Welcome to ISAserver.org
Forums |
Register |
Login |
My Profile |
Inbox |
RSS 
|
My Subscription |
My Forums |
Address Book |
Member List |
Search |
FAQ |
Ticket List |
Log Out
"Failed Connection Attempt" for MSBITS client - WIndows Update
|
Users viewing this topic:
none
|
Logged in as: Guest
|
Login  | |
|
"Failed Connection Attempt" for MSBITS client... - 2.Oct.2008 1:47:14 PM
|
|
|
Hapexamendios
Posts: 7
Joined: 2.Oct.2008
Status: offline
|
Hi all,
My first post on this forum; though it has helped me a great deal in the past :)
Here's my problem:
Recently, I've noticed that, when attempting to perform Windows or Microsoft Update through our ISA 2006 Std server, some (but not all) of the updates are failing. I ahev a Firewall rule which is designed to allow anonymous access to all the Windows Update sites as highlighted in
http://support.microsoft.com/kb/885819/en-us
I ran a live logging session on ISA against a "problem" client, and saw some interesting results - a large amount of "Failed Connection Attempt" entries, like this:
Failed Connection Attempt
<ISA Server name> 02/10/2008 18:10:43
Log type: Web Proxy (Forward)
Status: 12158
Rule: MS Updates
Source: Internal (<client's IP address>)
Destination: External (<upstrem content-filtering server:80>)
Request: GET http://www.download.windowsupdate.com/msdownload/update/software/uprl/2008/07/windowsxp-kb951072-v2-x86-enu_416780abe6a655cc4be4dfc720dd17c4fad0011f.psf
Filter information: Req ID: 16440723 , Range=22016-25441;25600-29027
Protocol: http
User: anonymous
 Additional information
Client agent: Microsoft BITS/6.7
Object source: Upstream (Object was returned from an upstream proxy cache.)
Cache info: 0x8800040 (Request includes the RANGE header. Response includes the LAST-MODIFIED header. Response includes the VIA header.)
Processing time: 31 ms
MIME type: -
I'm struggling to find a relevant common denominator; and I'm unsure I have, but it seems that these "Failed Connection Attempt" have this in common:
- they originate from the MSBITS/6.6 or MSBITS/6.7 client on the machine instead of the WIndows Update Agent or the browser
- they are all attempts to download ".psf" files
Having checked further, there are entries for successful connections by MSBITS/x, but only when ".exe" files are the target as selected by the Windows Update site.
The last piece of obviously relevant information is that ISA connects through a content-filtering server - MIMESweeper for Web by Clearswift, which is the "<content-filtering server>" above. It's been checked over, and if I use it as the proxy instead of the ISA serevr, there's not a single hitch.
Can anyone there assist with a method of troubleshooting this? I've been through everything from the Networks, System Firewall policy and my own firewall rules - however as it's the "MS Updates" rule I created being registered as the blocking rule, surely it's somewhere there...?
Much appreciated...
< Message edited by Hapexamendios -- 3.Oct.2008 8:06:01 AM >
|
|
|
|
|
RE: "Failed Connection Attempt" for MSBITS cl... - 3.Oct.2008 5:13:50 AM
|
|
|
Hapexamendios
Posts: 7
Joined: 2.Oct.2008
Status: offline
|
Thanks for the reply, hsdhilon
Yes; though I don't see a System firewall rule for that in ISA 2006. Mines is a custom rule, created as outlined in kb885819 (in the "More Information" section, though I'm disturbed by the fact that ISA 2006 isn't mentioned in the article. It contains all those sites in a URL set, it allows "All protocols" and "All content types".
Also, my issue isn't identical to the kb article Scenarios - the issue for me arises at the "Downloading updates" phase, having successfully scanned for, selected and clicked to "Install Updates". The downloads all fail, and I see "0x80244019" in the update history for the client.
I am thinking it's these .psf extensions, which I think are for the Packager for Windows handler (can't remember the handler's name, no time to look it up!)
Since my rule doesn't dicriminate by content type, I can't understand why this would be the case, but it seems so.
Any more ideas - or anyone else have any advice as to how to troubleshoot this issue further?
Thanks...
|
|
|
|
|
RE: "Failed Connection Attempt" for MSBITS cl... - 3.Oct.2008 5:13:51 AM
|
|
|
Hapexamendios
Posts: 7
Joined: 2.Oct.2008
Status: offline
|
<Removed spurious double post - another "feature" of our ISA server...>
< Message edited by Hapexamendios -- 3.Oct.2008 8:07:49 AM >
|
|
|
|
|
RE: "Failed Connection Attempt" for MSBITS cl... - 8.Oct.2008 11:19:45 AM
|
|
|
Hapexamendios
Posts: 7
Joined: 2.Oct.2008
Status: offline
|
Hi Tom,
I'm not sure what you mean there; however it sounds close to one fo the tests I performed: I edited the "Internal" network's properties, and on the "Web Browser" tab, I set the domains cited in kb885819 in the Direct Access field there.
However, we don't use the automatic configuration script to set browser settings; we use Group Policy, with a GPO attached to each AD site.
I've just tested it again; I have the Firewall Client running on my machine, so clicking the "Configure Now" button on the Web Browser tab sets IE to use the auto-configuration script
:8080/array.dll?Get.Routing.Script">http://<proxyserver>:8080/array.dll?Get.Routing.Script
Sadly, this still fails.
How would I check that all the pre-requisites for using the method above have been met? For example, if the auto-config script is needed, how to check that the script exists and is configured correctly; does the type of network template involved have an impact (this box is uni-homed).
Thanks for taking the time to reply, Tom,
|
|
|
|
|
RE: "Failed Connection Attempt" for MSBITS cl... - 9.Oct.2008 9:06:15 AM
|
|
|
tshinder
Posts: 47644
Joined: 10.Jan.2001
From: Texas
Status: offline
|
Hi Hap,
I think you mentioned that there was a device that was handling traffic in addition to the ISA firewall, is that right? Is that device behind of, along side, or in front of the firewall?
Thanks!
Tom
_____________________________
Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/
GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8
|
|
|
|
|
RE: "Failed Connection Attempt" for MSBITS cl... - 13.Oct.2008 5:05:43 AM
|
|
|
Hapexamendios
Posts: 7
Joined: 2.Oct.2008
Status: offline
|
HI Tom,, all,
Yes, we have a server running Clearswift's MIMESweeper for Web.
This is the Internet-facing device, with ISA connecting through it to the web.
Its purpose is really content-filtering. Haven't found anything on their forums indicating a known issue or mis-configuration.
I've confirmed it's not that - at least, I can browse the web directly through it with no issues (using it as my browser's proxy), so none of its "scenarios" are directly responsible for stopping the traffic.
It could still be that the issue is for ISA downloading certain copntent types through it, although that doesn't really make sense if I can browse through it.
Still stumped...:)
|
|
|
|
|
RE: "Failed Connection Attempt" for MSBITS cl... - 13.Oct.2008 5:05:43 AM
|
|
|
Hapexamendios
Posts: 7
Joined: 2.Oct.2008
Status: offline
|
<darn thing...>
|
|
|
|
 New Messages |
 No New Messages |
 Hot Topic w/ New Messages |
 Hot Topic w/o New Messages |
 Locked w/ New Messages |
 Locked w/o New Messages |
|
 Post New Thread
Reply to Message
Post New Poll
Submit Vote
Delete My Own Post
Delete My Own Thread
Rate Posts |
|
Printable Version
RE: "Failed Connection Attempt" for MSBITS cl... - 
