Recommended Network Card Configuration for Forefront UAG Servers

A high-level overview of NIC configuration best practice is provided below:

• The network card name used within the operating system should (ideally) be changed to closely match the associated Windows server network name. This clarifies assignment and improves supportability.
• Only one network interface should be configured with a default gateway.
• Only one network interface should be defined with DNS servers.
• Unused or unnecessary bindings should be removed from all interfaces, where possible, to improve security. This is often termed ‘interface hardening’.
• The default bind order should be amended to define a specific customized order.

Based upon these best practices, the configuration shown below is the standard approach as a part of Forefront UAG server build process.

10Gigabit Ethernet PCI Express 2.0 Server Adapters Card

Rename NICs:

Rename all NICs to descriptive names that ideally match the connection type and UAG wizard/console names.

UAG interface connected to the trusted network becomes: Internal Network

UAG interface connected to the untrusted network becomes: External Network

Please Note: Matching the names is not essential; it just makes mapping networks between UAG, TMG and Windows much easier when troubleshooting…

You should then have something like this:

Network Connections

Configure NICs:

The Internal Network NIC will normally be connected to your trusted environment. This could be your actual internal network (LAN) or could be a private DMZ (perimeter network) if using a back firewall.

Default Gateway should not be defined

DNS Servers should be defined

Register this connection’s address in DNS – Enabled

File and Printer Sharing for Microsoft Networks – Enabled

Client for Microsoft Networks – Enabled

NetBIOS over TCP/IP – Default or Enabled

A more detailed view of these settings is provided in the following example screenshots.

Networking items enabled for the Internal Network NIC:

Internal Networks Properties

Please Note: The above examples are for a non-NLB enabled system. If NLB is enabled within UAG, the ‘Network Load Balancing (NLB)’ items would be shown as selected in the NIC properties and should not be disabled.

General properties of the External Network NIC

Advanced properties of the External Network NIC

Amend Bind Order:

Edit the bind order (Alt|Advanced|Advanced settings…) to place the Internal Network above the External network as shown below (note bindings too):

Advanced settings

UAG Configuration:

When running the UAG Network Interfaces wizard, you should now see the following:

Define Network Adapters

By taking a peek in the TMG console, you should see that these settings are consequently inherited as follows:

Internal Properties

You should now have correctly configured network interfaces for Forefront UAG!

Important! As you have configured the default gateway on the External Network NIC, it is necessary to add static routes to define internal network subnets that are reached via the Internal Network NIC but located behind routers (including VLANs on layer 3 switches) on the internal network. The use of multiple default gateways is not supported and static routes are the recommended solution.

Once you have defined the appropriate static routes, you will then need to run the UAG Network Interfaces wizard to add the new subnets (called address ranges) to the internal network definition; this will consequently be inherited by TMG and allow correct traffic flow…

Hope this helps…

By the way, Sopto supplies high quality PCI Express Cards with reasonable price specifically for network servers. For the newest quotes, please contact a Sopto representative by calling 86-755-36946668, or by sending an email to info@sopto.com. For more info, please browse our website.