Syed Jahanzaib – Personal Blog to Share Knowledge !

March 21, 2012

TMG 2010 ISP Redundancy Fail Over Guide

Scenario: I have 2 WAN Internet Connections, and I want that if primary link fails (or looses its connectivity with the ISP/internet) TMG should automatically switch over to secondary link, and when primary link gets back online, TMG should switch back to Primary Link.

But first let’s discuss some theoretical introduction of TMG new feature called ISP Redundancy

Forefront TMG 2010 is the latest proxy/firewall server from Microsoft. It have many new exciting features which makes it very good , reliable and rich feature application.

One of the greatest (and most demanding) new features of Microsoft Forefront TMG is ISP Redundancy. With the help of this feature it is now possible to load balance the network traffic between two different ISPs . One other configuration mode is the ability to configure Microsoft Forefront TMG for ISP Failover (Which is discussed later in this article). In this case, Forefront TMG will use one ISP link as the primary connection, and if this link gets broken, TMG will automatically failover to the second configured ISP.

ISP redundancy feature utilizes multiple ISP links and provide high-availability with load balancing and failover or just failover capability to the corporate Internet. The common functionality of ISP redundancy are:

  •     Designate primary and secondary link for internet connections
  •     Balance traffic load based on percentage of total traffic per link
  •     Automatic fail over to secondary link if primary link fails

Ok Let’s Start 🙂


1) Two Separate WAN connections connected with TMG , both should be fully configured with there respective IP , gateway and DNS.

2) Static Route defined via ip route command for ISP’s DNS Server (Or any other WAN IP, to let TMG decide if the specific link unable to reach isp dns or any other wan ip defined)

In this example , we have 3 Interfaces card in TMG as following

LAN = Connected with Users Switch
WAN1 = PTCL DSL Link (Primary)
WAN2 = FIBER Optics Backup Link (Secondary)

(As shown in the image below . . .)

Open TMG console,
Goto Networking  >> ISP Redundancy
and click on Configure ISP Redundancy

(As shown in the image below . . .)

In the below example, I am using FAILOVER only mode, (But you can select Load balancing with failover capability, you can also change the mode later)

Now type the ISP1 name and select the Network adapter (After selecting the network adapter , Subnet field will auto fill up )

In next screen, it will show you the ISP1 ip scheming info like gateway , subnet , dns etc

Now type the ISP2 name and select the Network adapter (After selecting the network adapter , Subnet field will auto fill up )

In next screen, it will show you the ISP1 ip scheming info like gateway , subnet , dns etc

Now it will ask you which ISP link will act as PRIMARY ISP Connection, select your desired link

All done, It will show the final config on your screen, just select FINISH.

Now the Important Part. We Must add static route to tell TMG via route that if specific WAN link looses its connectivity , it should switch over to secondary link.

First you have to see what network interface have which code, this code will be used in route command to tell which interface rule would be applied.

open command prompt on TMG, and type

Now Open Network Connections , and take properties of your First ISP Interface Adapter. and you will see the interface name, like below

Now check in the route PRINT command and find the number of your first isp interface card number which name is “Microsoft Virtual Machine Bus Network Adapter #2” which in this example is 12 (it is showed in starting)

Repeat the above step and find the number of secondary ISP link, which in this example is 29

Now issue following command To add a persistent static route

route -p ADD MASK METRIC 1 IF 12
route -p ADD MASK METRIC 2 IF 29

the above command will tell TMG to go through Specific link for DNS Server status, so if primary link looses it connectivity with the internet(connectivity with the via ISP1, ) it will switch over to ISP2 , it will periodically check primary link connectivity, as soon it restores, it will switch back to primary link.

ROUTE Command Syntax

route [-p] ADD [destination] MASK [netmask] [gateway] METRIC [metric] IF [interface]

  • P—-Makes the route persistent
  • METRIC---specifies the priority for this route. the route with the lowest metric has the highest priority.
  • IF---Specifies the interface number


Howto Bind User/dst website to Go through Specific Link Only in TMG

If you want to bind specific user or group to go through specific link only,use the following logic

# First create user/ip/ip range entry in FIREWALL POLICY > TOOL BOX / NETWORK OBJECTS  >> computer / computer sets or address range

# Then goto  NETWORKING / NETWORK RULES and create new NETWORK RULE with following data

Network Name Rule : WAN2 Users
FROM: Your Specific Computer IP / User / IP Range
TO : External
Network Relationship : Network Address Translator (NAT)
NAT Address Selection : Use the Specified IP and then select your desired WAN link ip

Note: As shown in the images below

Now hit APPLY button to make changes.

