Take the 2-minute tour ×

I currently have an ISA 2006 server connected to my company's internet connection.

At the moment there is only a single NIC in the ISA Server and all it is doing it publishing Outlook Web Access and acting as a web proxy. All our client machines have the internal IP of our ISP managed firewall as their gateway address as there is a VPN we need to route across.

To lighten the load on our VPN I would like to route web browsing across a separate ADSL connection whilst retaining the proxying of the ISA server.

Is this possible? Can anyone point me in the right direction with regard to the NIC configuration on ISA and the routing?

share|improve this question
I don't believe ISA is able to do policy based routing. –  Zoredache Dec 17 '10 at 2:06

1 Answer 1

up vote 0 down vote accepted

ISA Server can't do that. There used to be a product called RainWall or RainConnect by RainFinity that did this for ISA Server; there might be other alternatives out there, though I don't know of them offhand.

Forefront TMG 2010 supports a new feature called ISP Redundancy, which does some of this; it might be worth investigating.

Edit: ISA 2004/2006 can use different paths for Web destinations, using Web Chaining rules, though. In this case, you create a rule that tells ISA that for the following destinations (perhaps Anywhere, or if you have an Internal subnet defined, External or anywhere-but-your-internal-subnet-range), there's an upstream proxy available. Then you'd ensure that its route to the upstream proxy uses the DSL connection. It's a tab under Networks.

So, the VPN traffic would still flow to and from whatever network, and the web traffic would go via ADSL - but any non-Web traffic would be pushed via the Default Gateway, as per usual. this might cause interesting issues once in a while (for eg, with Java applets, or other things that use their own proxy configuration that isn't the ISA box), but they're normally easy enough to fix.

share|improve this answer
I've heard of something called a multi-homed ISA server but haven't had time to read up properly. Would this not serve my purposes? –  Danny Apr 3 '11 at 17:15
Multihoming is typically having membership in more than one network, usually by having multiple NICs. But now you've mentioned that... (edit) –  TristanK Apr 3 '11 at 21:31
Thanks for the follow-up. So I could have the current, single, NIC connected to the external connection that provides our VPN access and upon which we publish OWA etc. I could then have a second NIC connected to the (for arguments sake) ADSL connection and define this as the route (via an second ISA network object) for our firewall policies that allow web access and the like? –  Danny Apr 6 '11 at 20:37
I don't think you need a second NIC - Web Chaining should let you route traffic via the DSL connection, as long as you have an upstream proxy (for eg, an ISP proxy) available on the other side of it, which you can add a static route for. –  TristanK Apr 6 '11 at 22:43
So yes, what you said - it'll only affect web destinations, and only when there's an upstream proxy available. –  TristanK Apr 6 '11 at 22:47

Your Answer


