13 reputation
5
bio website
location Washington State, USA
age
visits member for 1 year, 7 months
seen Nov 8 '13 at 3:37

Basically the systems/network guy for a smallish organization. We're small so I do all networks and all systems plus a little of everything else!


Sep
24
awarded  Autobiographer
Jul
11
awarded  Scholar
Jul
11
comment Use a dedicated subnet to connect all routers/firewalls?
I marked this as the answer because although I'm not going to follow it totally this answer provides the principles I was looking for. Because I need to use TMG in front of some other servers I am going to go ahead with my proposed network diagram in the question. Thanks for the help and the info.
Jul
11
accepted Use a dedicated subnet to connect all routers/firewalls?
Jul
10
comment Use a dedicated subnet to connect all routers/firewalls?
Well it's basically only the routing part I wanted help with and so far at least you've helped confirm my idea makes some sense if not exactly how you'd do it. If no one else has any ideas in the next couple days I'll mark this as the answer. Thanks.
Jul
9
comment Use a dedicated subnet to connect all routers/firewalls?
here's a link to Microsoft's definition of "publishing" a Sharepoint server technet.microsoft.com/en-us/library/cc441501.aspx
Jul
9
comment Use a dedicated subnet to connect all routers/firewalls?
I mean "publish" as used in MS TMG which means the client connects and authenticates to TMG instead of directly to the Exchange or Sharepoint server. PfSense is my main router but can't perform the same type of authentication services at the application layer so I use ISA and TMG on the few other public IPs I have.
Jul
9
awarded  Informed
Jul
9
comment Use a dedicated subnet to connect all routers/firewalls?
Okay I see where you're going with this and it makes sense. I don't have multiple ISPs though; just one with a /28. I think your diagram would work except for the fact that each router has different functions. My Router A would be pfSense and I want to publish MS stuff behind TMG2010 which would be Router 1. So in this diagram how would I publish 10.20.20.100 behind Router 1 for users on 192.168.1.0 and external clients?
Jul
8
comment Use a dedicated subnet to connect all routers/firewalls?
sorry didn't know "Enter" sent the comment. Assume both Router1 and Router2 also have publicly addressable IPs on another interface and NAT is enabled. If Server A with IP 192.168.1.100 is published behind Router2 but has Router1 as it's def GW then a packet coming in from the internet via Router2 will be replied to via Router1 and the packet will be blocked by the firewall on the far end. In this case I need to set Server A to use Router2 as the def GW and add static routes on Server A to networks behind the other routers and this seems too complex.
Jul
8
comment Use a dedicated subnet to connect all routers/firewalls?
Fukawi2, yes your description of the problem is correct in general although I simplified it a bit. I will attempt to explain the actual problem I've had which is not so much rules.
Jul
8
awarded  Editor
Jul
8
revised Use a dedicated subnet to connect all routers/firewalls?
corrected 10.200.200.1/24 as referenced in the comment.
Jul
8
awarded  Student
Jul
8
asked Use a dedicated subnet to connect all routers/firewalls?
Jul
7
answered Can Wireshark capture an entire Ethernet frame including preamble, CRC and Interframe spacing?