To test, Goto your client, and open
It will show you new ip of secondary link. 😀

BEFORE NETWORK RULE:  User request is routing through Default First WAN link (PTCL).

AFTER NETWORK RULE:  User request is now routing through second WAN link (FIBER).

Some Considerations and Info

To determine the availability of a particular ISP connection, TMG performs dead link detection by randomly polling one of the thirteen Internet root DNS servers on TCP port 53 (when TMG is deployed as a back firewall, make certain that TCP port 53 is open to the Internet). If the selected root DNS server responds, TMG considers the connection available. If it does not respond, TMG will poll additional root DNS servers at one minute intervals. If no replies are received after three consecutive attempts, TMG considers the connection unavailable and raises an alert. Once TMG identifies a connection as unavailable, it will wait for five minutes before attempting to poll again. Once it receives a response, TMG will continue polling at one minute intervals. When three consecutive responses have been received, TMG will consider the connection available.

In the default setting, TMG checks the status of the ISP link by trying to establish a TCP connection on port 53 (DNS zone transfer) to a list* of root DNS server on a round robin basis. If a connection can be established, TMG will consider the link active.

* Default destination addresses in TMG RC:,,,,,,,,,,,,

TMG will wait at least 3 minutes until a link is considered down

  •  A link will be considered down for at least 7 minutes (min failed time with 300 seconds + 2x OK interval with 60 seconds each)
  • A link has to be stable for at least 3 minutes once TMG will bring the link up again.

You can modify those default values by using VBS Script (mentioned in the below links)

Script to reduce link detection time:

set root=CreateObject("FPC.Root")
set arr=root.GetContainingArray()
set ExtNet=arr.NetworkConfiguration.Networks("External")
set ISPRCfg=ExtNet.ISPRedundancyConfig
ISPRCfg.MinimalResumeTime = 30
ISPRCfg.TestIntervalLinkAvailable = 30
ISPRCfg.TestIntervalLinkUnavailable = 30
ISPRCfg.FailuresToUnavailable = 1
ISPRCfg.SuccessesToAvailable = 1


I took help from following websites for this article , I copied some text from following websites for general information. You can find Some Good Reference for more detailed and step by step guides.


Syed Jahanzaib


  1. Jahanzaib bhai very nice sharing !!!! is it possible with Isa or not ?


    Comment by faizan — March 22, 2012 @ 2:25 AM

  2. Thanks brother . I have VOIP system , if i do load balancing , with the configuration above how should i configure the voip phones , my question will it be still same network. I have bandwith issue , and clogs up the phone system , I currently have T1 system if i add cable for better result how should i configure , just design perspective thanks


    Comment by Muharrem Aker — March 22, 2012 @ 8:28 AM

    • If you do load balancing, i guess it will break up few sessions.
      try to bind users with specific link. this way there gateway will remain same for every request. use grouping.


      Comment by Syed Jahanzaib / Pinochio~:) — March 22, 2012 @ 8:43 AM

  3. Thanks Seyed Jahanzaib
    its perfect.
    i think your netmask For Route must be


    Comment by Majid — May 13, 2012 @ 2:11 PM

  4. This is simply GREAT!
    Thanks, really, for this article.
    I have been struggling around for a while and I simply could NOT find any tutorial for the LAST part of the config (routes and all).
    Since I’m new to this kind of configuration, my personal server was left with a partial config for more than a year and just not it’s done and 100% working.
    Thanks thanks thanks!!!


    Comment by Anderson Luiz Mendes Matos — June 12, 2012 @ 7:50 AM

  5. Dear Sir,
    I’ve configured TMG as an Edge Firewall and after configuring I’m unable to access Internet.
    Following are the configurations I made:
    Internal Network Adapter Settings:
    Subnet Mask:
    Gateway : None
    DNS: is my Domain Controller where I’m also using DHCP.

    External Network Adapter Settings:
    Subnet Mask:
    DNS: None

    After installation, I added Allow Access rule in Firewal Policy to allow DNS from Internal to External but still I’m unable to access Internet.
    Also I can’t ping to Router’s IP ( from my Internal Network PC’s.
    Please can you guide me step by step that how can I configure it properly so I can use Internet from Internal Network.
    Where I’m doing mistake.
    Waiting for your kind help. Please can you give your cell# or email so that I can communicate on this.
    I’ll be very thankful.


    Comment by Abid Ghaffar — July 18, 2012 @ 9:47 AM

    • i also face same problem…is there any solution?


      Comment by tamerat — October 9, 2015 @ 8:46 PM

      • Try to give DNS ip address (DNS IP not your domain, provide dns given you from your ISP) in your external card setting, hope it will work.


