• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

ISA Server alert: The Web cache proxy was disabled because of a global failure.

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2004 Cache] >> General >> ISA Server alert: The Web cache proxy was disabled because of a global failure. Page: [1] 2   next >   >>
Login
Message << Older Topic   Newer Topic >>
ISA Server alert: The Web cache proxy was disabled beca... - 23.Jul.2004 11:43:00 AM   
Markus M.

 

Posts: 8
Joined: 23.Jul.2004
From: Germany
Status: offline
Hello,

we work with ISA 2004 on our Systemcenter enviroment. Every think works well, but the caching does not work. We got the following message:
ISA Server alert: The Web cache proxy was disabled because of a global failure.
The cache was not properly initialized. caching will be disabled (internal code 503.285.4.0.2161.50). Identify the specific reason for the failure from previous relevant event logs. Fix the problem, and then restart the Firewall service to enable caching.
The failure is due to error: A cluster resource failed.

Wath have we to do ?
Markus
Post #: 1
RE: ISA Server alert: The Web cache proxy was disabled ... - 23.Jul.2004 11:57:00 AM   
Markus M.

 

Posts: 8
Joined: 23.Jul.2004
From: Germany
Status: offline
Some more Infos:
The D:\ drive has 3 GB. 2.7 are free. We start with are cache of 500 MB. The isa server creates the D:\urlcache but no file.

(in reply to Markus M.)
Post #: 2
RE: ISA Server alert: The Web cache proxy was disabled ... - 23.Jul.2004 2:26:00 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Markus,

Do you know what the cluster resource might be that it's referring to?

Thanks!
Tom

(in reply to Markus M.)
Post #: 3
RE: ISA Server alert: The Web cache proxy was disabled ... - 23.Jul.2004 2:30:00 PM   
Markus M.

 

Posts: 8
Joined: 23.Jul.2004
From: Germany
Status: offline
Hello Tom,

actually we don't know, why in the eventlog is the information about the cluster ressource. The windows server 2003 is anyhow "only" a standard edition.

We already installed everything from the scretch with the same result.

Regards Markus

(in reply to Markus M.)
Post #: 4
RE: ISA Server alert: The Web cache proxy was disabled ... - 24.Jul.2004 6:35:00 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Markus,

I haven't encountered this error yet. If you figure it out, let us know!

Thanks!
Tom

(in reply to Markus M.)
Post #: 5
RE: ISA Server alert: The Web cache proxy was disabled ... - 2.Aug.2004 2:36:00 PM   
GMSonic

 

Posts: 9
Joined: 9.Feb.2004
Status: offline
Hello,
we have the same problem. Windows 2003 standart server with all hotfixes, ISA Server 2004 Final Edition. Everything works fine, but if i define a cache drive, then the following error is shown in the alert window:

Description: The cache was not properly initialized. caching will be disabled (internal code 503.285.4.0.2161.50). Identify the specific reason for the failure from previous relevant event logs. Fix the problem, and then restart the Firewall service to enable caching. The failure is due to error: A cluster resource failed.

The urlcache directory was created but is still empty. I have set everyone fullcontrol permission to this folder and restart the isa services... no success...

Best Regards Marc

(in reply to Markus M.)
Post #: 6
RE: ISA Server alert: The Web cache proxy was disabled ... - 2.Aug.2004 9:51:00 PM   
Ann Lee

 

Posts: 3
Joined: 18.Jul.2004
Status: offline
Hi.
Maybe you set cache on FAT32 disk partion ?

(in reply to Markus M.)
Post #: 7
RE: ISA Server alert: The Web cache proxy was disabled ... - 2.Aug.2004 10:46:00 PM   
Markus M.

 

Posts: 8
Joined: 23.Jul.2004
From: Germany
Status: offline
Hello,
as I know, it is not possible, to set a cache on a fat32-partition.

(in reply to Markus M.)
Post #: 8
RE: ISA Server alert: The Web cache proxy was disabled ... - 3.Aug.2004 9:18:00 AM   
GMSonic

 

Posts: 9
Joined: 9.Feb.2004
Status: offline
Hello,
the partition is ntfs formated...

I don't understand the error message "A cluster resource failed" ??? On Technet and Google Groups no solution is posted..

Regards Marc

(in reply to Markus M.)
Post #: 9
RE: ISA Server alert: The Web cache proxy was disabled ... - 3.Aug.2004 1:31:00 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hey guys,

What happens if you delete the old cache file and create a new one on another drive?

Thanks!
Tom

(in reply to Markus M.)
Post #: 10
RE: ISA Server alert: The Web cache proxy was disabled ... - 3.Aug.2004 1:40:00 PM   
Markus M.

 

Posts: 8
Joined: 23.Jul.2004
From: Germany
Status: offline
Hello Tom,

thank You for Your tip. We already tested the cache on all drives in every size and combination. We believe that the information about the "cluster...." is the key to the solution. If we promt the set-command we see an entry about a cluster ressource. But why and how can these be shown on an standard edition?

Regard Markus

(in reply to Markus M.)
Post #: 11
RE: ISA Server alert: The Web cache proxy was disabled ... - 3.Aug.2004 1:48:00 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Markus,

Is it possible that ISA 2000 Enterprise Edition was installed on that machine in the past?

