hi folks
i got a strange problem. i thought i could PING NLB-enabled ISA servers after stopping their FWSRV service, but actually not.
basic system information of the ISA servers:
W2K3R2 Standard in Hyper-V
512MB
4 NICs with 4 dedicated IPs (1 x external facing, 3 x internal facing)
NLB enabled on all NICs on IGMP multicast mode
additional 17 VIPs assigned to the 4 NICs (10 + 1 + 3 + 3)
ISA 2006 Enterprise with SP1 and Supportability Update
Back Firewall template with Block All
outgoing DNS/HTTP/HTTPS/NTP/PING traffic is allowed
NOTE: ISA Integrated NLB is not used as it does not support NLB on all adapters with IGMP multicast, WLBS used instead.
the network connection is OK as i can use ARP -A to see their MAC addresses though i could not PING the IPs
any clues? many thanks for any input.
kind regards,
bbao
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Its not a problem - it is by design. Stopping the services means exactly that. ISA has a system policy (not firewall policy) that says whether to allow icmp traffic from internal to the localhost (isa box) so if you stop the services you also stop the access. removing ISA would allow the connections OK - stopping the services stops ISA from being operational however the dll's, the configs etc are all expecting ISA to be running.
Keith
hi Keith
you are right, it is by design - a very good design.
i have actually already found the way to unlock ISA lockdown mode: NET STOP FWENG /Y.
this command will open the ISA server to all network traffic by stopping the Firewall Engine which runs in kernel mode of W2K3. the engine is a kernel-mode driver (fweng.sys) "which is called whenever network traffic arrives or leaves an ISA server network interface and modifies it if necessary."
this command will automatically stop the upper-layer Firewall Service, so NET STOP FWSRV is not necessary.
i found the above information from a MS white paper "ISA Server 2006 Firewall core", the best MS document i ever read - clear, informative, and accurate.
regards,
bbao
FYI
ISA Server 2006 Firewall Core
http://www.microsoft.com/i
hi Keith,
do you mind that i accept my second comment as the answer as i would like to PAQ this question. i believe this would help others who intend to hear the heartbeat after killing the ISA server. :-)
i tried to share points to you by accepting multiple solutions, but EE did not allow me to choose my comment in this way...
thanks for your kind help,
regards,
bbao
Business Accounts
Answer for Membership
by: bbaoPosted on 2008-09-09 at 02:13:47ID: 22425380
just an update:
i just did a test on another stand-alone ISA server and got the same problem. no PING. it seems the stopped ISA server has been locked down.
i also found the following from MS TechNet site:
"2. Put the ISA Server firewall in LOCKDOWN mode, by stopping the Microsoft Firewall service. At a command prompt, type net stop fwsrv."
Troubleshooting networking issues
http://www.microsoft.com/t
the ISA servers are now in LOCKDOWN mode?? if so, how to unlock in turn to allow any incoming and outgoing traffic as before?
regards,
bbao