        Comment by moid — April 4, 2018 @ 11:10 AM

    • Try to give DNS ip address (DNS IP not your domain, provide dns given you from your ISP) in your external card setting, hope it will work.


      Comment by moid — April 4, 2018 @ 11:13 AM

  6. Good work!


    Comment by Ahmad — August 6, 2012 @ 1:01 PM

  7. Dear Sir ,
    Very nice Sharing Can You please Share TMG Full Config
    Thanks ,


    Comment by ALi — December 21, 2012 @ 12:08 PM

  8. Thanks jahanzaib bro.its very helpful for me……your method is so simple and easy,directly to the point ..thanks.thanks,thanks…i hope u will share more experience in future,like this.. .


    Comment by Umer Azeem — January 4, 2013 @ 12:40 AM

  9. Can you please tell me TMG internal Nic(connected with private LAN) and external NiC (connected with internet) Tcp/ip configuration ???
    ( if we do not use 3rd adapter for redundancy.i mean TMG server have only two network adapters)

    and other question is that it is better if we do not join TMG server machine to domain?


    Comment by Muhammad Omer — January 4, 2013 @ 12:51 AM

    • # IP address configuration is different for every network.
      Just for example:

      TMG LAN interface connected with internal LAN =
      TMG WAN interface connected with internet DSL =

      You must have at least 2 interfaces for proper firewalling/NATTING , its not necessary to have 3rd interface.

      # To join TMG with domain or not, its depend on your local network scenario and requirements. Its always better to join TMG with the DOMAIN to enjoy full user base authentication. if there is no domain, then you have to secure everything based on ip addresses, which sometimes creates overhead management.


      Comment by Syed Jahanzaib / Pinochio~:) — January 4, 2013 @ 9:12 AM

      • whats about Default gateway and DNS ip address configuration on both TMG adapters???in this case :

        TMG LAN interface connected with internal LAN =
        TMG WAN interface connected with internet DSL =


        Comment by Muhammad Omer — January 5, 2013 @ 9:18 PM

  10. Does DNS addresses assign on TMG External adapter???
    if yes then dns address is of ISP or Ptcl Dsl router(Which act as DNS)?


    Comment by Muhammad Omer — January 5, 2013 @ 9:25 PM

  11. Dear Sir,

    can we have two internal default gateway and two external default gateway and network load balancing /failover done in between them. like external isp1 DG( and ISP2( and our local LAN DG( and another local LAN DG( with FOUR NIC card intalled in the server two for isp and two for local LAN.

    Sytem Admin


    Comment by sid — January 10, 2013 @ 1:48 PM

  12. I am hoping you may be able to help me here.

    I have a client that is running a single TMG server. Two internet connections Via the same router. The router has the WAN IP address of both connections. I then have routed subnets applied to the router. This is how the TMG server is accessing the router.

    When i have an outbound NAT address of an edge server in the DMZ set to use one of the routed addresses. Im using a 90/10 split. The Routed addesses im using are on the 10 connection.

    When runing a tracert i see it coming from the correct addresses, but then ends up changing to the other internet connection so cant route back.

    Any help here would be great!


    Comment by alan — January 24, 2013 @ 4:25 AM

    • Add your required target Server in a Detination set, then in route, Bind this set with any specific WAN you want. This way it will go via same WAN link every time.
      in short Mark & Route.


      Comment by Syed Jahanzaib / Pinochio~:) — January 24, 2013 @ 8:45 AM

      • i think you mean make a network rule.

        NAT-name NAT Source network (computer listed as IP address) Destination-External NAT address x.x.x.29

        The server has 3x NAT rules (Lync Edge server) but it keeps trying to route Via to wrong network. But it may be in the routers rather than in TMG, as the router is controlling both internet connections with a routed subnet that the TMG is using.


        Comment by alan — January 24, 2013 @ 8:51 AM

  13. Sir !
    i am new in TMG !
    kindly let me know ………..
    What is TMG Client software? Why it is need to install on Client computers ? purpose of TMG Client software ?
    is it essential?


    Comment by M.U.A — February 21, 2013 @ 10:48 AM

    • TMG Client software:
      1) if you install this software to client system then you do not need to configure proxy setting in client system just need to provide ip what you set down in your TMG server.
      2) Client system will by pass all TMG rules in TMG server when users use internet via TMG client software


      Comment by moid — April 4, 2018 @ 10:56 AM

  14. very nice


    Comment by kiyanoosh — May 21, 2013 @ 12:43 PM

  15. i am using load balancing with failover capability can you pls help me to improve my configuration pls make article for that
    i am facing one problem with that i have 2 wan link with 20MB when i configure the load balancing with failover capability after few minute one of my wan link going down so pls help me


    Comment by jaleel — August 5, 2013 @ 11:03 PM

  16. Excellent article, thank you.
    I use UISP-R for some time.
    But I’ve encountered strange problem when combining ISP-R together with Exchange services publishing to internet using one of providers.
    Are there any recommendations regarding such combination?


