Nat on RRAS with ISA 2004

Hi,

we want to deploy ISA server in our organization. we have 5 static public ip
address to map to 5 private address its working fine with our current router
with firewall. But, in that firewall we cannot control internet access to
users and etc. so, we want's to deploy the isa server. but, we understand in
isa server cannot do mulitiple nat it can be one-to-one only. Can I install
RRAS and ISA 2004 same box? If possible. can we use RRAS NAT to configure
multiple nat address and configure ISA 2004 on same box is ok?

Any suggestions please....!!!!

Thanks

"Mohan" <(E-Mail Removed)> wrote in message
news:79B844E2-21E9-4458-8F74-(E-Mail Removed)...
> we want to deploy ISA server in our organization. we have 5 static public
ip
> address to map to 5 private address its working fine with our current
router
> with firewall.

That is a very bad thing to do in the first place. You might as well have
hose 5 machines sitting "but naked" out on the Internet to begin with,...it
is the same thing. Your firewall is doing absolutley nothing to protect
you,...in fact, it is doing just the opposite,...it is exposing you.

> But, in that firewall we cannot control internet access to
> users and etc. so, we want's to deploy the isa server.

Sounds good.

>but, we understand in isa server cannot do mulitiple nat it can be
one-to-one only.

Correct,...ISA is primarily a "proxy" server not a NAT Server. NAT and
proxying are two different technologies.

> Can I install RRAS and ISA 2004 same box?

Yes. ISA uses RRAS and the "engine" for the VPN abilities and I believe it
effects the SecureNAT Services of ISA.

> If possible. can we use RRAS NAT to configure multiple nat address and
configure ISA
> 2004 on same box is ok?

No, you cannot. And ISA is the "boss" over RRAS and RRAS should not be
configured separately from ISA. ISA configures RRAS "behind the scenes" for
its own purposes (particularly VPN stuff). Any independent configuring of
RRAS should only be done when you know exactly what you are doing with it,
and "why", and "how" it might adversly effect other things.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/IS...cessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/t...dance/2004.asp
http://www.microsoft.com/isaserver/t...dance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp
-----------------------------------------------------

Philip,
First of all Thank you very much for your kind advice.

Is it any way to configure Multiple NAT on ISA 2004 box or any other
Recommendations.

Thanks.



"Phillip Windell" wrote:

> "Mohan" <(E-Mail Removed)> wrote in message
> news:79B844E2-21E9-4458-8F74-(E-Mail Removed)...
> > we want to deploy ISA server in our organization. we have 5 static public
> ip
> > address to map to 5 private address its working fine with our current
> router
> > with firewall.
>
> That is a very bad thing to do in the first place. You might as well have
> hose 5 machines sitting "but naked" out on the Internet to begin with,...it
> is the same thing. Your firewall is doing absolutley nothing to protect
> you,...in fact, it is doing just the opposite,...it is exposing you.
>
> > But, in that firewall we cannot control internet access to
> > users and etc. so, we want's to deploy the isa server.
>
> Sounds good.
>
> >but, we understand in isa server cannot do mulitiple nat it can be
> one-to-one only.
>
> Correct,...ISA is primarily a "proxy" server not a NAT Server. NAT and
> proxying are two different technologies.
>
> > Can I install RRAS and ISA 2004 same box?
>
> Yes. ISA uses RRAS and the "engine" for the VPN abilities and I believe it
> effects the SecureNAT Services of ISA.
>
> > If possible. can we use RRAS NAT to configure multiple nat address and
> configure ISA
> > 2004 on same box is ok?
>
> No, you cannot. And ISA is the "boss" over RRAS and RRAS should not be
> configured separately from ISA. ISA configures RRAS "behind the scenes" for
> its own purposes (particularly VPN stuff). Any independent configuring of
> RRAS should only be done when you know exactly what you are doing with it,
> and "why", and "how" it might adversly effect other things.
>
> --
> Phillip Windell [MCP, MVP, CCNA]
> www.wandtv.com
> -----------------------------------------------------
> Understanding the ISA 2004 Access Rule Processing
> http://www.isaserver.org/articles/IS...cessRules.html
>
> Microsoft Internet Security & Acceleration Server: Guidance
> http://www.microsoft.com/isaserver/t...dance/2004.asp
> http://www.microsoft.com/isaserver/t...dance/2000.asp
>
> Microsoft Internet Security & Acceleration Server: Partners
> http://www.microsoft.com/isaserver/partners/default.asp
> -----------------------------------------------------
>
>
>
>

"Mohan" <(E-Mail Removed)> wrote in message
news:455D1689-DE95-44BB-9B63-(E-Mail Removed)...
> Philip,
> First of all Thank you very much for your kind advice.
>
> Is it any way to configure Multiple NAT on ISA 2004 box or any other
> Recommendations.

I don't know about RRAS alone. Absolutely not with ISA. I don't know of
any other things out there.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/IS...cessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/t...dance/2004.asp
http://www.microsoft.com/isaserver/t...dance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp
-----------------------------------------------------