Welcome to ISAserver.org

Netlogon 5783 - RPC Traffic Blocked

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA 2006 General] >> General >> Netlogon 5783 - RPC Traffic Blocked

Page: [1] 2 next > >>

Message

<< Older Topic Newer Topic >>

Netlogon 5783 - RPC Traffic Blocked - 23.Feb.2007 7:23:30 AM

Polar

Posts: 23
Joined: 30.Jun.2006
Status: offline

I've installed ISA 2006 and I'm getting the dreaded Netlogon 5783 on the server. I've noticed in the firewall log that RPC traffic is being denied to my DC's within the first minute or two when the ISA server loads up, under status 0xc0040017 is listed with - shown in the rule column. The traffic is then allowed through by the system policy rule Allow RPC from ISA Server to trusted servers.

Is anyone aware of a way to fix this issue?

Thanks

Post #: 1

Featured Links*

RE: Netlogon 5783 - RPC Traffic Blocked - 23.Feb.2007 8:58:39 AM

tshinder

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline

Is there an external DNS server configured on the ISA Firewall?

Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to Polar)

Post #: 2

RE: Netlogon 5783 - RPC Traffic Blocked - 23.Feb.2007 12:52:44 PM

Polar

Posts: 23
Joined: 30.Jun.2006
Status: offline

Hi Tom,

Thanks for the reply. There are no external DNS servers configured on the server. The LAN interface has two internal DNS servers configured which use forwarders. The WAN interface does not have any DNS servers configured.

Thanks

(in reply to tshinder)

Post #: 3

RE: Netlogon 5783 - RPC Traffic Blocked - 25.Feb.2007 12:55:33 PM

tshinder

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline

Was the ISA Firewall configured as a domain member before the Firewall software was installed?

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to Polar)

Post #: 4

RE: Netlogon 5783 - RPC Traffic Blocked - 25.Feb.2007 5:09:51 PM

Polar

Posts: 23
Joined: 30.Jun.2006
Status: offline

Hi Tom,

Yes, the server was a member of the domain before I installed ISA on it. The Netlogon errors didnt happen till 15:50 on the 21st, I installed ISA on the 20th at 10:54 (going from created date on the Microsoft ISA Server folder in Program Files) and between that time there were several restarts. I don't know if that helps at all...

Thanks

(in reply to tshinder)

Post #: 5

RE: Netlogon 5783 - RPC Traffic Blocked - 27.Feb.2007 8:39:25 AM

tshinder

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline

Are there any interesting errors on the domain controller?

Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to Polar)

Post #: 6

RE: Netlogon 5783 - RPC Traffic Blocked - 27.Feb.2007 12:52:22 PM

Polar

Posts: 23
Joined: 30.Jun.2006
Status: offline

Hi Tom,

Thanks for replying again. Sadly there are no errors in any of the domain controllers logs.

I uninstalled ISA off the server today and reinstalled it and recreated all my rules. After every change I did a reboot to see if I could figure out what was causing the problem. It seemed to be fine but I left the server for a hour or so after creating all the rules and rebooted it, the netlogon 5783 reappeared.

(in reply to tshinder)

Post #: 7

RE: Netlogon 5783 - RPC Traffic Blocked - 28.Feb.2007 10:33:40 AM

tshinder

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Polar,

OK. Is there anything not working because of this? Are you getting failed authentication attempts or are you unable to log into the machine with a domain account?

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to Polar)

Post #: 8

RE: Netlogon 5783 - RPC Traffic Blocked - 1.Mar.2007 7:31:35 AM

Polar

Posts: 23
Joined: 30.Jun.2006
Status: offline

Hi Tom,

I may have found a fix/fudge for the problem... I created a new protocol:

Name: AD Logon/Dir Rep
Port Range: 1025 - 1026
Protocol Type: TCP
Direction: Outbound

Then created an access rule to allow AD Logon/Dir Rep from Local Host to Internal. I've rebooted a few times this morning with the rule enabled and disabled. When the rule is disabled I get the netlogon error and when its enabled I dont. I'll keep testing it, but its looking hopeful.

(in reply to tshinder)

Post #: 9

RE: Netlogon 5783 - RPC Traffic Blocked - 1.Mar.2007 11:00:53 AM

tshinder

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline

There should already be a System Policy rule that allows RPC communications to your DCs.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to Polar)

Post #: 10

RE: Netlogon 5783 - RPC Traffic Blocked - 1.Mar.2007 11:38:09 AM

Polar

Posts: 23
Joined: 30.Jun.2006
Status: offline

Hi Tom,

I believe you are talking about system policy 22 - Allow RPC from ISA Server to trusted servers. I do have this enabled but it doesnt seem to take affect for the first 2 minutes or so and by that time the netlogon error has already been logged.

Thanks

(in reply to tshinder)

Post #: 11

RE: Netlogon 5783 - RPC Traffic Blocked - 2.Mar.2007 10:52:34 AM

tshinder

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Polar,

Are you seeing any side effects from this, other than the entry in the Event Viewer?

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to Polar)

Post #: 12

RE: Netlogon 5783 - RPC Traffic Blocked - 2.Mar.2007 11:34:47 AM

Polar

Posts: 23
Joined: 30.Jun.2006
Status: offline

Hi Tom,

I'm getting two other errors MrxSmb 8003 and W32Time 29. These do not appear until the server has been up and running for sometime. As I understand I can get round MrxSmb 8003 by disabling the computer browser service and I havent really looked into the W32Time issue yet...

One thing I have noticed is that it takes a fairly long time when I logon when it produces the 5783. It gets stuck on Applying Computer Settings.

(in reply to tshinder)

Post #: 13

RE: Netlogon 5783 - RPC Traffic Blocked - 3.Mar.2007 11:57:41 AM

tshinder

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Polar,

I'd double check the DNS settings on the ISA Firewall's NICs and make sure that only the internal DNS server is listed, and only the interface closest to that DNS server has the DNS server listed and that it's on the top of the interface list.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to Polar)

Post #: 14

RE: Netlogon 5783 - RPC Traffic Blocked - 6.Mar.2007 11:02:18 AM

Polar

Posts: 23
Joined: 30.Jun.2006
Status: offline

Hi Tom,

Just to say I have double checked all the interface settings and their order and they are set how your book says. The only way I seem to be able to get round the problem is by starting the ISA services up after Windows 2003 has loaded or use the protocol and rule I mention earlier, I'm not sure what the better option is though... Do you have any recommendations?

Thanks for all your help.

(in reply to tshinder)

Post #: 15

RE: Netlogon 5783 - RPC Traffic Blocked - 6.Mar.2007 11:44:44 AM

tshinder

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Polar,

Check your DNS server and make sure that it's registered the IP address on the internal interface for the name of the ISA Firewall. Sometimes the external IP address get registered or even a VPN address.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to Polar)

Post #: 16

RE: Netlogon 5783 - RPC Traffic Blocked - 13.Mar.2007 1:11:50 PM

Polar

Posts: 23
Joined: 30.Jun.2006
Status: offline

Hi Tom,

Sorry for the delay in replying. I've checked the DNS servers and the private IP address that is assigned to the LAN interface is registered correctly.

Are you aware of any of your lab ISA servers blocking traffic that is destined for a DC on port 1026 when they first load?

Thanks

(in reply to tshinder)

Post #: 17

RE: Netlogon 5783 - RPC Traffic Blocked - 13.Mar.2007 1:17:30 PM

ossiv5

Posts: 9
Joined: 19.Apr.2004
Status: offline

hi,

i have installed ISA Server 2006 on a Win Server 2003 machine.
I have the same event-id in the systemlog.
On this machine i have installed the Symantec Antivirus-Client (SAV 10.x) too.
i notice: when i deinstall this program then the event 5783 disappears.

how can i resolve this problem?

bye

oscar

(in reply to tshinder)

Post #: 18

RE: Netlogon 5783 - RPC Traffic Blocked - 15.Mar.2007 6:54:10 PM

saturno

Posts: 8
Joined: 24.May2006
From: Portugal
Status: offline

Hi everyone

I'm having the same problem as Polar.

W2k3 R2 domain member before installing ISA.
Network cards correctly ordered (and protocols) as per Tom instructions.
Everything works untill Firewall Service is started. After this ISA can't negotiate with AD (sepparate w2k3 +sp1 machine).

I noticed this when I tried to add a windows namespace group for vpn users without success.

When configuring allowed groups for vpn, I can browse internal domain->OU->vpn users group, but when confirming, ISA take more than a minute to validate and the gorup name is not shown! only appears it's SID!!

System policy rules are enabled for AD internal network, but firewall service is still blocking netbios AD related operations.

Can someone point us any directions?

Thanks for any help

edit: just for testing purposes, with the exactly same rules, I tried to authenticate those vpn users against a RADIUS server (the same that has AD) and worked perfectly.

< Message edited by saturno -- 15.Mar.2007 7:30:29 PM >

(in reply to ossiv5)

Post #: 19

RE: Netlogon 5783 - RPC Traffic Blocked - 16.Mar.2007 7:49:58 AM

saturno

Posts: 8
Joined: 24.May2006
From: Portugal
Status: offline

Just to let you know that the solution provided by Polar in post #9 works perfectly.

I've created a similar protocol just for port 1025, and after enabling it, everything seems to be working as it should.

- No delays loging on to ISA
- Can create new user sets from internal domain
- No RPC erros,etc...

Does this rule shouldnt be unnecessary?

Can someone explain why this happen?

Thnaks

(in reply to saturno)

Post #: 20