Changing Subnet Addresses

[hughn]

Many of our remote users connect to our corporate network from Hotels, airports, and etc. through our ISA server running Routing and Remote Access. The problem is our private network uses IP subnet 192.168.1.XXX which is such
a standard now that many hotels, airline lounges, and hotspots are using the same. The remote users connect and authenticate fine but cannot reach any corporate resources such as Exchange server or internal websites.

The only solution I know is to change the local subnet addressing but I don’t know what the effect will be on DNS and Active Directory. There are approximately 50 nodes on the corporate network and I should also mention
that in addition to the corporate site I have 3 remote sites, all part of the same Domain and connected via VPN using Cisco PIX. They are different subnets.

I would appreciate any advice or suggestions as to how to approach this.

 

[dtrtel]

I feel your pain, hopefully any potential workaround isn't as bad (or worse) than renumbering corporate. As a former ISP network engineer, though, I've done lots of renumbering. You may have to announce a weekend maintenance period and just bite the bullet and be happier in the long run.

But, before going to such lengths, and this is a big wild-ass guess, you might try assigning the roaming users IP addresses from a different subnet, make it obscure like 172.19.23.X or whatever to try not to have to move them again later. Then assign IP host records in the new 172.x.x.x subnet for services on machines that roaming users need to access in your DNS server, including your DNS server. A big caveat however.....

This depends, of course, on the ability to add alias IP addresses on those "server" resource machines to listen on the new subnet addresses. Not certain if this will work for exchange, but IIS certainly will as well as just about any Unix/Linux application.

Keep in mind that the new subnet will be in a different IP broadcast domain so browsing will probably break. You should be able to circumvent that through configuring WINS, though.

HTH,
--jeff

http://linkedin.com/in/JeffLynch