<edited: I think my subject didn't properly reflect the configuration question>
Hello, I have an existing TMG setup that is currently publishing the various Exchange services of Activesync, Outlook Anywhere and OWA. It looks like ths:
Internet --------- FW-----------TMG------------Publish-------------TMG-------------Internal
Ext Outlook Int
NIC#1 Suite NIC#2
TMG Ext Nic#1 = 10.10.10.250/24
Incoming public traffic is NAT'd to 10.10.10.250
Default Gateway: 10.10.10.254 (firewall)
Exchange Activesync Listener IP: 10.10.10.250
TMG Int Nic#2 = 192.168.168.1/24
Default Gateway: None
Static Route to internal network
Background: As you can see, the TMG sits behind another firewall and only publishes Exchange services. It is not used for general outbound traffic.
I am deploying Lync and was planning to add it to the TMG configured as it is shown here: http://jsilverdrake.blogspot.com/2012/04/publishing-lync-with-forefront-tmg-part_26.html
For purposes of keeping the Exchange and Lync traffic seperated, my firewall is configured with the Exchange services above on one VLAN, the 10.10.10.0/24 network above, and the Lync services on another VLAN on say a 10.10.50.0/24 network. I don't profess to be an expert but I'm thinking that the most secure way to do this would be to have a seperate external facing NIC for Exchange and another for Lync. The obvious flaw in my logic is that I can't have two NIC's with each having its own default gateway.
The only way I can see around this is to reconfigure my firewall to have both the Exchange services and the Lync services on the same VLAN (network), and NAT the public traffic to say, 10.10.10.200 and configure the Lync Web Listener to listen for 10.10.10.200.
That would have the Exchange traffic coming to the sole TMG external NIC destined for 10.10.10.250 and the Lync traffic being directed to 10.10.10.200 and their respective Web Listeners.
My question is, are my assumptions correct and is it secure to have Exchange traffic and Lync traffic (and any other future traffic I add to the TMG) hitting the TMG on the same subnet with just different IP's?
I'm sorry if this seems a dumb question and I thank you for your help.
Jim