    Comment by Martin Zakovic — November 7, 2013 @ 4:03 PM

  17. TMG ISP redundancy problem. I can not use websites which I public on ISP1 IP from internal clients if the redundancy is enabled


    Comment by Eldost — February 7, 2014 @ 3:53 AM

  18. can you help please!
    i have configured ISP redundancy same as the way you told in your article, currently internet is coming thru my Backup link not the primary.. infront of primary NIC “no internet access” is written in my TMG network connections page.


    Comment by Muhammad Asim Badar — October 4, 2014 @ 5:33 PM

  19. Dear All Please Help me .

    Tmg Web Access Problem from Local User .

    my tmg server is working fine last 2 days .but today is internet browsing issue local user.


    Comment by Sher ali — May 19, 2015 @ 11:37 AM

  20. Dear Syed Jahanzaib,

    Using your article, I have configured ISP redundancy (for Failover only) with two ISPs.I’m confused about DNS resolution, here are my configurations:

    TMG’s Internal interface is set to internal primary and secondary DNS(AD) servers and both ISPs External interfaces are without DNS entered, empty! Metric 1 is on primary ISP interface and Metric 2 is on secondary ISP interface.

    I have set OpenDNS servers ( & as forwarders on Internal DNS servers for public name resolution. And these DNS/AD servers are also behind this TMG (as secureNAT client). I am not using any of ISPs DNS because using opendns for web filtering also.

    Now my question is, do I also need to add static persistent route for DNS ips on TMG server when TMG’s only internal interface is configured to use internal DNS?. Or should i add static route for DNS? if yes then can i add route using opendns ip or it should be ISP dns only?

    Please guide.



    Comment by MStechpro — December 18, 2015 @ 1:41 PM

    • TMG should use local AD dns to resolve hosts (AD DNS must have forwarder configured to resolve external hosts)
      in this example i used two foreign DNS server ip addresses, they are used to check the status of each link.
      you can use any internet host to check the links.


      Comment by Syed Jahanzaib / Pinochio~:) — December 21, 2015 @ 7:30 PM

  21. Asslamalailkoum jahanzaib kya ap mujhe bata sakte hai agar me 2 isp ki redundancy banao ek off hone pe dosri on hojaey gi itna pata hai mujhe iske ilawa kya meri donu isp ki speed increase hokar aaey gi please help me urgent matlab ke 2 mb ke 2 connection hai aur me ISP redundancy banao to kya meri speed 4 mb aaey gi


    Comment by Arslan — April 20, 2016 @ 12:27 AM

  22. About the Dead Link Detection Script, for me to check that I understood it well, I will assume that I put the (Default) behavior in the script, then, will it be like this:

    set root=CreateObject(“FPC.Root”)
    set arr=root.GetContainingArray()
    set ExtNet=arr.NetworkConfiguration.Networks(“External”)
    set ISPRCfg=ExtNet.ISPRedundancyConfig
    ISPRCfg.MinimalResumeTime = 300
    ISPRCfg.TestIntervalLinkAvailable = 60
    ISPRCfg.TestIntervalLinkUnavailable = 60
    ISPRCfg.FailuresToUnavailable = 3
    ISPRCfg.SuccessesToAvailable = 3



    Comment by Mesbah — November 28, 2016 @ 11:11 AM

  23. what would be the network topology in the case of isp redundancy ??
    Edge firewall, 3 leg parameter, back firewall or single network adapter
    If there is no DMZ in the network and we are using isp redundency, then waht would be the network topology. Plz guide regarding this


    Comment by Syed Ammar Haidar — September 17, 2017 @ 7:26 PM

  24. very good explanation.


    Comment by moid — April 4, 2018 @ 10:37 AM

  25. Dear Jahanzaib, I am using TMG 2010, and defined ISP redundancy as you mentioned in your post, my problem is that when primary ISP go down (internet connection down) then our internal user won’t able to use internet connection and i have to disable my Primary connection disable after that internet traffic route via secondary WAN.

    Can you please help me why it is so?

    Thanks in advance, looking forward to hear from you.


    Comment by moid — April 4, 2018 @ 10:45 AM

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: