Tom's Guide | Tom's Hardware | Tom's Games
![]() |
![]() |
![]() |
We have a domain run with two servers, and three IP ranges:
10.0.0.x for servers and fixed IP gear like printers
10.0.1.x and 10.0.2.x DHCP fr PCs and laptopsWe cannot ping a machine outside your IP range, this also means if you're a 1.x or 2.x you can't ping externally. I can't find anything other than a 255.255.0.0 subnet mask in Routing and Remote Access, ISA Management etc but I'm obviously missing something.
This is becoming an issue as there is some software we need to use that isn't able to connect to the web because of this - any ideas?

Are ISA servers acting as routers between the subnets?
TECH-NO-LOGICAL ROMANCE!
http://www.homestarrunner.com/tgs12.html

Both ISA servers have an IP packet filter rule to allow all traffic. Enable IP routing has been ticked in the properties page. Both have been enabled as routers in RRAS.
There's got to be something staring me in the face, but I've been working on this almost non-stop for two days and my brain has turned to mush...

Sure would like to know what the designer was thinking [or smoking] with servers on a different subnet than the pcs accessing them. Appears to me that all that was accomplished was to create a series of bottlenecks.
what ports does the program require and are they open on all routers? Does DNS have all three subnets listed?
Give a person a fish, they eat for a day. Suggest they internet search and they learn a skill for a lifetime.

Are these ISA 2000, 2004, or 2006 servers?
"Enough, enough bowing down to disillusion!
Hats off & applause to rogues & evolution!
The ripple effect is too good not to mention.
If you’re not affected, you’re not paying attention!"

wanderer - I know what you mean, there's only about 200 machines in the entire place so we don't really need three subnets, certainly not with two DHCP servers controlling them. If I ever meet the bloke who laid out this network (and put the servers at opposite ends of the site, but made both of them critical - one with the router, and the other with the profile store) I won't be responsible for my actions!
I don't think it's a port issue (it uses some weird five digit code I can't remember at the moment) as ping, tracert etc have the same issues. As far as I can tell I've opened all ports for the time being to try and solve this. As for DNS, the Reverse Lookup Zone is set as 10.0.x.x and has all three listed so that should be OK.
heropsycho - The machines are running ISA 2000 (I know as I had to find the CD because they'd been configured in cache mode so I had to reinstall it to get IP routing)

I'm more familiar with ISA 2004/2006, but at least with those, most traffic is denied between networks. You definitely should check the firewall policy.
"Enough, enough bowing down to disillusion!
Hats off & applause to rogues & evolution!
The ripple effect is too good not to mention.
If you’re not affected, you’re not paying attention!"

Trying to run through the Security Configuration wizard just comes up with an error. It tells me to refer to the log, which (apart from a couple of access problems with open files) has no errors in it!
Is ther any way of manually defining a firewall policy to communicate between subnets in ISA 2000?

I don't mean to sound like a jerk, but if you don't know how to admin the ISA server, why are you admining it? Get someone there who knows ISA 2000 to fix this.
I don't know ISA 2000 either, and if I didn't have any idea how to do it, I'd either read a book on the product or I'd call someone who knows it to fix it.
"Enough, enough bowing down to disillusion!
Hats off & applause to rogues & evolution!
The ripple effect is too good not to mention.
If you’re not affected, you’re not paying attention!"

The problem is, as a one man IT department I'm the one that's supposed to know this, that is when they send me on that training course...
I've been trying to read up on it from the web, but in between setting up twenty brand new PCs, having colleagues coming to me every ten minutes saying "can you fix this?" and trying not to lose my mind, I haven't had much time.

Then they made a mistake to think they can get away with a one man IT shop with no outside consultant help.
Look, I'm an AD, Exchange, ISA 2004/2006 expert. I don't really know all that much how to image PC's and mass deploy them aside from basics like you can use Ghost, or RIS, etc. That's why I don't do that stuff. You simply cannot know it all, and for them to expect that from you is unrealistic.
If you touted yourself as "I know ISA 2000" and are stuck, hey, that's on you, but otherwise, your employers are clueless on how to manage IT.
ISA is truly an enterprise class product. It takes serious time to learn how to use it.
"Enough, enough bowing down to disillusion!
Hats off & applause to rogues & evolution!
The ripple effect is too good not to mention.
If you’re not affected, you’re not paying attention!"

To be frank, I was employed as a technician to maintain hardware mainly on the PC system side, I've been here for nearly eighteen months and this is the first time I've had to go in depth into the server setup. I didn't tout myself as knowing it, in fact I specifically stated my complete lack of server side knowledge, but they employed me anyway. We do have people we can contact, but as their support contract hasn't been renewed they probably won't be too co-operative. Looks like we might not have a choice.

You have a choice - bumble it up and potentially blow the environment up, or pay the piper.
It's cheaper to pay the piper. ;-)
"Enough, enough bowing down to disillusion!
Hats off & applause to rogues & evolution!
The ripple effect is too good not to mention.
If you’re not affected, you’re not paying attention!"

I think you're right - I sent an email to the contractor who set it up originally in hope they'll take pity on a poor technician out of his depth.
I know what you mean about "bumbling it up", somehow the work I was doing yesterday in ISA compelled everyone who logged in this morning to reset their passwords...perculiar!

Do yourself a favor...
http://www.microsoft.com/downloads/...
http://www.vmware.com/download/server/
Learn in a lab, not on production.
TECH-NO-LOGICAL ROMANCE!
http://www.homestarrunner.com/tgs12.html

![]() |
![]() |
![]() |

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |