• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

Internal DNS Servers Stop Responding

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2000 Firewall] >> Firewall Client >> Internal DNS Servers Stop Responding Page: [1]
Login
Message << Older Topic   Newer Topic >>
Internal DNS Servers Stop Responding - 10.Dec.2002 4:37:00 PM   
MattYurek

 

Posts: 34
Joined: 11.Apr.2001
From: Norwalk, CT
Status: offline
I have 2 DNS servers with private IPs (NAT Clients) behind an ISA server running in integrated mode. Occasionally the DNS services on both servers will, at the same time, stop resolving external zones. The internal zones are never a problem, so I know the DNS servers are working properly.

I've already applied ISA SP1 and the 2 post-SP1 hotfixes. MS Q312640 says the fix for this issue is to install SP1 - riiiight. I have not run the lockdown wizard, and TCP/IP is the only protocol running on both NICs. The internal NIC on the ISA server uses internal DNS and no gateway, the external NIC has no DNS and the ISP's gateway. The internal DNS servers that stop working have failed when accessing the ISP's DNS and the root hosts.

I'm publisking a website, a POP3 server, and an SMTP server on the same ISA box. I'm using a different IP for the publishing than the NAT clients use for outgoing access.

My old fix was to restart the Web Proxy service, or un- and re-install ISA SP1. Up until a week or two ago this seemed to work. I have this exact installation in 3 different networks, in 3 different places, with 3 different ISPs... this DNS issue happens regularly in only 2 of them.

This issue has already been covered in this thread: http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=2;t=003374 but hasn't done much to solve my issue. Does anyone have any additional information on this problem?
Post #: 1
RE: Internal DNS Servers Stop Responding - 11.Dec.2002 7:31:00 AM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Matt,

I've found that when I split my DNS in advertising and resolver servers that things worked much better. Also disabling recursion on the advertisers is very helpful. There are a few more tips, but my Exchange server is down so I don't have access to them [Big Grin]

HTH,
Tom

(in reply to MattYurek)
Post #: 2
RE: Internal DNS Servers Stop Responding - 11.Dec.2002 3:32:00 PM   
MattYurek

 

Posts: 34
Joined: 11.Apr.2001
From: Norwalk, CT
Status: offline
My only concern is that these DNS servers are internal only -- there are only about 100 nodes on each network, and two servers service these 100 nodes. The servers will resolve about 10 internal zones and will forward on anything else to the root or my ISP - very low traffic on these servers. We don't run any public zones out of the offices, so there's really no need to split the DNS in these situations.

Once the exchange server comes back online, I'd love to hear what else you got! :-)

(in reply to MattYurek)
Post #: 3
RE: Internal DNS Servers Stop Responding - 12.Dec.2002 4:04:00 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Matt,

OK, it seems that you might have a bit different problem, although related to what I was talking about.

Check this out:

===================
Jorgen
Junior Member
Member # 8800

posted November 11, 2002 11:13 AM
--------------------------------------------------------------------------------
Sorry Stefaan

Your link is close but not quite all the way there...

That article deals with TCP comnnections and most (not all) DNS traffic is UDP based. The parameter that handles UDP "connections" are in the same location but is called "msFPCMappingQuota".

/Jśrgen


SecureNAT and Firewall Clients Are Disconnected from the Network
CAUSE
This behavior can occur because ISA Server limits each client to forty SecureNAT mappings, by default. If there are more than forty simultaneous connections from one client, when the forty-first connection is requested from the same client, ISA Server sends a TCP Reset frame to the oldest connection, and then the new connection is successfully established.
RESOLUTION
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To resolve this behavior, increase the registry value that controls the number of connections that ISA Server allows for each client:
Start Registry Editor (Regedt32.exe).
Locate and click the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\FPC\Arrays\GUID\ArrayPolicy\Proxy-WSP\msFPCConnectionQuota

Click DWORD on the Edit menu, type a new value, and then click OK.

NOTE: The new value depends on your environment. The default is 40 decimal. A new value of 100 decimal is safe in most cases. To determine a specific value, analyze the maximum number of simultaneous sessions that you need. The maximum allowable value is based on available system resources.
Quit Registry Editor.

===========================

Change the entry msFPCMappingQuota to 600 decimal and it should work much better. Don't make the change to the TCP quota or it won't work and might make things worse (or not).

HTH,
Tom

(in reply to MattYurek)
Post #: 4
RE: Internal DNS Servers Stop Responding - 12.Dec.2002 4:26:00 PM   
MattYurek

 

Posts: 34
Joined: 11.Apr.2001
From: Norwalk, CT
Status: offline
Thanks for the additional info - I'll try that out today and hope it helps things.

My only concern is that the problem goes away for a number of weeks after re-installing ISA (my only sure-fire fix at this point). So wouldn't this mean that a "too many connections" problem would resurface almost immediately? And if it was "too many connections" wouldn't restarting the ISA server or the services clear the problem up at least temporarily? It doesn't...

Thanks again, if you have any additional insight, or if I find out anything else, I'll meet you back here. :-)

(in reply to MattYurek)
Post #: 5
RE: Internal DNS Servers Stop Responding - 13.Dec.2002 5:51:00 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Matt,

I think the fact that it goes away for a number of weeks is just a coincidence. I've noticed the same thing, but it will go away for weeks and then return. But since we don't really know for sure what's causing the problem, it could be anything [Big Grin] Try the registry entries and see how it works for you. So far, it seems to be working OK at our sites.

HTH,
Tom

(in reply to MattYurek)
Post #: 6
RE: Internal DNS Servers Stop Responding - 28.Jan.2003 6:06:00 PM   
jbaud3

 

Posts: 17
Joined: 23.Sep.2002
Status: offline
We have found a similar problem. We have a split DNS system as well. When we restart the ISA services on the ISA server, our (separate) internal DNS server stops resolving dns queries, every time... WEIRD!

Restarting the DNS Server service on the internal DNS server fixes the problem... hope this helps you track down your issue.

(in reply to MattYurek)
Post #: 7
RE: Internal DNS Servers Stop Responding - 31.Jan.2003 9:40:00 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi J,

Restarting the ipnat service is faster [Big Grin]

HTH,
Tom

(in reply to MattYurek)
Post #: 8
RE: Internal DNS Servers Stop Responding - 1.Feb.2003 2:58:00 AM   
jmacneil

 

Posts: 29
Joined: 27.Feb.2002
Status: offline
Matt-

I had the same problem with our internal dns servers, to get around this issue you can setup your ISA Servers as caching only DNS servers. After we setup our ISA Servers for caching only dns the internal dns servers worked great even after a restart and or shutdown.
Hope the information helps.

-Josh

(in reply to MattYurek)
Post #: 9
RE: Internal DNS Servers Stop Responding - 3.Feb.2003 7:04:00 AM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Josh,

Yes! That is a good way to get around the problem, that and putting your public DNS servers on the ISA Server, alhtough I really don't like that solution as much.

Thanks!
Tom

(in reply to MattYurek)
Post #: 10
RE: Internal DNS Servers Stop Responding - 4.Feb.2003 2:38:00 AM   
RTrees

 

Posts: 2
Joined: 9.Apr.2002
Status: offline
I must be missing something here. We have been having a very similar problem. I checked to see if I could add this registry entry and found that I don't have the key starting at FPC, I have no "Arrays" key. Why would that be?

(in reply to MattYurek)
Post #: 11

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2000 Firewall] >> Firewall Client >> Internal DNS Servers Stop Responding Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts