Intermittent Timeouts browsing? (Full Version)

All Forums >> [ISA 2006 Firewall] >> HTTP Filtering



Message

CSDAdmin -> Intermittent Timeouts browsing? (6.Jun.2008 2:07:57 PM)

Anyone else have issue with ISA where the page will hang loading, as soon as you hit refresh or hit enter again on url, the page will load?

It is especially bad on sites like facebook where ajax scripts try to submit information.

When i uncheck proxy, the site works fine, when i proxy through ISA it has a lot of trouble.

Anyone know how to even troubleshoot this?



paulo.oliveira -> RE: Intermittent Timeouts browsing? (6.Jun.2008 4:57:04 PM)

Hi,

is your rule configured to allow only authenticated users? Maybe thats the "problem", because some websites, like bank sites, donīt work well when the proxy server is configured to ask for authentication. These type of applications are being processed by the webproxy but are not passing all the info webproxy expects from an IE or other compliant web browser.

It explains why works when you remove the proxy setting from the browser and access the website as secureNAT (assuming the ISA is the default gateway).

Check ISA logs to make sure if thereīs an error.

Regards,
Paulo Oliveira.



Jason Jones -> RE: Intermittent Timeouts browsing? (6.Jun.2008 6:37:47 PM)

Make sure you are running the ISA2k6 supportability update and maybe consider installing the April 2008 hotfix package.

Run ISA Best Practice Analyser (BPA) and check for problems with MTU size (amongst others).

Make sure the IE browers are configured to use HTTP 1.1 and HTTP 1.1 via proxy.

Cheers

JJ



CSDAdmin -> RE: Intermittent Timeouts browsing? (9.Jun.2008 9:57:03 AM)

The 1.1 is allowed through proxy connections, looking at the ISA server.

The HTTP Proxy Connection keeps initiating and closing.

The log shows:
Open HTTP Proxy at 172.20.0.103:1282
Http traffic allowed
Close HTTP Proxy
Http Denied traffic (the timeout i suspect)
Open HTTP Proxy at 172.20.0.103:1283
and so on.

There seems to be gaps in the proxy connection where http traffic is denied.
ISA BPA is fine, the hotfix is being downloaded now.

As far as forced authentication, it is not set in the network section to connect to proxy, it is set in the rule allowing http out (authenticated users only).

Have an AD domain with proxy set as a domain policy, so all:
Internet Explorer - connection to proxy set, login information sent
Safari - connection to proxy is IE's so set, login is requested
Firefox - Ignores group policy, manually set to use proxy, login is requested.

All three do authenticate though.



Jason Jones -> RE: Intermittent Timeouts browsing? (9.Jun.2008 11:26:10 AM)

quote:

ORIGINAL: CSDAdmin

The 1.1 is allowed through proxy connections, looking at the ISA server.



How about your clients?



CSDAdmin -> RE: Intermittent Timeouts browsing? (11.Jun.2008 3:25:37 PM)

bad spacing on my part to re-iterate from previous post:

http1.1 through proxy is enabled on client,

looking at server these logs were:
etc..



Page: [1]