VPN Firewall through ISA

I have a SnapGear firewall which I will be using as the
VPN end point for my clients, rather than ISA/SBS2K.
I intended to run the firewall through the second NIC and
ISA Server so I could use the reporting features of ISA.
The problem is that because the firewall is a VPN Server
it needs to issue IP addresses out from it's subnet, which
is 192.168.0.255. The LAN IP range is totally different to
this.

What do I do? I haven't actively tested this yet as I am
still in the early stages but need to prepare before I go
too far to turn back. If the VPN clients are issued the
192.168.0.255 address will they still be able to acess the
LAN?

Any suggestions, comments or further questions most
welcome.

Thanks.

Tippy.

Chris
Tue Jan 13 21:19:38 CST 2004


Hi Tippy

What is the IP of your ISA servers external interface?

Regards
Chris

Tippy
Tue Jan 13 21:33:29 CST 2004

Thanks for your reply Chris.

My ISA's external IP address is 192.168.0.2
The Internal IP is 120.1.3.x

Thanks.

Tippy



>-----Original Message-----
>
>Hi Tippy
>
>What is the IP of your ISA servers external interface?
>
>Regards
>Chris
>.
>

Marina
Wed Jan 14 06:13:21 CST 2004

Tippy,

How come you're using public IP's on your internal network? Do you have 2
nics? Can you post the ipconfig/all please?

--
Regards,

Marina

"Tippy" <glenn@voodoodolls.com> schreef in bericht
news:04db01c3da4f$2d4712d0$a601280a@phx.gbl...
> Thanks for your reply Chris.
>
> My ISA's external IP address is 192.168.0.2
> The Internal IP is 120.1.3.x
>
> Thanks.
>
> Tippy
>
>
>
> >-----Original Message-----
> >
> >Hi Tippy
> >
> >What is the IP of your ISA servers external interface?
> >
> >Regards
> >Chris
> >.
> >

Tippy
Wed Jan 14 17:31:25 CST 2004

Marina,

IP configuration was set up here before I arrived by
(supposed) professionals.

The IP details are as follows. The router is not properly
installed yet, but this is roughly how it will look except
for the default gateway for the LAN.

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . : Voodoosrv
Primary DNS Suffix . . . . . . . :
VoodooDolls.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . :
VoodooDolls.local

Ethernet adapter StirlingAP LAN:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : IBM Netfinity
10/100 Ethernet Adapter
Physical Address. . . . . . . . . : FE-00-42-FD-45-
32
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 120.1.3.100
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 120.1.3.50
DNS Servers . . . . . . . . . . . : 120.1.3.100
Primary WINS Server . . . . . . . : 120.1.3.100

Ethernet adapter ADSL WAN:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : NETGEAR
FA311/FA312 PCI Adapter
Physical Address. . . . . . . . . : 87-AA-A1-B2-F2-
32
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 120.1.3.100
NetBIOS over Tcpip. . . . . . . . : Disabled

Thanks

Tippy.



>-----Original Message-----
>Tippy,
>
>How come you're using public IP's on your internal
network? Do you have 2
>nics? Can you post the ipconfig/all please?
>
>--
>Regards,
>
>Marina
>
>"Tippy" <glenn@voodoodolls.com> schreef in bericht
>news:04db01c3da4f$2d4712d0$a601280a@phx.gbl...
>> Thanks for your reply Chris.
>>
>> My ISA's external IP address is 192.168.0.2
>> The Internal IP is 120.1.3.x
>>
>> Thanks.
>>
>> Tippy
>>
>>
>>
>> >-----Original Message-----
>> >
>> >Hi Tippy
>> >
>> >What is the IP of your ISA servers external interface?
>> >
>> >Regards
>> >Chris
>> >.
>> >
>
>
>.
>

Marina
Wed Jan 14 18:24:21 CST 2004

The internal nic should have a blank gateway, so take out the 120.1.3.50.
You might consider changing the internal IP-range to something like
10.0.0.x.
Check if you have options 003, 006 and 015 in DHCP-server, Scope options.
003 and 006 should point to your server-IP. 015 should be your AD-domainname
(company.local).
Check DNS-server, to see if it allows dynamic updates (properties of Forward
and Reverse lookup zones).
Check the internal nic, TCP/IP, advanced, DNS and make sure that the 'add
primary suffixes' is checked as well as the 'register in DNS'.

--
Regards,

Marina

"Tippy" <glenn@voodoodolls.com> schreef in bericht
news:043501c3daf6$86e52500$a401280a@phx.gbl...
> Marina,
>
> IP configuration was set up here before I arrived by
> (supposed) professionals.
>
> The IP details are as follows. The router is not properly
> installed yet, but this is roughly how it will look except
> for the default gateway for the LAN.
>
> Windows 2000 IP Configuration
>
> Host Name . . . . . . . . . . . . : Voodoosrv
> Primary DNS Suffix . . . . . . . :
> VoodooDolls.local
> Node Type . . . . . . . . . . . . : Hybrid
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . :
> VoodooDolls.local
>
> Ethernet adapter StirlingAP LAN:
>
> Connection-specific DNS Suffix . :
> Description . . . . . . . . . . . : IBM Netfinity
> 10/100 Ethernet Adapter
> Physical Address. . . . . . . . . : FE-00-42-FD-45-
> 32
> DHCP Enabled. . . . . . . . . . . : No
> IP Address. . . . . . . . . . . . : 120.1.3.100
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : 120.1.3.50
> DNS Servers . . . . . . . . . . . : 120.1.3.100
> Primary WINS Server . . . . . . . : 120.1.3.100
>
> Ethernet adapter ADSL WAN:
>
> Connection-specific DNS Suffix . :
> Description . . . . . . . . . . . : NETGEAR
> FA311/FA312 PCI Adapter
> Physical Address. . . . . . . . . : 87-AA-A1-B2-F2-
> 32
> DHCP Enabled. . . . . . . . . . . : No
> IP Address. . . . . . . . . . . . : 192.168.0.2
> Subnet Mask . . . . . . . . . . . : 255.255.255.0
> Default Gateway . . . . . . . . . : 192.168.0.1
> DNS Servers . . . . . . . . . . . : 120.1.3.100
> NetBIOS over Tcpip. . . . . . . . : Disabled
>
> Thanks
>
> Tippy.
>
>
>
> >-----Original Message-----
> >Tippy,
> >
> >How come you're using public IP's on your internal
> network? Do you have 2
> >nics? Can you post the ipconfig/all please?
> >
> >--
> >Regards,
> >
> >Marina
> >
> >"Tippy" <glenn@voodoodolls.com> schreef in bericht
> >news:04db01c3da4f$2d4712d0$a601280a@phx.gbl...
> >> Thanks for your reply Chris.
> >>
> >> My ISA's external IP address is 192.168.0.2
> >> The Internal IP is 120.1.3.x
> >>
> >> Thanks.
> >>
> >> Tippy
> >>
> >>
> >>
> >> >-----Original Message-----
> >> >
> >> >Hi Tippy
> >> >
> >> >What is the IP of your ISA servers external interface?
> >> >
> >> >Regards
> >> >Chris
> >> >.
> >> >
> >
> >
> >.
> >

Tippy
Wed Jan 14 19:09:17 CST 2004

Marina,

Thank you very much for your detailed reply. Is this all I
need to do and VPN clients should work? Is it cool for VPN
clients to be issued with a different IP than the server?
I assumed there would be routing problems.

Thanks again.

Tippy.


>-----Original Message-----
>The internal nic should have a blank gateway, so take out
the 120.1.3.50.
>You might consider changing the internal IP-range to
something like
>10.0.0.x.
>Check if you have options 003, 006 and 015 in DHCP-
server, Scope options.
>003 and 006 should point to your server-IP. 015 should be
your AD-domainname
>(company.local).
>Check DNS-server, to see if it allows dynamic updates
(properties of Forward
>and Reverse lookup zones).
>Check the internal nic, TCP/IP, advanced, DNS and make
sure that the 'add
>primary suffixes' is checked as well as the 'register in
DNS'.
>
>--
>Regards,
>
>Marina
>
>"Tippy" <glenn@voodoodolls.com> schreef in bericht
>news:043501c3daf6$86e52500$a401280a@phx.gbl...
>> Marina,
>>
>> IP configuration was set up here before I arrived by
>> (supposed) professionals.
>>
>> The IP details are as follows. The router is not
properly
>> installed yet, but this is roughly how it will look
except
>> for the default gateway for the LAN.
>>
>> Windows 2000 IP Configuration
>>
>> Host Name . . . . . . . . . . . . : Voodoosrv
>> Primary DNS Suffix . . . . . . . :
>> VoodooDolls.local
>> Node Type . . . . . . . . . . . . : Hybrid
>> IP Routing Enabled. . . . . . . . : No
>> WINS Proxy Enabled. . . . . . . . : No
>> DNS Suffix Search List. . . . . . :
>> VoodooDolls.local
>>
>> Ethernet adapter StirlingAP LAN:
>>
>> Connection-specific DNS Suffix . :
>> Description . . . . . . . . . . . : IBM
Netfinity
>> 10/100 Ethernet Adapter
>> Physical Address. . . . . . . . . : FE-00-42-FD-
45-
>> 32
>> DHCP Enabled. . . . . . . . . . . : No
>> IP Address. . . . . . . . . . . . : 120.1.3.100
>> Subnet Mask . . . . . . . . . . . :
255.255.255.0
>> Default Gateway . . . . . . . . . : 120.1.3.50
>> DNS Servers . . . . . . . . . . . : 120.1.3.100
>> Primary WINS Server . . . . . . . : 120.1.3.100
>>
>> Ethernet adapter ADSL WAN:
>>
>> Connection-specific DNS Suffix . :
>> Description . . . . . . . . . . . : NETGEAR
>> FA311/FA312 PCI Adapter
>> Physical Address. . . . . . . . . : 87-AA-A1-B2-
F2-
>> 32
>> DHCP Enabled. . . . . . . . . . . : No
>> IP Address. . . . . . . . . . . . : 192.168.0.2
>> Subnet Mask . . . . . . . . . . . :
255.255.255.0
>> Default Gateway . . . . . . . . . : 192.168.0.1
>> DNS Servers . . . . . . . . . . . : 120.1.3.100
>> NetBIOS over Tcpip. . . . . . . . : Disabled
>>
>> Thanks
>>
>> Tippy.
>>
>>
>>
>> >-----Original Message-----
>> >Tippy,
>> >
>> >How come you're using public IP's on your internal
>> network? Do you have 2
>> >nics? Can you post the ipconfig/all please?
>> >
>> >--
>> >Regards,
>> >
>> >Marina
>> >
>> >"Tippy" <glenn@voodoodolls.com> schreef in bericht
>> >news:04db01c3da4f$2d4712d0$a601280a@phx.gbl...
>> >> Thanks for your reply Chris.
>> >>
>> >> My ISA's external IP address is 192.168.0.2
>> >> The Internal IP is 120.1.3.x
>> >>
>> >> Thanks.
>> >>
>> >> Tippy
>> >>
>> >>
>> >>
>> >> >-----Original Message-----
>> >> >
>> >> >Hi Tippy
>> >> >
>> >> >What is the IP of your ISA servers external
interface?
>> >> >
>> >> >Regards
>> >> >Chris
>> >> >.
>> >> >
>> >
>> >
>> >.
>> >
>
>
>.
>

Marina
Thu Jan 15 04:29:28 CST 2004

Hi Tippy,

In the RRAS configuration, you can decide if you want RAS-clients to get an
IP from a static pool that you create, or that they just listen to the
internal nic.