Thanks!
Tom

(in reply to Markus M.)
Post #: 12
RE: ISA Server alert: The Web cache proxy was disabled ... - 3.Aug.2004 2:04:00 PM   
GMSonic

 

Posts: 9
Joined: 9.Feb.2004
Status: offline
Hi Friends,
here the solution:

Isa Server 2004 runs under the network service user, we have set the ntfs permissions via policy to all our member servers (also isa server).

The solution is, you must set the network service user on the root of the disk with full control permissions. If you set it only on the urlcache directory, it fails to initialize.

I have modified our policy and added the network service user on this drives. Everything works fine.....

Regards Marc

(in reply to Markus M.)
Post #: 13
RE: ISA Server alert: The Web cache proxy was disabled ... - 3.Aug.2004 2:10:00 PM   
Markus M.

 

Posts: 8
Joined: 23.Jul.2004
From: Germany
Status: offline
Hey Marc,

great point! We chance in our network also the root security just for local admin with full control. I will be in our office the next day and will chance the NTFS-Rights, then we see.

(in reply to Markus M.)
Post #: 14
RE: ISA Server alert: The Web cache proxy was disabled ... - 4.Aug.2004 10:54:00 AM   
Markus M.

 

Posts: 8
Joined: 23.Jul.2004
From: Germany
Status: offline
Hello Marc,

I changed the security properties as You metioned and it works fine. Thank You very much for Your help. Great job.

Regards Markus

(in reply to Markus M.)
Post #: 15
RE: ISA Server alert: The Web cache proxy was disabled ... - 4.Aug.2004 1:28:00 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hey guys,

This is great info! The error message could have been a bit more helpful [Smile]

Thanks!
Tom

(in reply to Markus M.)
Post #: 16
RE: ISA Server alert: The Web cache proxy was disabled ... - 4.Aug.2004 3:31:00 PM   
Jim Harrison

 

Posts: 271
Joined: 5.May2001
From: Redmond, WA
Status: offline
Hi all,

This isn't a good idea, security-wise.
The whole point of the Network Service is that it only gets access to the places it needs to work.

Have you tried limiting that access to:
- ISA installation folder tree
- ISA logging folder
- ISA cache folder
?

(in reply to Markus M.)
Post #: 17
RE: ISA Server alert: The Web cache proxy was disabled ... - 5.Oct.2004 11:33:00 PM   
Guest
ISA sets full control to the urlcache directory but it does not change the root directory. Setting Network Service to read access at the root access seems to work.

(in reply to Markus M.)
  Post #: 18
RE: ISA Server alert: The Web cache proxy was disabled ... - 22.Nov.2004 4:44:00 PM   
RanT

 

Posts: 1
Joined: 22.Nov.2004
Status: offline
Hi Guys,
The solution described above suggests allowing full control to NETWORK SERVICE on the disk root. As a general security guideline, we recommend that you do not allow the NETWORK SERVICE extensive permissions.

What is the problem?
When configuring cache drive, if the root dir on the drive (e.g. C:\ or D:\ or E:\ or...) has non-default permissions, in which a NETWORK SERVICE does not have sufficient permissions the creation of the cache file fails.

GMSonic proposed a solution in a previous posting: ˘...The solution is, you must set the network service user on the root of the disk with full control permissions...÷

What is the security problem with this solution?
This solution would surely work. But from security PoV it is not recommended.
A NWS is generally considered to be a service with low trust because it is dealing with network traffic and therefore there is a chance that it is possible to exploit it from the network. Therefore a NWS should not have full access to the drive root. This solution would work, but it is not recommended security-wise

What is a better solution?
NWS only needs the following permissions to the driveĂs root:
+ ˘Read Attributes÷
+ ˘Create Folders / Append data÷
Note: These permissions should not be inherited to subfolders or files. The permissions should apply to ÷This folder only÷ (use the advanced tab when setting permissions the permissions).

A few notes:
  • NETWORK SERVICE exists on Win 2003, but does not exist on Win 2000. On Win 2000 the ISA firewall service runs as system
  • On Win 2003 in a default installation a NWS is not explicitly allowed the above listed permissions, rather the USERS group is allowed them and a NWS is part of the USERS group.
  • You can read more security hardening guidelines in the ˘ISA Server 2004 Security Hardening Guide÷, available on http://www.microsoft.com/isaserver/techinfo/guidance/2004/planning.asp
RanT [MS ISA team]

(in reply to Markus M.)
Post #: 19
RE: ISA Server alert: The Web cache proxy was disabled ... - 23.Nov.2004 12:31:00 PM   
Markus M.

 

Posts: 8
Joined: 23.Jul.2004
From: Germany
Status: offline
Hello Ran,

thanks for Your help. The hardening guidelines isvery new. We alreday got them and changed the ACL on the maschines.

May be You can ask Your team in SP1 for ISA to implement in the wizzard a control for changing the correct ACL for the caching mode. This would be very helpfull for administrators. The error log was not very helpfull in this case.

Greating from Germany

(in reply to Markus M.)
Post #: 20

Page:   [1] 2   next >   >> << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2004 Cache] >> General >> ISA Server alert: The Web cache proxy was disabled because of a global failure. Page: [1] 2   next >   >>
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts