8080 Denied Connections? (Full Version)

All Forums >> [ISA Server 2004 General ] >> ISA 2004 SBS



Message

Cumulus -> 8080 Denied Connections? (24.Mar.2006 10:41:21 PM)

I am fairly new to ISA and some of the configurations get a little beyond my understanding.  Specifically in this instance ISA denies a connection to port 8080 which I understand is the proxy port,  as all proxy request are sent to server:8080, but it dosnt list a rule that is causing the connections to be denied?  So do I need to create a rule beyond the standard rules that are created with the SBS wizzard?  Below are three different clients trying to connect.

And for clairity this is on Windows SBS 2003 with ISA 2004. 


Original Client IP    Client Agent    Authenticated Client    Service    Server Name    Referring Server    Destination Host Name    Transport    MIME Type    Object Source    Source Proxy    Destination Proxy    Bidirectional    Client Host Name    Filter Information    Network Interface    Raw IP Header    Raw Payload    Source Port    Processing Time    Bytes Sent    Bytes Received    Result Code    HTTP Status Code    Cache Information    Error Information    Log Record Type    Log Time    Destination IP    Destination Port    Protocol    Action    Rule    Client IP    Client Username    Source Network    Destination Network    HTTP Method    URL
192.168.1.111                ZDG1    -        TCP    -                No        -    192.168.1.201    45 00 00 28 50 e9 00 00 80 06 65 5e c0 a8 01 6f c0 a8 01 c9    06 d4 1f 90 68 da 8b d1 68 da 8b d1 50 04 00 00 1b 9c 00 00    1748    0    0    0    0xc0040017 FWX_E_TCP_NOT_SYN_PACKET_DROPPED        0x0    0x0    Firewall    3/24/2006 1:14:08 PM    192.168.1.201    8080    Web Proxy    Denied Connection        192.168.1.111        Internal    Local Host    -    -
192.168.1.111                ZDG1    -        TCP    -                No        -    192.168.1.201    45 00 00 28 51 51 00 00 80 06 64 f6 c0 a8 01 6f c0 a8 01 c9    06 d5 1f 90 60 ad c6 7c 60 ad c6 7c 50 04 00 00 b6 9e 00 00    1749    0    0    0    0xc0040017 FWX_E_TCP_NOT_SYN_PACKET_DROPPED        0x0    0x0    Firewall    3/24/2006 1:14:26 PM    192.168.1.201    8080    Web Proxy    Denied Connection        192.168.1.111        Internal    Local Host    -    -
192.168.1.115                ZDG1    -        TCP    -                No        -    192.168.1.201    45 00 00 28 91 c1 40 00 80 06 e4 81 c0 a8 01 73 c0 a8 01 c9    0e b1 1f 90 bf 73 b8 73 8f f1 c3 d3 50 14 00 00 31 56 00 00    3761    0    0    0    0xc0040017 FWX_E_TCP_NOT_SYN_PACKET_DROPPED        0x0    0x0    Firewall    3/24/2006 1:33:08 PM    192.168.1.201    8080    Web Proxy    Denied Connection        192.168.1.115        Internal    Local Host    -    -
192.168.1.115                ZDG1    -        TCP    -                No        -    192.168.1.201    45 00 00 28 94 c6 00 00 80 06 21 7d c0 a8 01 73 c0 a8 01 c9    08 52 1f 90 2c 2c 99 5c 2c 2c 99 5c 50 04 00 00 78 60 00 00    2130    0    0    0    0xc0040017 FWX_E_TCP_NOT_SYN_PACKET_DROPPED        0x0    0x0    Firewall    3/24/2006 1:57:09 PM    192.168.1.201    8080    Web Proxy    Denied Connection        192.168.1.115        Internal    Local Host    -    -
192.168.1.110                ZDG1    -        TCP    -                No        -    192.168.1.201    45 00 00 28 7a 6d 00 00 80 06 3b db c0 a8 01 6e c0 a8 01 c9    06 07 1f 90 b8 30 1b f5 b8 30 1b f5 50 04 00 00 5d 76 00 00    1543    0    0    0    0xc0040017 FWX_E_TCP_NOT_SYN_PACKET_DROPPED        0x0    0x0    Firewall    3/24/2006 2:15:43 PM    192.168.1.201    8080    Web Proxy    Denied Connection        192.168.1.110        Internal    Local Host    -    -


Any help would be much appreciated!



Cumulus -> RE: 8080 Denied Connections? (29.Mar.2006 6:37:23 AM)

Is this just too obvious for people to respond or have I not provided enough info?



Archytype -> RE: 8080 Denied Connections? (12.Apr.2006 8:54:21 PM)

Hi there, have a read over the article on the ISA Server 2004 monitoring.

The Live Log can show you which Rule is denying the traffic.

Also, have you modified the SBS Internet Users rule that allows Authenticated users on the Internal Network to access the internet? If your users are not in the SBS Internet Users Group then this rule will deny them access to websites.

PS. You could add in specific User Groups for this rule instead of using the SBS Internet Users group.






ababinchak -> RE: 8080 Denied Connections? (18.Apr.2006 2:53:10 PM)

0xc0040017 FWX_E_TCP_NOT_SYN_PACKET_DROPPED       

This error means that ISA isn't receiving the SYN packet from the site that is requesting access. If the website doesn't play by the rules, then ISA won't allow access to it. It's classic TCP rule violation. Sometimes you'll see these because the session terminated with closing properly. Usually its nothing to worry about. If you have trouble with a particular website associated with this error then you'll have to contact the host of that site and complain.



Cumulus -> RE: 8080 Denied Connections? (18.Apr.2006 4:52:28 PM)

Amy,

Thanks for your reply...

Any idea why is ISA monitoring dosn't report what website the client is trying to connect to?

Tait



Page: [1]