--
Regards,

Marina

"Tippy" <glenn@voodoodolls.com> schreef in bericht
news:050901c3db04$327eaaa0$a401280a@phx.gbl...
> Marina,
>
> Thank you very much for your detailed reply. Is this all I
> need to do and VPN clients should work? Is it cool for VPN
> clients to be issued with a different IP than the server?
> I assumed there would be routing problems.
>
> Thanks again.
>
> Tippy.
>
>
> >-----Original Message-----
> >The internal nic should have a blank gateway, so take out
> the 120.1.3.50.
> >You might consider changing the internal IP-range to
> something like
> >10.0.0.x.
> >Check if you have options 003, 006 and 015 in DHCP-
> server, Scope options.
> >003 and 006 should point to your server-IP. 015 should be
> your AD-domainname
> >(company.local).
> >Check DNS-server, to see if it allows dynamic updates
> (properties of Forward
> >and Reverse lookup zones).
> >Check the internal nic, TCP/IP, advanced, DNS and make
> sure that the 'add
> >primary suffixes' is checked as well as the 'register in
> DNS'.
> >
> >--
> >Regards,
> >
> >Marina
> >
> >"Tippy" <glenn@voodoodolls.com> schreef in bericht
> >news:043501c3daf6$86e52500$a401280a@phx.gbl...
> >> Marina,
> >>
> >> IP configuration was set up here before I arrived by
> >> (supposed) professionals.
> >>
> >> The IP details are as follows. The router is not
> properly
> >> installed yet, but this is roughly how it will look
> except
> >> for the default gateway for the LAN.
> >>
> >> Windows 2000 IP Configuration
> >>
> >> Host Name . . . . . . . . . . . . : Voodoosrv
> >> Primary DNS Suffix . . . . . . . :
> >> VoodooDolls.local
> >> Node Type . . . . . . . . . . . . : Hybrid
> >> IP Routing Enabled. . . . . . . . : No
> >> WINS Proxy Enabled. . . . . . . . : No
> >> DNS Suffix Search List. . . . . . :
> >> VoodooDolls.local
> >>
> >> Ethernet adapter StirlingAP LAN:
> >>
> >> Connection-specific DNS Suffix . :
> >> Description . . . . . . . . . . . : IBM
> Netfinity
> >> 10/100 Ethernet Adapter
> >> Physical Address. . . . . . . . . : FE-00-42-FD-
> 45-
> >> 32
> >> DHCP Enabled. . . . . . . . . . . : No
> >> IP Address. . . . . . . . . . . . : 120.1.3.100
> >> Subnet Mask . . . . . . . . . . . :
> 255.255.255.0
> >> Default Gateway . . . . . . . . . : 120.1.3.50
> >> DNS Servers . . . . . . . . . . . : 120.1.3.100
> >> Primary WINS Server . . . . . . . : 120.1.3.100
> >>
> >> Ethernet adapter ADSL WAN:
> >>
> >> Connection-specific DNS Suffix . :
> >> Description . . . . . . . . . . . : NETGEAR
> >> FA311/FA312 PCI Adapter
> >> Physical Address. . . . . . . . . : 87-AA-A1-B2-
> F2-
> >> 32
> >> DHCP Enabled. . . . . . . . . . . : No
> >> IP Address. . . . . . . . . . . . : 192.168.0.2
> >> Subnet Mask . . . . . . . . . . . :
> 255.255.255.0
> >> Default Gateway . . . . . . . . . : 192.168.0.1
> >> DNS Servers . . . . . . . . . . . : 120.1.3.100
> >> NetBIOS over Tcpip. . . . . . . . : Disabled
> >>
> >> Thanks
> >>
> >> Tippy.
> >>
> >>
> >>
> >> >-----Original Message-----
> >> >Tippy,
> >> >
> >> >How come you're using public IP's on your internal
> >> network? Do you have 2
> >> >nics? Can you post the ipconfig/all please?
> >> >
> >> >--
> >> >Regards,
> >> >
> >> >Marina
> >> >
> >> >"Tippy" <glenn@voodoodolls.com> schreef in bericht
> >> >news:04db01c3da4f$2d4712d0$a601280a@phx.gbl...
> >> >> Thanks for your reply Chris.
> >> >>
> >> >> My ISA's external IP address is 192.168.0.2
> >> >> The Internal IP is 120.1.3.x
> >> >>
> >> >> Thanks.
> >> >>
> >> >> Tippy
> >> >>
> >> >>
> >> >>
> >> >> >-----Original Message-----
> >> >> >
> >> >> >Hi Tippy
> >> >> >
> >> >> >What is the IP of your ISA servers external
> interface?
> >> >> >
> >> >> >Regards
> >> >> >Chris
> >> >> >.
> >> >> >
> >> >
> >> >
> >> >.
> >> >
> >
> >
> >.
> >

Joe
Mon Feb 16 15:49:48 CST 2004

Tippy,
It is very easy to tell the snapgear firewall to assign ip addresses
that belong to your existing internal ip address block simply by making
changes to the vpn configuration. If you have trouble doing this simply
call the snapgear tech support. They will walk you through the proper steps
to assign addresses to the vpn users so that when they come in they are
using the same ips as the other computers that access the network locally.

