SBS 2k3 with ISA 2004 installation on Dell PE 2850

the setup I had up to quite recently is the following:

1 WAN interface

2 LAN interfaces - server had an additional Broadcom NIC

Configured as: LAN1 and BackupLAN

I use the BackupLAN for creating backups and copying large backup files during day time, so the LAN1 doesn't get clocked up with it.

It was all working fine - at last i did not have any noticeable problems

Now I took out the additional Broadcom NIC and replaced it with a new Intel Dual Port NIC to create this additional service network.

To explain: we start a new project and for this we will be supplied with a firewall which will provide us with a VPN link to use some project related services / servers which are not located at any of our sites!

My idea now was to have this firewall setup in a service network segment on my ISA Server to not place / link this firewall directly to my network and only allow required connections / protocols.

All is setup as shown on the diagram.

I have setup persistent routes on the SBS2k3 for the 2 new networks and pinging these new networks seems to be working (tested by pinging the IP address assigned to the individual network card for each network on the ISA from different clients in the 166.0 network)

Persistent Routes:

  Network Address          Netmask  Gateway Address  Metric

    192.168.188.0    255.255.255.0    192.168.166.2       1

    192.168.155.0    255.255.255.0    192.168.166.2       1

The problem I stated to see now yesterday is that DHCP requests from internal clients were not answered - they were not bale to pickup IP address.

Assigning them a static IP worked!

After further investigations and testing, I also noticed that Remote Access stopped working. I noticed that the BackupLAN adapter is assigned to be used for broadcast name resolution to obtain DHCP,DNS and WINS, not the internal LAN.

Changing it to the internal LAN did not fix it and restarting the remote access service defaulted back to the BackupLAN adapter.

Where is it going wrong? Is a setup like i need / had I n mind not possible.

Recommendations and tips really appreciated. Tnx a mill in advance

Regards

Andre

Client ipconfig & ping service network:

Ethernet adapter VMware Network Adapter VMnet8:

        Connection-specific DNS Suffix  . :

        IP Address. . . . . . . . . . . . : 192.168.220.1

        Subnet Mask . . . . . . . . . . . : 255.255.255.0

        Default Gateway . . . . . . . . . :

Ethernet adapter VMware Network Adapter VMnet1:

        Connection-specific DNS Suffix  . :

        IP Address. . . . . . . . . . . . : 192.168.213.1

        Subnet Mask . . . . . . . . . . . : 255.255.255.0

        Default Gateway . . . . . . . . . :

Ethernet adapter Wireless Network Connection:

        laceName w:st="on">MedialaceName> laceType w:st="on">StatelaceType> . . . . . . . . . . . : Media disconnected

Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . : gmcdublin.local

        IP Address. . . . . . . . . . . . : 192.168.166.107

        Subnet Mask . . . . . . . . . . . : 255.255.255.0

        Default Gateway . . . . . . . . . : 192.168.166.2

C:\Documents and Settings\andre>ping 192.168.155.2

Pinging 192.168.155.2 with 32 bytes of data:

Reply from 192.168.155.2: bytes=32 time<1ms TTL=128

Reply from 192.168.155.2: bytes=32 time<1ms TTL=128

Reply from 192.168.155.2: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.155.2:

    Packets: Sent = 3, Received = 3, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 0ms, Maximum = 0ms, Average = 0ms

Server ipconfig:

Windows IP Configuration

PPP adapter RAS Server (Dial In) Interface:

   Connection-specific DNS Suffix  . :

   IP Address. . . . . . . . . . . . : 192.168.166.124

   Subnet Mask . . . . . . . . . . . : 255.255.255.255

   Default Gateway . . . . . . . . . :

Ethernet adapter External:

   Connection-specific DNS Suffix  . :

   IP Address. . . . . . . . . . . . :  PublicIP

   Subnet Mask . . . . . . . . . . . : 255.255.255.0

   Default Gateway . . . . . . . . . : 83.147.186.1

Ethernet adapter Internal:

   Connection-specific DNS Suffix  . :

   IP Address. . . . . . . . . . . . : 192.168.166.2

   Subnet Mask . . . . . . . . . . . : 255.255.255.0

   Default Gateway . . . . . . . . . :

Ethernet adapter BGE:

   Connection-specific DNS Suffix  . :

   IP Address. . . . . . . . . . . . : 192.168.155.2

   Subnet Mask . . . . . . . . . . . : 255.255.255.0

   Default Gateway . . . . . . . . . : 

the problems disappear if I disable the BackupLAN NIC in the ISA server.

The only difference I can think of between the BGE and BackupLAN NIC is that the new BGE Network is declared as a perimeter network when setting it up in ISA.

So if I enable the BackupLAN interface the following happens:

The BackupLAN adapter is assigned to be used for broadcast name resolution to obtain DHCP,DNS and WINS for remote access, not the internal LAN.

If I manually change it over to the internal lan NIC VPN Client sometimes can dial in but get a 169.something ip address assigned - so one that does not belong to my actual internal network.

Regards

Andre