My company is having lots of problems connecting to https sites. Lots of failed connection errors, resulting in really slow SSL sessions.
In the ISA 2004 logs I can see error msgs with :-
995 The I/O operation has been aborted because of either a thread exit or an application request.
I've tried increasing the connection limits to 200, installing sp3, checking dns settings, and reset the isa cache
A sample log is below.
Original Client IP Client Agent Authenticated Client Service Server Name Referring Server Destination Host Name Transport MIME Type Object Source Source Proxy Destination Proxy Bidirectional Client Host Name Filter Information Network Interface Raw IP Header Raw Payload Source Port Processing Time Bytes Sent Bytes Received Result Code HTTP Status Code Cache Information Error Information Log Record Type Log Time Destination IP Destination Port Protocol Action Rule Client IP Client Username Source Network Destination Network HTTP Method URL
0.0.0.0 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 1.0.3705; .NET CLR 2.0.50727) No Proxy ISA_SERVER s12.projectcentre.net TCP Internet - - - Req ID: 0572cb53 - - - 0 0 895 777 995 The I/O operation has been aborted because of either a thread exit or an application request. 0x0 0x8 Web Proxy Filter 22/01/2008 10:15 202.51.175.12 443 SSL-tunnel Failed Connection Attempt Web Outbound 192.168.10.30 anonymous Internal External s12.projectcentre.net:443
The ISA box's roles are firewall//gateway whilst the web proxy (192.168.10.30) has Webmarshal installed and another server acts as the dns server
Any ideas?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
GL Computing thanks for your suggestion.
However, all users are able to access websites, but intermittently HTTPS websites (such as banking, etc) are very slow and simultaneously generate error isa 2004 errors consisting of ->
995 The I/O operation has been aborted because of either a thread exit or an application request.
DNS is fine, tried sp3 on ISA 2004, increasing connection limit, bypassing cache for https.
Any other ideas??
At first glance this solution does not appear relevant as the problem description is very different as all my users can access the internet, but intermittantly https performance is poor .
Further research shows that this may work for similar situations as mine, but you didn't make this link. For future reference I would probably suggest a line stating how that solution would address my problem.
Thanks....
Although the solution GL_Computing posted has a different problem scenario, further research that I undertook showed that some java on https sites requires anonymous/basic authentication and because ISA cannot read the layer 5 session a failure is generated without much detail eg a generic status code 995.
I haven't tested this solution yet but from what I've found it would seem to work -->
http://forums.isaserver.or
So, I will create an Unauthenticated Outbound rule for https with the https sites in a new domain set and if it doesn't work, then I'll add a remark here.
Failed Connection Attempt
Log type: Web Proxy (Forward)
Status: 995 The I/O operation has been aborted because of either a thread exit or an application request.
Rule: Internet-Access
Source: Internal (10.1.47.90)
Destination: External (65.54.166.122:443)
Request: support.microsoft.com:443
Filter information: Req ID: 0a9cc57e; Compression: client=No, server=No, compress rate=0% decompress rate=0%
Protocol: SSL-tunnel
User: anonymous
Additional information
Client agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648)
Object source: Internet (Source is the Internet. Object was added to the cache.)
Cache info: 0x0
Processing time: 0 ms
MIME type:
Any solution?
The best way to handle the Java, assuming you mean actually Java (requiring the JRE) and not simply Java Script, is to set the JRE using the Control Panel Applet to never use a proxy,..use a Direct Connection,...and then install the ISA Firewall Client on the machine. The the Firewall Client will handle the authentication between the Client and the ISA and the JRE will be oblivious to that happening and will remain "happy".
My only suggestions for other syptoms would be:
1. Turn off the Compression Filter in the ISA MMC.
2. Make sure that the Active Directory DNS/DC is the only DNS used,...that nothing at all anywhere,...is using any other DNS. Then use the ISP as a Forwarder in the config of the DNS service on the DNS/DC machine.
3. Make sure on the ISA that the only nic that has DNS is the Internal Nic and that it only points to the AD/DNS/DC. The External nic on the ISA should have blank DNS specs.
4. Make sure that the ISA only has a Default Gateway on the External Nic. The DFG must be blank on all other interfaces.
Business Accounts
Answer for Membership
by: GLComputingPosted on 2008-01-22 at 10:19:17ID: 20716602
Try this:
http://www.microsoft.com/t
in the section:
Allow Anonymous Access to Specific Sites
Problem: Some users cannot access the Internet.
Cause: Require all users to authenticate is enabled on the network listening for Web requests from users, so all user requests must be authenticated. Requests from users unable to authenticate (for example users who are not members of a domain, or client computers configured as SecureNAT clients) are denied.
Solution: Disable Require all users to authenticate. Instead, require authentication on access rules to sites to which you want to limit access. On sites for which you want to allow anonymous access, specify that rules should apply to All Users.