Joe


"Tippy" <glenn@voodoodolls.com> wrote in message
news:050901c3db04$327eaaa0$a401280a@phx.gbl...
> Marina,
>
> Thank you very much for your detailed reply. Is this all I
> need to do and VPN clients should work? Is it cool for VPN
> clients to be issued with a different IP than the server?
> I assumed there would be routing problems.
>
> Thanks again.
>
> Tippy.
>
>
> >-----Original Message-----
> >The internal nic should have a blank gateway, so take out
> the 120.1.3.50.
> >You might consider changing the internal IP-range to
> something like
> >10.0.0.x.
> >Check if you have options 003, 006 and 015 in DHCP-
> server, Scope options.
> >003 and 006 should point to your server-IP. 015 should be
> your AD-domainname
> >(company.local).
> >Check DNS-server, to see if it allows dynamic updates
> (properties of Forward
> >and Reverse lookup zones).
> >Check the internal nic, TCP/IP, advanced, DNS and make
> sure that the 'add
> >primary suffixes' is checked as well as the 'register in
> DNS'.
> >
> >--
> >Regards,
> >
> >Marina
> >
> >"Tippy" <glenn@voodoodolls.com> schreef in bericht
> >news:043501c3daf6$86e52500$a401280a@phx.gbl...
> >> Marina,
> >>
> >> IP configuration was set up here before I arrived by
> >> (supposed) professionals.
> >>
> >> The IP details are as follows. The router is not
> properly
> >> installed yet, but this is roughly how it will look
> except
> >> for the default gateway for the LAN.
> >>
> >> Windows 2000 IP Configuration
> >>
> >> Host Name . . . . . . . . . . . . : Voodoosrv
> >> Primary DNS Suffix . . . . . . . :
> >> VoodooDolls.local
> >> Node Type . . . . . . . . . . . . : Hybrid
> >> IP Routing Enabled. . . . . . . . : No
> >> WINS Proxy Enabled. . . . . . . . : No
> >> DNS Suffix Search List. . . . . . :
> >> VoodooDolls.local
> >>
> >> Ethernet adapter StirlingAP LAN:
> >>
> >> Connection-specific DNS Suffix . :
> >> Description . . . . . . . . . . . : IBM
> Netfinity
> >> 10/100 Ethernet Adapter
> >> Physical Address. . . . . . . . . : FE-00-42-FD-
> 45-
> >> 32
> >> DHCP Enabled. . . . . . . . . . . : No
> >> IP Address. . . . . . . . . . . . : 120.1.3.100
> >> Subnet Mask . . . . . . . . . . . :
> 255.255.255.0
> >> Default Gateway . . . . . . . . . : 120.1.3.50
> >> DNS Servers . . . . . . . . . . . : 120.1.3.100
> >> Primary WINS Server . . . . . . . : 120.1.3.100
> >>
> >> Ethernet adapter ADSL WAN:
> >>
> >> Connection-specific DNS Suffix . :
> >> Description . . . . . . . . . . . : NETGEAR
> >> FA311/FA312 PCI Adapter
> >> Physical Address. . . . . . . . . : 87-AA-A1-B2-
> F2-
> >> 32
> >> DHCP Enabled. . . . . . . . . . . : No
> >> IP Address. . . . . . . . . . . . : 192.168.0.2
> >> Subnet Mask . . . . . . . . . . . :
> 255.255.255.0
> >> Default Gateway . . . . . . . . . : 192.168.0.1
> >> DNS Servers . . . . . . . . . . . : 120.1.3.100
> >> NetBIOS over Tcpip. . . . . . . . : Disabled
> >>
> >> Thanks
> >>
> >> Tippy.
> >>
> >>
> >>
> >> >-----Original Message-----
> >> >Tippy,
> >> >
> >> >How come you're using public IP's on your internal
> >> network? Do you have 2
> >> >nics? Can you post the ipconfig/all please?
> >> >
> >> >--
> >> >Regards,
> >> >
> >> >Marina
> >> >
> >> >"Tippy" <glenn@voodoodolls.com> schreef in bericht
> >> >news:04db01c3da4f$2d4712d0$a601280a@phx.gbl...
> >> >> Thanks for your reply Chris.
> >> >>
> >> >> My ISA's external IP address is 192.168.0.2
> >> >> The Internal IP is 120.1.3.x
> >> >>
> >> >> Thanks.
> >> >>
> >> >> Tippy
> >> >>
> >> >>
> >> >>
> >> >> >-----Original Message-----
> >> >> >
> >> >> >Hi Tippy
> >> >> >
> >> >> >What is the IP of your ISA servers external
> interface?
> >> >> >
> >> >> >Regards
> >> >> >Chris
> >> >> >.
> >> >> >
> >> >
> >> >
> >> >.
> >> >
> >
> >
> >.
> >