We have a very standard setup with a Windows Server 2003 domain controller issuing IP addresses using DHCP. This works fine.
Internet access is managed via Microsoft ISA Server 2006 Standard. Clients are required to authenticate and this works fine.
We now need to provide wireless internet access to visitors for laptops, iPhones etc.
We've bought a couple of Netgear access points so I was thinking we might be able to issue wireless clients connected to it with an IP address on a different subnet and then allow non-authenticated Internet access via the ISA Server for that IP range.
Does that sound plausible? I'm not even sure if I can issue a different subnet to wireless clients.
Best Answer
You sure can do this. You'll need to put a few things together to do it.
Step 1 Connect and configure a new network segment to your ISA server for the wireless network. (you could use the DMZ but I don't recommend putting DHCP on your DMZ). Link it up to your Netgear AP's.
Step 2 Configure ISA server to allow DHCP Relay. See this article: http://technet.microsoft.com/en-us/library/cc302680.aspx
Step 3 Install Routing and Remote Access and configure DHCP Relay on the ISA server. See this article: http://www.computerperformance.co.uk/w2k3/services/DHCP_Relay_Agent.htm
Step 4 Create a DHCP scope corresponding to your new subnet. What's cool is that your DHCP server will automatically issue an address from the correct subnet because the DHCP Relay Agent tells it which subnet it needs an address from.
This is a fair amount of stuff that all has to work in concert. I recommend three areas to help troubleshoot: 1. Temporarily stop the ISA server service and get it to work that way first 2. Use ISA server monitoring logs 3. Use Microsoft Network Monitor (http://www.microsoft.com/en-us/download/details.aspx?id=4865) or Wireshark (http://www.wireshark.org/download.html). If you're not handy with a packet sniffer, this is the perfect time to start.