Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have two TMG servers set up with an IPSec Tunnel between them and can connect fine between the two internal networks.

Each TMG server has 3 NICs

  • Internal
  • External
  • DMZ

The problem I have is I can't see a way of setting up the IPSec Tunnel to be able to receive packets that are destined to the local DMZ.

I can add the DMZ range to the list of IP addresses for the VPN Network in TMG but there is no way of telling the remote end where the DMZ network is to "listen" for these addresses and so they just get dropped when they arrive.

Is this just a limitation of Forefront TMG to make setting up IPSec tunnels more idiot proof?

I notice that when setting up the VPN, the message on the Addresses tab does say "The VPN Network range should match the remote internal network" so I suspect what I am trying to do isn't possible although it feels like a fairly major use case for many people.

Any help or suggestions welcome.

share|improve this question
Phil, forgive my pointing this out, but you've asked 12 questions on SF, most of them have at least one answer, and you've accepted the answer for only one of those. We see this as a warning "11% accept rate" by your username. May I suggest that you spend an hour or two reviewing your past questions, and accepting answers where you can? –  MadHatter May 25 '12 at 13:11
Hi MadHatter, thanks for pointing it out, I was unaware I'd failed to accepted so few but have now accepted the ones that have been answered although unfortunately its only up to 44% and I presume marking an answer as acceptable when it isn't just to increase your acceptance rate is worse than not accepting :-) I must just be asking very tricky questions I guess –  Phil May 25 '12 at 18:30
Phil, I take your point. In any case, 44%'s much better than 11%, so thanks for that! –  MadHatter May 25 '12 at 19:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.