I'm trying to create a new dmz setup with our ISA 2004 setup towards the internal Win2k3 network. I'm running ISA2004 SP3 on Win2K3 SP2.
The problem which I've been investigating for one and a half day now is that I can't get a member server in the domain to get a full domain connection to the AD hosts in the internal lan.
The member server is an freshly installed 2k3 sp2 box and it's already part of the domain. I configured the network rules to route back and forth from the internal network to the DMZ. I've created an access rule from DMZ outbound to Internal with the following protocols:
Whit this rule in place I almost have full access to the domain, I can browse shares, ping, query the dns but I can't get it to apply my GPO's. Whenever I try to perform a gpupdate I'll end up with an RPC (All interfaces) denied message.
I've tried to disable strict RPC rules, I've disabled the filter, I addedd the RSS disable reg entry as wel as the TCP ofload entries. I also added the Server2003NegotiateDisable key. None were successfull.
In the end I created a Allow all rule and disabled the RPC filter alltogether. After a reboot the access rule worked, however the moment I edit the rule ie adding the right ports the rule stops functioning an I need to start all over again rebooting the server to get it to accept the rule.
Currently I'm stuck, do any of you guys have a clue?
Thanks for your feedback. The post has been helpfull and did prove somewhat usefull. After implementing the fixed port 50000 as suggested, the Gpupdate works 6 out of 10 times, during the other times I'm still seeing a lot of these errors:
Log type: Firewall service Status: A non-SYN packet was dropped because it was sent by a source that does not have an established connection with the ISA Server computer. Rule: Source: DMZ ( 172.16.1.2:1151) Destination: Internal ( 10.10.3.1:135) Protocol: RPC (all interfaces) User:
I've done my research and the most common cause is SP2 with the scalable net pack. I've implemented the RSS and offloading tweaks and also updated my nic drivers. Unfortunately with out the required result.
Update: Sometimes I feel like a complete noob... I seems that removing the IPv6 Binding from my W2K8 DMZ member server resolved the issue.
< Message edited by superprutser -- 3.Jul.2008 6:28:43 AM >