ISA Server 2004 firewall clients that use IPSec in the internal network cannot access external networks

View products that this article applies to.

Symptoms

If the following conditions are true, computers that use the Microsoft Internet Security and Acceleration (ISA) Server 2004 firewall client on an internal network cannot access the external network:

You are using IPSec to encrypt data in the internal network.
You are using Network Address Translation (NAT) on the ISA Server 2004-based server so internal clients can connect to an external network.

↑ Back to the top

Workaround

To work around this behavior, turn off IP routing on the ISA Server 2004-based server. To do this, follow these steps:

Click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
In the ISA Server 2004 Management console, expand ISA Server 2004-based server.
Expand Configuration, and then click General.
In the right pane of the ISA Server 2004 Management console, click Define IP Preferences under Additional Security Policy.
In the IP Preferences box, click the IP Routing tab.
Click to clear the Enable IP routing check box, and then click OK.