How to Set Up a DMZ with ISA Server

To set up a back-to-back DMZ that uses ISA Server for the two firewalls, you need to obtain two servers, two copies of Win2K, two copies of ISA Server, four NICs (two for each server), and a switch or hub for the DMZ. First, create the outer firewall by installing and updating Win2K and ISA Server on one server. In the Control Panel Network Connection applet, configure the Internet NIC on the outer firewall with all the IP addresses that your ISP provides. Select a private IP subnet such as 10.10.*.* for all the public servers in the DMZ. For example, assign 10.10.0.1 to the DMZ NIC on the outer firewall, 10.10.0.2 to the Web server, and 10.10.0.3 to the SMTP gateway. Assign this subnet (10.10.*.*) as the outer firewall's LAT. Configure computers in the DMZ to use the outer firewall as the default gateway.

Next, create the inner firewall by installing and updating Win2K and ISA Server on the second server. Assign 10.10.0.4 to the DMZ NIC on the inner firewall, and configure that NIC to use the outer firewall as its default gateway. Select a private IP subnet such as 10.20.*.* for the internal network. Assign the address 10.20.0.1 to the internal network NIC on the inner firewall. Configure internal computers to use the inner firewall as their default gateway. Configure the inner firewall's LAT with the IP address of the internal network (10.20.*.*), which is a separate network from the 10.10.*.* network of the DMZ. . . .