ISA 2006 from Edge Firewall to 3-Leg Perimeter
What if you want to take your simple 2 NIC “Internal/External” firewall and add a DMZ to it on the fly? We recently tried this on a production firewall no less and hoped it would work. It did after a few bumps.
The big problem with changing your Network Template is that ISA wants' to slick your config and start over, so you’ll end up with two options: Try to make a 3 NIC config work in your original design by adding in networks and network rules, or applying a new network template and then bringing your config back in via import. After failing the former (likely my lack of skills), we chose the later.
Mileage may very, but here’s some notes on what we did:
- Obviously you need the 3rd NIC installed first.
- Add the Subnets to the new NIC’s IP config for your DMZ aka “Perimeter” network in Windows.
- Export your firewall config, including all settings, make a copy of the XML file, and open for editing.
- We’re going to remove the network section of the XML file to prevent issues later. Once you’ve chosen a new network template, you’ll want to import the config back in, minus the network related stuff (which is what the network template will change for you).
- Search the XML file for the open and closing NetConfig tags:
- <fpc4:NetConfig StorageName="NetConfig" StorageType="1">