Access remote VPN client via Site to Site VPN

1. Local Host Network - The network is defined by all boundary IP addresses for any interface on ISA.
2. The Default Internal Network - This is an ISA Firewall Network that you can define when the ISA Firewall is installed. Typically, it is the closest interface for the main network infrastructure services that the ISA Firewall depends on, such as Active Directory domain controller, DNS server, DHCP server, and certificate service.
3. The Default External Network - the Default External Network is defined with all IP addresses not included in the definition of any ISA Firewall Network . You never need to add IP addresses to the Default External Network because it is a self-defined network, including IP addresses that you don't group on any ISA Firewall Network.
4. VPN Clients Network - VPN Clients Network is an ISA Firewall Network that contains the IP address of the remote access VPN client and the VPN gateways connecting to the ISA Firewall. Definition This ISA Firewall Network is dynamic. Since the VPN client and gateway connect to the ISA Firewall, their VPN interface addresses are automatically added to define the VPN Clients Network, and are automatically deleted when the VPN client and gateway cancel the connection to the ISA Firewall.

1. Local Host Access - defines the Route relationship between Local Host Network and other networks.
2. VPN Clients to Internal - define the Route relationship between VPN Clients Network and Default Internal Network networks.
3. Internet Access - defines a NAT relationship for communications originating from the Internal Network to the Default External Network.

1. VPN Clients Network - This is the network ISA Firewall Network has all VPN clients and gateways when they connect to the ISA Firewall.
2. Main office default Internal Network - This is the network behind the main office ISA Firewall. Note that the network name (Network name) of the ISA Firewall is related to the location of the client connecting to this ISA Firewall Network. When the remote access VPN client connects to the branch office ISA Firewall, this will be a Default Internal Network for the members of the VPN Clients Network. However, if a host at the branch office is connected to this network, the network name will show that. We will consider an example of this later.
3. Branch Remote ISA Firewall Network - Remote Network networks are defined when you create site to site VPN connections. From the host side connecting from the main office ISA Firewall, the connections created with the branch office network will be connected to the Branch Remote Network. However, if a client is connected to the branch office ISA Firewall, what is the network the clients will connect to? That's the Default Internal Network because in the site to site VPN scenario, the name of the destination ISA Firewall Network is related to the ISA Firewall that the remote access VPN client connects to.

1. There is a Network Rule for connecting VPN Clients Network to the default Internal Network. This Network Rule establishes a route relationship between the main office's VPN and default Network clients.
2. A Network Rule for connecting the main office's Default Internal Network to the branch office ISA Firewall Network. This Network Rule establishes a Route relationship between these networks.

With this foundation, you can now show why some ISA Firewall administrators have had problems allowing remote access VPN clients to connect to the office ISA Firewall to access the resources. Branch office ISA Firewall Network: they need to create a Network Rule to connect the main office VPN Clients Network to the branch office ISA Firewall Network.

See page 4

In fact, one other thing to do is to create an Access Rule to allow communication from the main office VPN Clients Network to the branch office network. Although there is a Network Rule that connects networks, there is a need for an Access Rule that allows communication between these networks.

1. At the CSS machine, open the ISA Firewall console. In this window, click Arrays and click the Main array. Then click Configuration and Networks .
2. On the Networks node, click the Network Rules tab in the middle pane. In the Tasks tab on the Task Panel, click the Create a Network Rule link .
3. In the Welcome to the New Network Rule Wizard page , enter the rule name in the Network Rule name dialog box. In this example, we used the name VPN Clients to Branch and clicked Next .
4. On the Network Traffic Sources page, click the Add button. In the Add Network Entities dialog box, click the Networks folder, and then double-click the VPN Clients network. Click Close .

5. Click Next on the Network Traffic Sources page.
6. On the Network Traffic Destinations page, click the Add button. In the Add Network Entities dialog box, click the Networks folder, then click the Branch network. Click Close .

7. On the Network Relationship page, select the Route option. There is a problem here, from the security perspective of using NAT for this scenario, so we must always select the Route option. Click Next .

8. Click Finish on the Completing the New Network Rule Wizard page

1. At the CSS computer in the main office, in the ISA Firewall console, click Firewall Policy (main) in the left pane of the interface.
2. In the Tasks tab of the Task Pane, click the Create Access Rule link .
3. On the Welcome to the New Access Rule Wizard page , enter a name for the rule in the Access Rule name box. In this example, we use the name Ping VPN Clients to Branch and click Next .
4. In the Rule Action page, select the Allow option and click Next .
5. On the Protocols page, select the Selected protocols option from the This rule applies drop- down list . Click the Add button. In the Add Protocols box, click the Infrastructure folder, then double-click the PING protocol. Then click Close .

6. On the Access Rule Sources page, click the Add button. In the Add Network Entities box, click the Networks folder, then double-click the network. Click Close .

7. Click Next on the Access Rule Sources page .
8. On the Access Rule Destinations page, click the Add button. In the Add Network Entities box, click the Networks folder, then double-click the Branch network. Click Close .
9. On the User Sets page, accept the default settings, All Users , and click Next .
10. Click Finish in the Completing the New Access Rule Wizard page .
11. Click Apply to save the changes and update the firewall policy. Click OK in the Apply New Configuration dialog box.

1. At the CSS computer at the main office, in the ISA Firewall console, click the Firewall Policy button (branch) in the left pane of the console.
2. In the Tasks tab in the Task Pane, click the Create Access Rule link .
3. In the Welcome to the New Access Rule Wizard page , enter the rule name in the Access Rule name box. In this example we use the name Ping Main to Branch and click Next .
4. In the Rule Action page, select the Allow option and click Next .
5. On the Protocols page, select the Selected protocols option from the This rule applies to drop- down list . Click the Add button. In the Add Protocols dialog box, click the Infrastructure folder, and then double-click the PING protocol. Click Close .

6. On the Access Rule Sources page, click the Add button. In the Add Network Entities box, click the Networks folder, then double-click the Internal network. Click Close .
7. Click Next on the Access Rule Sources page.
8. On the Access Rule Destinations page, click the Add button. In the Add Network Entities dialog box, click the Networks folder, then click the Branch network. Click Close .
9. On the User Sets page, accept the default settings, All Users , and click Next .
10. Click Finish in the Completing the New Access Rule Wizard page .
11. Click Apply to save the changes and update the firewall policy. Click OK in the Apply New Configuration box.

1. At the main office CSS machine, click the Virtual Private Networking button (VPN) in the Main array tree.
2. In the Virtual Private Networking button (VPN) , click on Tasks tab on the Task Pane. Click the Enable VPN Client Access link .
3. Click OK in the dialog box informing you that the RRAS service can restart.
4. Click Apply to save the changes and update the firewall policy. Click OK in the Apply New Configuration dialog box.