>> And what do internal clients have for the default
> gateway - the netscreen
>> or the SBS? My money would be on the netscreen.
>> But the SBS will not have a default gateway on the
> internal nic (quite
>> correctly). And I'm guessing the VPN IP is not
> 192.168.0.x but some other
>> internal range. You probably should add the VPN IP range
> to the SBS LAT. Or
> That's right - my LAN at home is 192.168.1.x. I have added this range to
> the SBS LAT already...
Your Home LAN IP range is not relevant, unless you're also using a
netscreen. If it's a VPN connectoid of some sort on a Windows machine, you
need to look at what IP range the netscreen is handing out for VPN sessions
(ipconfig /all while the VPN is up should tell you).
Is there a static route defined in SBS for the VPN IP range(s), telling the
SBS to pass those packets to the netscreen?
>> get rid of the netscreen entirely since SBS could handle
> the VPN for itself
> I have thought of this, but looking around the net I get the impression
> that Windows VPN could be quite troublesome to set up, or even reduce the
> reliability of the SBS server (I know one person who has to reboot his
> SBS regularly as it locks up totally sometimes as a result of something
> going wrong with the VPN).
> What do you think - would you trust SBS to handle VPN reliably
> considering what else runs on the box?
I use SBS VPN regularly without issue.
>> (or place the netscreen in front of SBS and have a DMZ).
> This is definitely an option, but I don't see how it would solve the
> problem as I'm still pinging the Internal interface...
You would either terminate the VPN in front of the SBS, and then have
particular access policies setup in ISA to allow inbound access from the
DMZ, or again SBS would be handling the VPN (PPTP only in this case).
One of my clients has this configuration of a hardware VPN firewall in
front of the SBS, and we use IPSec VPN to get to the DMZ (where there are
some webservers we manage) and then PPTP VPN is passed-through to SBS for
LAN access by the boss and myself.
Steve Foster [SBS MVP]
MVPs do not work for Microsoft. Please reply only to the newsgroups.