Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a very standard setup with a Windows Server 2003 domain controller issuing IP addresses using DHCP. This works fine.

Internet access is managed via Microsoft ISA Server 2006 Standard. Clients are required to authenticate and this works fine.

We now need to provide wireless internet access to visitors for laptops, iPhones etc.

We've bought a couple of Netgear access points so I was thinking we might be able to issue wireless clients connected to it with an IP address on a different subnet and then allow non-authenticated Internet access via the ISA Server for that IP range.

Does that sound plausible? I'm not even sure if I can issue a different subnet to wireless clients.

share|improve this question

You sure can do this. You'll need to put a few things together to do it.

Step 1 Connect and configure a new network segment to your ISA server for the wireless network. (you could use the DMZ but I don't recommend putting DHCP on your DMZ). Link it up to your Netgear AP's.

Step 2 Configure ISA server to allow DHCP Relay. See this article:

Step 3 Install Routing and Remote Access and configure DHCP Relay on the ISA server. See this article:

Step 4 Create a DHCP scope corresponding to your new subnet. What's cool is that your DHCP server will automatically issue an address from the correct subnet because the DHCP Relay Agent tells it which subnet it needs an address from.

This is a fair amount of stuff that all has to work in concert. I recommend three areas to help troubleshoot: 1. Temporarily stop the ISA server service and get it to work that way first 2. Use ISA server monitoring logs 3. Use Microsoft Network Monitor ( or Wireshark ( If you're not handy with a packet sniffer, this is the perfect time to start.

share|improve this answer

Well I'm not entirely sure how the ISA works in this scenario. So we might need more info about your typology.

We did something similar on my network once, with an ASA and Cisco Wireless Controller sitting in the DMZ, so it sounds plausible atleast :)

But as far as DHCP goes ...

But I think you could set the Netgear access points to a different subnet then create a different DHCP scope on our Server 2003 box. You'd have to make sure you setup routing between the Netgear subnet and your internet edge (presumably your ISA).

Directions to add a DHCP scope found here.

share|improve this answer
How would I configure Windows DHCP to issue IP's from a different subnet? Alternatively, if the wireless clients never needed access to LAN resources could I put the AP in the DMZ on my firewall? – Danny Jun 3 '11 at 13:25
It depends if we are talking a web or application server, or if you want them to authenticate against AD. IF they needed to access LAN resources they should be inside the LAN. The DMZ is not used for that, there are too many ports required for windows networking you'd turn your DMZ into swiss cheese. – JamesBarnett Jun 3 '11 at 14:25
@Beanz see updated my answer with link to step-by-step directions on how to add a new DHCP Scope of Server 2003. – JamesBarnett Jun 3 '11 at 14:29
thanks for the link. The issue I have is having the new subnet only available to the wireless clients rather than all clients. – Danny Jun 4 '11 at 14:47
The wireless clients would not need access to LAN resources so the DMZ is a potential option I suppose? – Danny Jun 4 '11 at 14:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.