Two internet connections - One SBS

We have SBS acting as Exchange Server and Proxy Server as well as running
ISA 2004. The fixed IP address for Exchange Server is via a DSL line that is
near some DSL limit and is extremely slow, Although sufficient for email the
DSL is inadequate for some other purposes as the firm deales in fine art and
much of the web traffic involves large graphic files.

We also have a Comcast cable connection with excellent speed, but no fixed
IP addresses are available from Comcast, or at least not with our plan. Some
clients for some purposes, connect to the internet via this cable connection
bypassing the corporate firewall.

The SBS has two nics, one for internal and the other for external. Is there
a way to add a third NIC and a second internet connection?

A scheme that came to mind would be to move the gateway to the third NIC so
that all traffic other than incoming mail would be via Comcast cable. Would
this work? Is there a better solution?

Kal

Kal <(E-Mail Removed)> wrote:
> We have SBS acting as Exchange Server and Proxy Server as well as
> running ISA 2004. The fixed IP address for Exchange Server is via a
> DSL line that is near some DSL limit and is extremely slow, Although
> sufficient for email the DSL is inadequate for some other purposes as
> the firm deales in fine art and much of the web traffic involves
> large graphic files.
> We also have a Comcast cable connection with excellent speed, but no
> fixed IP addresses are available from Comcast, or at least not with
> our plan. Some clients for some purposes, connect to the internet via
> this cable connection bypassing the corporate firewall.
>
> The SBS has two nics, one for internal and the other for external. Is
> there a way to add a third NIC and a second internet connection?
>
> A scheme that came to mind would be to move the gateway to the third
> NIC so that all traffic other than incoming mail would be via Comcast
> cable. Would this work? Is there a better solution?
>
> Kal


No, don't add a third NIC. Two are quite bad enough. I'd suggest you get a
hardware appliance that can handle two WAN connections and do load
balancing/bandwidth aggregation. The Sonicwall line with EnhancedOS can do
this for you. AFAIK, you should still be able to use ISA - just connect the
public-facing NIC to the LAN side of the SonicWALL and it will have a
private IP address.

I suggest you post all SBS questions in microsoft.public.windows.server.sbs
as it does a lot of things its own way, and in general, answers are often
different when SBS is involved. It might also be time to go to a leased line
rather than DSL!

Thanks for your help.

What do you mean, "Two are quite bad enough."?

I hear loud and clear that you like hardware appliances, but do you know
that a third NIC will not work?

Kal

"Lanwench [MVP - Exchange]"
<(E-Mail Removed) hoo.com> wrote in message
news:(E-Mail Removed)...
> Kal <(E-Mail Removed)> wrote:
>> We have SBS acting as Exchange Server and Proxy Server as well as
>> running ISA 2004. The fixed IP address for Exchange Server is via a
>> DSL line that is near some DSL limit and is extremely slow, Although
>> sufficient for email the DSL is inadequate for some other purposes as
>> the firm deales in fine art and much of the web traffic involves
>> large graphic files.
>> We also have a Comcast cable connection with excellent speed, but no
>> fixed IP addresses are available from Comcast, or at least not with
>> our plan. Some clients for some purposes, connect to the internet via
>> this cable connection bypassing the corporate firewall.
>>
>> The SBS has two nics, one for internal and the other for external. Is
>> there a way to add a third NIC and a second internet connection?
>>
>> A scheme that came to mind would be to move the gateway to the third
>> NIC so that all traffic other than incoming mail would be via Comcast
>> cable. Would this work? Is there a better solution?
>>
>> Kal
>
>
> No, don't add a third NIC. Two are quite bad enough. I'd suggest you get a
> hardware appliance that can handle two WAN connections and do load
> balancing/bandwidth aggregation. The Sonicwall line with EnhancedOS can do
> this for you. AFAIK, you should still be able to use ISA - just connect
> the public-facing NIC to the LAN side of the SonicWALL and it will have a
> private IP address.
>
> I suggest you post all SBS questions in
> microsoft.public.windows.server.sbs as it does a lot of things its own
> way, and in general, answers are often different when SBS is involved. It
> might also be time to go to a leased line rather than DSL!
>
>

Kal <(E-Mail Removed)> wrote:
> Thanks for your help.
>
> What do you mean, "Two are quite bad enough."?
>
> I hear loud and clear that you like hardware appliances,

Yep

but do you
> know that a third NIC will not work?

It's what others have always been (vehemently) advised when posting nearly
identical questions in the SBS group.
I personally think multihomed DCs are bad news in general. I don't use ISA
on SBS. Just my $.02.

