I don't know if it's me or the number of users we have on our network (~35), but web requests through ISA seem to crawl. I've got our network setup with 2 NICs and a Cisco 2821 as our actual edge device. Between the 2821 and the ISA server is a 192.168.1.x network and behind ISA is a 192.168.2.x network. My thoughts are to alter the Netmask for my admins to 255.255.252.0 which would make the .1.x and .2.x networks appear as a single network. From there I could leave DNS resolution with my SBS server, but change my gateway to the LAN ip of our actual edge router.

 

The network topolgy I described is largely logical as the SBS server's external nic is not plugged directly into the 2821, but into a switch. This is a function of additional equipment we have sitting on the .1.x network that we didn't want behind the ISA firewall.

 

Any downsides to trying this that I might not be thinking of? I'll still be able to route to the inside interface of the SBS server, but I'll merely be opening up the address range that my workstation can "natively" route to encompass our edge device.

The workaround would only be for the IT staff. That said, what kind of limits in terms of traffic have you seen tax ISA2k4? I've got rules setup that create wide open outbound pipes for the machine I am working on, yet I still notice that certain sites have CSS, images, or other content stripped or blocked before getting to my machine.

 

I've run the BPA for both ISA and SBS on this machine and corrected all small changes as directed. It's more of a nuisance than anything really as it's not actually impeding my daily work.

Hi Chris,

 

I don't quite understand your network setup. Can you please post an ipconfig/all from the server and a client?

 

Windows IP Configuration
   Host Name . . . . . . . . . . . . : TSSBSR2
   Primary Dns Suffix  . . . . . . . : ts.local
   Node Type . . . . . . . . . . . . : Unknown
   IP Routing Enabled. . . . . . . . : Yes
   WINS Proxy Enabled. . . . . . . . : Yes
   DNS Suffix Search List. . . . . . : ts.local

Ethernet adapter Server Local Area Connection:
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client)
   Physical Address. . . . . . . . . : 00-18-8B-31-4E-79
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 192.168.2.2
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . : 192.168.2.2
   Primary WINS Server . . . . . . . : 192.168.2.2

Ethernet adapter Network Connection:
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client) #2
   Physical Address. . . . . . . . . : 00-18-8B-31-4E-7B
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 192.168.1.10
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.253
   DNS Servers . . . . . . . . . . . : 192.168.2.2
   NetBIOS over Tcpip. . . . . . . . : Disabled

 

Windows IP Configuration
   Host Name . . . . . . . . . . . . : Hp-xw4300-3
   Primary Dns Suffix  . . . . . . . : ts.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : ts.local

Ethernet adapter Local Area Connection:
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
   Physical Address. . . . . . . . . : 00-15-60-A2-14-49
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::a021:b057:c1c1:c044%7(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.2.10(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.2.2
   DNS Servers . . . . . . . . . . . : 192.168.2.2
                                       66.118.0.20

Hi Chris,

 

Unfortunately you have the dreaded Broadcom nics in the server. Please disable all advanced features on them regarding checksum, offload and Receive Side Scaling. Run the SBS BPA tool.

On the client remove the TCP/IP6 protocol and set it to obtain an IP from DHCP. It is having the wrong information now.