ISA server bridging networks

Vertigo · 15 Dec 2011 at 19:18

Ok got an insane problem here.

We have an ISA 2006 box acting as our Internet gateway. It has two network interfaces, one for the internal network and one for the external. The latter is connected to a Linksys router running Tomato and from there to the cable modem.

Some client machines connect directly to the router, either via cable or wireless, in order to access the Internet directly and are thus 'outside' the local network. Whilst an MS DHCP server services clients on the internal network, the DHCP server on the router assigns addresses to these clients which connect directly, obviously on a different subnet to the internal network

This has worked fine until today, when we've noticed that even the clients connecting directly to the router are being allocated internal network addresses by the internal DHCP server! What's more, they have complete access to other machines on the internal network, despite being connected to the internal one!

How on earth is this possible? The ISA server appears to be bridging the two interfaces and allowing all traffic through when this shouldn't be possible. Also, why are these clients preferring the internal DHCP server on the other side of the ISA box? If I disable the internal DHCP server then they do get a (correct) address from the router but if the internal DHCP server is active they always prefer that.

These clients shouldn't even be able to see the internal DHCP server, let alone everything else on the internal network. Nothing has changed recently as far as I'm aware

Any help appreciated as I'm at a total loss

Vertigo · 15 Dec 2011 at 19:37

Nope, no bridging enabled at all, that's what's bizarre - it's behaving as if the two networks were bridged.

Vertigo · 16 Dec 2011 at 08:34

Nope, the network isn't bridged - the only place the two networks meet is via the ISA server. I'm the only one who has access to this box and I've not changed a thing!

Vertigo · 17 Dec 2011 at 11:59

Ok done some more playing around. The fundamental problem appears to be that clients on the external network interface are obtaining an IP address from the internal DHCP server which they shouldn't be able to see!

I've tried disabling every single rule on the ISA server and disabling VPN completely to no avail, the server appears to be passing DHCP requests from the external interface to the internal one.

What on earth is going on!?

Vertigo · 17 Dec 2011 at 13:27

Solved! \o/

It wasn't the ISA server at all - it suddenly occurred to me that, if the networks were physically bridged somewhere, whilst IP traffic wouldn't be able to flow from one subnet to another without a router, DHCP broadcasts would.

Shutting down the ISA server completely proved this as external clients were still getting internal addresses.

Process of elimination found a switch which some moron had managed to connect to two floor points, one of which was uplinked to the internal network and one to the external.

Happy it's solved but livid that I've lost so much time, including several hours of my own this morning, sorting a problem due to someone else's stupidity.