>
> Kal
>
> "Lanwench [MVP - Exchange]"
> <(E-Mail Removed) hoo.com> wrote in
> message news:(E-Mail Removed)...
>> Kal <(E-Mail Removed)> wrote:
>>> We have SBS acting as Exchange Server and Proxy Server as well as
>>> running ISA 2004. The fixed IP address for Exchange Server is via a
>>> DSL line that is near some DSL limit and is extremely slow, Although
>>> sufficient for email the DSL is inadequate for some other purposes
>>> as the firm deales in fine art and much of the web traffic involves
>>> large graphic files.
>>> We also have a Comcast cable connection with excellent speed, but no
>>> fixed IP addresses are available from Comcast, or at least not with
>>> our plan. Some clients for some purposes, connect to the internet
>>> via this cable connection bypassing the corporate firewall.
>>>
>>> The SBS has two nics, one for internal and the other for external.
>>> Is there a way to add a third NIC and a second internet connection?
>>>
>>> A scheme that came to mind would be to move the gateway to the third
>>> NIC so that all traffic other than incoming mail would be via
>>> Comcast cable. Would this work? Is there a better solution?
>>>
>>> Kal
>>
>>
>> No, don't add a third NIC. Two are quite bad enough. I'd suggest you
>> get a hardware appliance that can handle two WAN connections and do
>> load balancing/bandwidth aggregation. The Sonicwall line with
>> EnhancedOS can do this for you. AFAIK, you should still be able to
>> use ISA - just connect the public-facing NIC to the LAN side of the
>> SonicWALL and it will have a private IP address.
>>
>> I suggest you post all SBS questions in
>> microsoft.public.windows.server.sbs as it does a lot of things its
>> own way, and in general, answers are often different when SBS is
>> involved. It might also be time to go to a leased line rather than
>> DSL!

"Kal" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Thanks for your help.
>
> What do you mean, "Two are quite bad enough."?

DC are not supposed to be multi-homed.
SBS is an exception ans the Installation "Wizards" over come the issue swhen
SBS is install,...but don't "push your luck" by adding a third.

If you did what you are asking the Exchange would receive on the Nic as you
expect but any aknowledgements or replies, or just simply outbound mail
would go over the other link which isn't even the same ISP. That could
cause communication problems and will very likely drive other peopls SPAM
Filtering system "wacko" and they may not accept mail from you to them.

The correct way to merge WAN links is to get them from the same ISP and
bring them onto the same Hardware Device that is designed for that purpose.

--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/IS...cessRules.html

Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/downlo...7/ts_rules.doc

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp

Microsoft ISA Server Partners: Partner Hardware Solutions
http://www.microsoft.com/forefront/e...epartners.mspx
-----------------------------------------------------

"Lanwench [MVP - Exchange]"
<(E-Mail Removed) hoo.com> wrote in message
news:%23UD%(E-Mail Removed)...

> I don't use ISA on SBS. Just my $.02.

Well, let's not get too carried away. :-)

If he doesn't have SBS Premium then he would not have it anyway I guess.

--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/IS...cessRules.html

Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/downlo...7/ts_rules.doc

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp

Microsoft ISA Server Partners: Partner Hardware Solutions
http://www.microsoft.com/forefront/e...epartners.mspx
-----------------------------------------------------

Phillip Windell <(E-Mail Removed)> wrote:
> "Lanwench [MVP - Exchange]"
> <(E-Mail Removed) hoo.com> wrote in
> message news:%23UD%(E-Mail Removed)...
>
>> I don't use ISA on SBS. Just my $.02.
>
> Well, let's not get too carried away. :-)

What, is that too much money? :-)
>
> If he doesn't have SBS Premium then he would not have it anyway I
> guess.

He does have Premium ....but when I get that for people it's only because
they need SQL.

"Lanwench [MVP - Exchange]"
<(E-Mail Removed) hoo.com> wrote in message
news:OuKx%(E-Mail Removed)...
> Phillip Windell <(E-Mail Removed)> wrote:
>> "Lanwench [MVP - Exchange]"
>> <(E-Mail Removed) hoo.com> wrote in
>> message news:%23UD%(E-Mail Removed)...
>>
>>> I don't use ISA on SBS. Just my $.02.
>>
>> Well, let's not get too carried away. :-)
>
> What, is that too much money? :-)

Hmm... {:-|

>> If he doesn't have SBS Premium then he would not have it anyway I
>> guess.
>
> He does have Premium ....but when I get that for people it's only because
> they need SQL.

ISA is rather comlicated for a place if they don't have someone there with
the skills to babysit it. In the ISA Groups there also seem to be people
out there with a very special gift to make a mess out of ISA too.

--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------

Phillip Windell <(E-Mail Removed)> wrote:
> "Lanwench [MVP - Exchange]"
> <(E-Mail Removed) hoo.com> wrote in
> message news:OuKx%(E-Mail Removed)...
>> Phillip Windell <(E-Mail Removed)> wrote:
>>> "Lanwench [MVP - Exchange]"
>>> <(E-Mail Removed) hoo.com> wrote in
>>> message news:%23UD%(E-Mail Removed)...
>>>
>>>> I don't use ISA on SBS. Just my $.02.
>>>
>>> Well, let's not get too carried away. :-)
>>
>> What, is that too much money? :-)
>
> Hmm... {:-|

<cough>

>
>>> If he doesn't have SBS Premium then he would not have it anyway I
>>> guess.
>>
>> He does have Premium ....but when I get that for people it's only
>> because they need SQL.
>
> ISA is rather comlicated for a place if they don't have someone there
> with the skills to babysit it. In the ISA Groups there also seem to
> be people out there with a very special gift to make a mess out of
> ISA too.

Agreed - but don't forget that SBS has wizards to do everything short of
cutting your steak & chewing it for you!

Hi,
1. great deal : a bypassed corporate firewall.
2. instead of leading the traffic via 3 or more nics in one PC/server you
should think over proffessional routing / switching solution.
-depends on what u have already
--anyhow there should be 2 modem / router at your wall (1 for DSL one for
"whatever is" Comcast)
have (do they?), if there are on board, their firewalls on
--have a router before these two (configurable for in and outgoing traffic)
/ combined with switching capabilities ? / or with firewall integrated

jk




jk