Windows Server - ISA 2004 Network Rules

Asked By JiminClevelan

02-Aug-07 04:58 PM

I just loaded ISA 2004 on a new server.  Out of the box, there are three
Network Rules:
Local Host to all networks  route
VPN Clients to Internal       route
Internal to External     NAT

Do I also have to set up a Network Rule (External to Internal) so that
people outside can get to our Web sites?  Or will this be taken care of with
Web & Server Publishing Rules?

Jim

02-Aug-07 05:24 PM

Yes, you need Web?Server Publishing rules to allow External users to access
your Internal Server behind ISA Server

HTH,
Tarek
--
_____________________________

Tarek Majdalani
Computer Engineer, CIW, MCSA: Security 2000/2003, TS: Windows Vista
MVP -- ISA Firewalls
Website : http://www.elmajdal.net/ISAServer

02-Aug-07 05:32 PM

Tarek,

Thanks for the reply.  I know that I have to create publishing rules for our
web site and our exchange server.  In reading Shinder's book, I thought it
also said that in order for two different networks to talk, there needed to
be a Network rule in place.  I just wasn't sure if I needed a Network rule as
well as Publishing rules or if just the Publishing rules would be suffice.
Am I correct in saying that?

Jim

03-Aug-07 12:24 PM

Publishing Rules - Yes
Network Rules - No

You must have read Tom's material out of the proper context.

--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html

Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/download/9/1/8/918ed2d3-71d0-40ed-8e6d-fd6eeb6cfa07/ts_rules.doc

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp

Microsoft ISA Server Partners: Partner Hardware Solutions
http://www.microsoft.com/forefront/edgesecurity/partners/hardwarepartners.mspx
-----------------------------------------------------

03-Aug-07 02:44 PM

To clarify a little more,...Network Rules establish Relationships, not
access control.  A Relationship is either going to be NAT (includes
proxying) or it will be Routed.

The relationship between Internal Type networks (including VPN Networks) and
the External Network (including DMZs) is typically a NATed relationship
while most other relationships are Routed.

--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html

Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/download/9/1/8/918ed2d3-71d0-40ed-8e6d-fd6eeb6cfa07/ts_rules.doc

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp

Microsoft ISA Server Partners: Partner Hardware Solutions
http://www.microsoft.com/forefront/edgesecurity/partners/hardwarepartners.mspx
-----------------------------------------------------