RE: Site to Site VPN Spoofing packets
- From: Nathan Storms <NathanStorms@xxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Wed, 4 Feb 2009 07:51:02 -0800
Your traffic is being marked as spoofed for the following reason:
When a client at a remote site requests services published at the main
office it is leaving through the ISA server at the remote site which performs
a NAT operation to the internet and will rewrite the source IP address as
that of the external IP address of your ISA server in your remote site. Once
your ISA server in your main office receives this traffic with a source IP
address of the external IP address of the ISA server in the remote site it
compares it against the networks it already knows about. In this case it
locates the external IP address of the remote ISA server as part of the IPSec
site-to-site vpn network, as because it received traffic on a network that
belongs to another network it will mark that traffic as spoofed. This is a
normal security feature in ISA server.
But, there are some workarounds:
You could use PPTP instead of IPSec, but I won’t recommend that due to
security.
You can however perform the following change to your site-to-site
connection; in your main office ISA server go to the properties of your
site-to-site VPN select the ‘Addresses’ tab and remove the IP address range
that includes the remote end point (external) address range of your remote
ISA server. Proceed to the ‘Connection’ tab and select the button labelled
‘IPsec Settings…’ this will open up the IPsec Configuration window, now
select the ‘Phase II’ window and uncheck ‘Use Perfect Forward Security’. You
will also need to uncheck the ‘Use Perfect Forward Security’ option in the
site-to-site vpn properties on the ISA server in the remote site.
Results:
This operation has some side effects, your ISA servers won’t be able to
directly talk to each other when the VPN is up. Your ISA servers won’t be
able to talk to the remote client network in each site. This will work with
integrated NLB in the main office, but not in a remote site. That being said
your remote client network will be able to communicate to each other and to
the external IP addresses of the ISA server in the main office.
.
- Next by Date: RE: How to configure IPSEC VPN ISA server 2006 Enterprise
- Next by thread: RE: How to configure IPSEC VPN ISA server 2006 Enterprise
- Index(es):
Relevant Pages
|
