Welcome to ISAserver.org

Unidentified IP traffic being denied

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2004 Firewall] >> General >> Unidentified IP traffic being denied

Page: [1]

Message

<< Older Topic Newer Topic >>

Unidentified IP traffic being denied - 12.Aug.2005 8:45:00 PM

charlie66

Posts: 27
Joined: 9.Aug.2004
From: Denmark
Status: offline

Generally, I see some unidentified IP traffic being denied, mostly high ports and some web proxy on 8080.

I cannot understand why the web proxy traffic is being denied (from internal to localhost) - log states that the rule is "-".

More problematic - the server can run without issues other than the above for a week or two, and then it suddenly denies all web proxy traffic, again under the rule "-". Obviously, this means the internet is not accessible.

Everything else is normal, there are no eventlog entries, connectivity is good. Only solution is to restart the firewall service which clears the issue.

Configuration is ISA 2004 sp1 Std on Win 2003 sp1 - the same issue existed before either of the sp's were applied, and the server has been completely rebuilt also (albeit because of a HW error, but the issue persists).

ISA is running in single NIC mode (I know, but we have a BorderWare firewall in front and it has to stay as the "only" firewall according to management decision. And single NIC mode is a supported configuration after all. Anyway, ISA at random intervals denying all traffic of a certain type is not the best sales argument.

Any hints?

Soren

Post #: 1

Featured Links*

RE: Unidentified IP traffic being denied - 30.Aug.2005 3:41:00 PM

charlie66

Posts: 27
Joined: 9.Aug.2004
From: Denmark
Status: offline

So it just happened yesterday again - all unidentified ip traffic is being blocked, apparently under the default rule. Since web proxy traffic falls under this category, access to the internet is not available until the firewall service has been stopped and started.

Nobody has any suggestions?

I suppose, I could just as a matter of routine, reset the firewall service every two weeks, but this really should not be necessarry.

I'll appreciate any suggestions!

Soren

(in reply to charlie66)

Post #: 2