Welcome to ISAserver.org

Weird eventlog entry

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2004 Firewall] >> Network Infrastructure >> Weird eventlog entry

Page: [1]

Message

<< Older Topic Newer Topic >>

Weird eventlog entry - 28.May2005 5:48:00 AM

FrancWest

Posts: 70
Joined: 22.Jul.2004
Status: offline

Hi,

during startup of our ISA server, the following error is logged:

ISA Server detected routes through adapter DMZ that do not correlate with the network element to which this adapter belongs. For best practice, the address range of an ISA Server network should match the address ranges routable through the associated network adapter as defined in the routing table. Otherwise valid packets may be dropped as spoofed. (This alert may occur momentarily when you create a remote site network. You may safely ignore this message if it does not reoccur.) The address ranges in conflict are: 10.255.255.255-10.255.255.255;.

ISA is configured as the second firewall in a Back-Back config.

Everything seems to work fine though.

Any idea how to fix this ?

Franc.

Post #: 1

Featured Links*

RE: Weird eventlog entry - 29.May2005 12:33:00 AM

isawader

Posts: 420
Joined: 27.Apr.2005
Status: offline

Read this KB
http://support.microsoft.com/?kbid=884496

(in reply to FrancWest)

Post #: 2

RE: Weird eventlog entry - 29.May2005 9:53:00 PM

ClintD

Posts: 1833
Joined: 26.Jan.2001
From: Keller, TX
Status: offline

In addition to that article, if you use a 10.x address range on both the external and internal adapters (different subnet ID's), then this is a benign error message.

The reason it is benign is that Windows, when assigned a 10x address on any adapter, automatically builds a route to the 10.255.255.255 destination for that adapter, regardless of the subnet ID you've used. If you have 2 adapters with a 10.x address, then Windows makes 2 route entries for this destination.

ISA looks at the routing table and says "Well, Windows is telling me that 10.255.255.255 is accessible through my external and internal adapters - so where is it really at?". This is what the error is really telling you and is safe to ignore in this scenario only.

(in reply to FrancWest)

Post #: 3