP Header            |
|------------------------------------|-----------------------------------|
|    source MAC    | destination MAC |    source IP    | destination  IP |
|------------------|-----------------|-----------------|-----------------|
|    (internal)    |   (internal)    |    127.0.0.1    |    10.0.0.2     |
|------------------|-----------------|-----------------|-----------------|

|------------------------------------|-----------------------------------|
|           Ethernet Header          |              IP Header            |
|------------------------------------|-----------------------------------|
|    source MAC    | destination MAC |    source IP    | destination  IP |
|------------------|-----------------|-----------------|-----------------|
|      North       |      bridge     |    10.0.0.1     |    10.0.0.2     |
|------------------|-----------------|-----------------|-----------------|


--------------------------------------------
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
--------------------------------------------

-----Original Message-----
From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx] 
Sent: Thursday, December 29, 2005 10:57 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] Re: Think outside the GUI challenge #1

http://www.ISAserver.org

I knew I'd get Tom in on this one (he loves a good brain twister).

#1 - closer.  Unless instructed otherwise, Windows always sends originating 
traffic using the default IP (123.123.123.123) as the source address in the IP 
header.  Since the bridge doesn't understand how to respond to what it sees as 
non-local traffic, it simply drops it.  The part of the routing command that 
makes it work is specifying the new IP (10.0.0.1) as the gateway for this 
route.  This causes Windows to "route internally" and results in the bridge 
seeing the 10.0.0.1 IP as the source IP.
#2 - almost...  RRAS maintains a separate routing table that affects (but is 
not affected by) the TCP/IP routing table.  Thus, when RRAS is installed, it is 
usually more correct to enter manual routes in the RRAS routing table.  This 
depends on how you want Windows & RRAS to behave with regard to "special" 
traffic
#3 - dingdingding!
#4 - close enough...

To illustrate the scenario...
For simplicity's sake, we'll use ISA-local traffic for this demo.
The original packet headers are built as (simplified):
|------------------------------------|-----------------------------------|
|           Ethernet Header          |              IP Header            |
|------------------------------------|-----------------------------------|
|    source MAC    | destination MAC |    source IP    | destination  IP |
|------------------|-----------------|-----------------|-----------------|
|    (internal)    |   (internal)    |    127.0.0.1    |    10.0.0.2     |
|------------------|-----------------|-----------------|-----------------|

Because Windows has no clear instructions on how to handle this destination IP, 
internal logic sends it as:
|------------------------------------|-----------------------------------|
|           Ethernet Header          |              IP Header            |
|------------------------------------|-----------------------------------|
|    source MAC    | destination MAC |    source IP    | destination  IP |
|------------------|-----------------|-----------------|-----------------|
|      North       | default gateway | 123.123.123.123 |    10.0.0.2     |
|------------------|-----------------|-----------------|-----------------|

Adding the new IP address only instructs Windows that this is now a local 
subnet, creating the following headers:
|------------------------------------|-----------------------------------|
|           Ethernet Header          |              IP Header            |
|------------------------------------|-----------------------------------|
|    source MAC    | destination MAC |    source IP    | destination  IP |
|------------------|-----------------|-----------------|-----------------|
|      North       |      bridge     | 123.123.123.123 |    10.0.0.2     |
|------------------|-----------------|-----------------|-----------------|

When we add the new route definition, Windows now understands that some 
internal routing is required and forwards the packet this way:
|------------------------------------|-----------------------------------|
|           Ethernet Header          |              IP Header            |
|------------------------------------|-----------------------------------|
|    source MAC    | destination MAC |    source IP    | destination  IP |
|------------------|-----------------|-----------------|-----------------|
|     (local)      |     (local)     |    127.0.0.1    |    10.0.0.1     |
|------------------|-----------------|-----------------|-----------------|

|------------------------------------|-----------------------------------|
|           Ethernet Header          |              IP Header            |
|------------------------------------|-----------------------------------|
|    source MAC    | destination MAC |    source IP    | destination  IP |
|------------------|-----------------|-----------------|-----------------|
|      North       |      bridge     |    10.0.0.1     |    10.0.0.2     |
|------------------|-----------------|-----------------|-----------------|

Note that you can't see these internal routing changes happening via NetMon or 
any other packet sniffer because it's occuring in what's known as "memory 
mapped networking".

--------------------------------------------
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
--------------------------------------------

-----Original Message-----
From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxx] 
Sent: Thursday, December 29, 2005 10:01 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] Re: Think outside the GUI challenge #1

http://www.ISAserver.org

OK

1. Because it will send it to the default gateway if we don't do this, and that 
won't work.
2. Still dunno -- undocumented RRAS horkage?
3. route -p add 10.0.0.1 mask 255.255.255.255 10.0.0.1
4. Move off

Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://spaces.msn.com/members/drisa/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
**Who is John Galt?**

 

> -----Original Message-----
> From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx] 
> Sent: Thursday, December 29, 2005 11:48 AM
> To: [ISAserver.org Discussion List]
> Subject: [isalist] Re: Think outside the GUI challenge #1
> 
> http://www.ISAserver.org
> 
> Very close!
> 1. sorry; incorrect
> 2. acceptable, but not very informative :0>
> 3. that'll break it again (if the utilities even allow it); 
> what else must be changed?
> 4. can be "sweetened"
> 
> 
> --------------------------------------------
> Jim Harrison
> MCP(NT4, W2K), A+, Network+, PCG
> http://isaserver.org/Jim_Harrison/
> http://isatools.org
> Read the help / books / articles!
> --------------------------------------------
> -----Original Message-----
> From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxx] 
> Sent: Thursday, December 29, 2005 9:36 AM
> To: [ISAserver.org Discussion List]
> Subject: [isalist] Re: Think outside the GUI challenge #1
> 
> http://www.ISAserver.org
> 
> 1. Because 10.0.0.0/8 is already taken
> 2. Dunno
> 3. Use 255.255.255.255
> 4. Can say here, there are ladies reading.
> 
> Thomas W Shinder, M.D.
> Site: www.isaserver.org
> Blog: http://spaces.msn.com/members/drisa/
> Book: http://tinyurl.com/3xqb7
> MVP -- ISA Firewalls
> **Who is John Galt?**
> 
>  
> 
> > -----Original Message-----
> > From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx] 
> > Sent: Thursday, December 29, 2005 11:13 AM
> > To: [ISAserver.org Discussion List]
> > Subject: [isalist] Re: Think outside the GUI challenge #1
> > 
> > http://www.ISAserver.org
> > 
> > I smell an xNIX geek among us.
> > :-p
> > 
> > Correct.  The actual command lines would be:
> > - netsh int ip add addr north 10.0.0.1 255.255.255.0
> > 
> > (without RRAS)
> > - route -p add 10.0.0.0 mask 255.255.255.0 10.0.0.1
> > 
> > (with RRAS)
> > - netsh routing ip add persistentroute dest=10.0.0.0 
> > mask=255.255.255.0 name="North" nhop=10.0.0.1 proto=NONDOD    
> >  preference=0 metric=1 view=both
> > - netsh routing ip set persistentroute dest=10.0.0.0 
> > mask=255.255.255.0 name="North" nhop=10.0.0.1 proto=NONDOD    
> >  preference=0 metric=1 view=both
> > 
> > ..now, for the extra points questions:
> > Ep1 - why doesn't it work without adding the route commands 
> > *as specified*?
> > Ep2 - why are the routing table command different with & 
> without RRAS?
> > Ep3 - how would you modify the commands to restrict the 
> > acceptable IP range?
> > Ep4 - what does my daughter's phone number spell?
> > 
> > --------------------------------------------
> > Jim Harrison
> > MCP(NT4, W2K), A+, Network+, PCG
> > http://isaserver.org/Jim_Harrison/
> > http://isatools.org
> > Read the help / books / articles!
> > --------------------------------------------
> > 
> > -----Original Message-----
> > From: Roy Tsao [mailto:roy_tsao@xxxxxxxxxxxx] 
> > Sent: Thursday, December 29, 2005 7:34 AM
> > To: [ISAserver.org Discussion List]
> > Subject: [isalist] Re: Think outside the GUI challenge #1
> > 
> > http://www.ISAserver.org
> > 
> > #1?Fbind static ip 10.0.0.X/24 at CLI
> >     also add a static route 10.0.0.0/24 gateway 10.0.0.X/24 at CLI
> > 
> > > Remember; this is the "out of the GUI" challenge.
> > > How would you accomplish item 1 from the command line?
> > > 
> > > Also, it still won't work (incomplete).
> > > What other non-ISA, non-GUI steps must be taken?
> > > 
> > > #2 answered correctly.
> > > 
> > > --------------------------------------------
> > > Jim Harrison
> > > MCP(NT4, W2K), A+, Network+, PCG
> > > http://isaserver.org/Jim_Harrison/
> > > http://isatools.org
> > > Read the help / books / articles!
> > > --------------------------------------------
> > > 
> > > -----Original Message-----
> > > From: Roy Tsao [mailto:roy_tsao@xxxxxxxxxxxx] 
> > > Sent: Wednesday, December 28, 2005 11:07 AM
> > > To: [ISAserver.org Discussion List]
> > > Subject: [isalist] Re: Think outside the GUI challenge #1
> > > 
> > > http://www.ISAserver.org
> > > 
> > > 
> > > 1) Bind a additional static IP 10.0.0.X/24 to ISA 
> External Interface
> > > 2) In case of dynamic IP, static IP can't assign as per 1)
> > > 
> > > 
> > > > Merry Xmas & Happy New Year!
> > > > 
> > > > In the spirit of giving, here's a "think outside the GUI" 
> > challenge
> > > for
> > > > you.
> > > >  
> > > > Scenario:
> > > > - ISA is connected directly to the Internet via a 
> "manageable" DSL
> > > > bridge
> > > > - ISA uses 123.123.123.123/24 static external IP; DG = 
> > 123.123.123.1
> > > > - Internal LAN uses 10.9.8.x/24
> > > > - DSL bridge has unchangeable 10.0.0.2/24 internal IP
> > > > - DSL bridge offers web-based management on that internal IP
> > > > 
> > > >         Internet
> > > >            |
> > > >       DSL Bridge
> > > >          |- 10.0.0.2/24
> > > >            |- 123.123.123.123/24
> > > >         ISA
> > > >          |- 10.9.8.x/24
> > > >           LAN
> > > > 
> > > > Note:
> > > > - The DSL bridge internal IP is irrelevant to normal 
> > Internet access.
> > > > Because it's operating in "bridge" (as opposed to NAT) 
> mode, it's
> > > > effectively transparent to the ISA for Internet traffic.
> > > > 
> > > > Challenges:
> > > > 1. Allow either ISA-local or ISA-internal to access the 
> > DSL bridge web
> > > > interface
> > > > 2. Explain why the correct solution is impossible to 
> > implement if the
> > > > ISP provides a dynamic IP.
> > > > 
> > > > Hint:
> > > > - The core of the solution has nothing whatsoever to do with ISA
> > > itself.
> > > > 
> > > > --------------------------------------------
> > > > Jim Harrison
> > > > MCP(NT4, W2K), A+, Network+, PCG
> > > > http://isaserver.org/Jim_Harrison/
> > > > http://isatools.org
> > > > Read the help / books / articles!
> > > > --------------------------------------------
> > > > 
> > > > 
> > > > All mail to and from this domain is GFI-scanned.
> > > 
> > > ------------------------------------------------------
> > > List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
> > > ISA Server Newsletter: 
> http://www.isaserver.org/pages/newsletter.asp
> > > ISA Server FAQ: 
> http://www.isaserver.org/pages/larticle.asp?type=FAQ
> > > ------------------------------------------------------
> > > Visit TechGenix.com for more information about our other sites:
> > > http://www.techgenix.com
> > > ------------------------------------------------------
> > > You are currently subscribed to this ISAserver.org 
> > Discussion List as:
> > > jim@xxxxxxxxxxxx
> > > To unsubscribe visit 
> > http://www.webelists.com/cgi/lyris.pl?enter=isalist
> > > Report abuse to listadmin@xxxxxxxxxxxxx
> > > 
> > > All mail to and from this domain is GFI-scanned.
> > 
> > ------------------------------------------------------
> > List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
> > ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> > ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
> > ------------------------------------------------------
> > Visit TechGenix.com for more information about our other sites:
> > http://www.techgenix.com
> > ------------------------------------------------------
> > You are currently subscribed to this ISAserver.org Discussion 
> > List as: jim@xxxxxxxxxxxx
> > To unsubscribe visit 
> > http://www.webelists.com/cgi/lyris.pl?enter=isalist
> > Report abuse to listadmin@xxxxxxxxxxxxx
> > 
> > All mail to and from this domain is GFI-scanned.
> > 
> > 
> > ------------------------------------------------------
> > List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
> > ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> > ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
> > ------------------------------------------------------
> > Visit TechGenix.com for more information about our other sites:
> > http://www.techgenix.com
> > ------------------------------------------------------
> > You are currently subscribed to this ISAserver.org Discussion 
> > List as: tshinder@xxxxxxxxxxxxxxxxxx
> > To unsubscribe visit 
> > http://www.webelists.com/cgi/lyris.pl?enter=isalist
> > Report abuse to listadmin@xxxxxxxxxxxxx
> > 
> > 
> 
> ------------------------------------------------------
> List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
> ------------------------------------------------------
> Visit TechGenix.com for more information about our other sites:
> http://www.techgenix.com
> ------------------------------------------------------
> You are currently subscribed to this ISAserver.org Discussion 
> List as: jim@xxxxxxxxxxxx
> To unsubscribe visit 
> http://www.webelists.com/cgi/lyris.pl?enter=isalist
> Report abuse to listadmin@xxxxxxxxxxxxx
> 
> All mail to and from this domain is GFI-scanned.
> 
> 
> ------------------------------------------------------
> List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
> ------------------------------------------------------
> Visit TechGenix.com for more information about our other sites:
> http://www.techgenix.com
> ------------------------------------------------------
> You are currently subscribed to this ISAserver.org Discussion 
> List as: tshinder@xxxxxxxxxxxxxxxxxx
> To unsubscribe visit 
> http://www.webelists.com/cgi/lyris.pl?enter=isalist
> Report abuse to listadmin@xxxxxxxxxxxxx
> 
> 

------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as: 
jim@xxxxxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx

All mail to and from this domain is GFI-scanned.


------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as: 
jim@xxxxxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx

All mail to and from this domain is GFI-scanned.



Other related posts: