[isalist] Re: External Network

  • From: "Jim Harrison" <Jim@xxxxxxxxxxxx>
  • To: <isalist@xxxxxxxxxxxxx>
  • Date: Fri, 16 Mar 2007 22:29:55 -0700

Check your ISA alerts.

My $ says you had the 192.168/16 range predefined as part of the
internal network.

 

From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Ball, Dan
Sent: Friday, March 16, 2007 9:36 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] External Network

 

I had an hour to kill, so I was trying to install a network load
balancing device in front of my ISA server (already had it setup waiting
to be plugged in).

 

Original Configuration:

 

    Internet

       |

(24.213.58.250)

      ISA

  (10.20.1.1)

       |

      LAN

 

 

I tried to change it to this:

 

    Internet

       |

(24.213.58.250)

   PowerLink

(192.168.111.2)

       |

(192.168.111.1)

      ISA

  (10.20.1.1)

       |

      LAN

 

I changed the NIC settings in the ISA server to 192.168.1.1, with a
default gateway of 192.168.1.2, changed the patch cords, and rebooted
the server.

 

I couldn't get the ISA server to route traffic to the 192.168.111.x
subnet.  If I tried to ping 192.168.111.2, I would get "Destination Host
Unreachable".  I left all other NICs unchanged, and that NIC was only
one with a default gateway set.  I checked the routing table, and that
appeared right, I even added a static route to make sure, but still got
the same message.  I have no perimeter networks in the 192.168.x.x
range, and my Internal network is in the 10.20.x.x range.  Since I found
no hard-coded entries for the old IP address in either the server or
ISA, and the routing table is generated by the server, I was assuming
(apparently incorrectly) that all I had to do was change the IP address
on the external NIC, and it "should" work.  

 

Before I head back into work this weekend to look at it closer, what
major step did I miss?  I checked articles on isaserver.org, and found
many references to using a 192.168.x.x subnet on the external side, so
that shouldn't be the issue.

 

 

 

 


All mail to and from this domain is GFI-scanned.

Other related posts: