We have two TMG servers set up with an IPSec Tunnel between them and can connect fine between the two internal networks.
Each TMG server has 3 NICs
The problem I have is I can't see a way of setting up the IPSec Tunnel to be able to receive packets that are destined to the local DMZ.
I can add the DMZ range to the list of IP addresses for the VPN Network in TMG but there is no way of telling the remote end where the DMZ network is to "listen" for these addresses and so they just get dropped when they arrive.
Is this just a limitation of Forefront TMG to make setting up IPSec tunnels more idiot proof?
I notice that when setting up the VPN, the message on the Addresses tab does say "The VPN Network range should match the remote internal network" so I suspect what I am trying to do isn't possible although it feels like a fairly major use case for many people.
Any help or suggestions welcome.