Posted on 2006-03-27
Last Modified: 2013-11-16
Pre 2k4 build (ISA 2000)

AD domain ------ (internal address: gate = blank) ISA Server(external address : gate = Watchguard)) ------- Watchguard Firewall


AD (ISA as forwarder, recursion) <-------> ISA (Stub zone, do not use recursion, forward ti ISP DNS) <-----------> tEh interweb
     (DHCP hands out ISA as DNS server AD as secondaries)

Ok..Ive been having random connection issues, during logging ive seen some odd thing. on a RARE occasion DNS timeout, and some packets dropped. I think I may have found ouit what it is but was gonna ask before I proceed. For some reason..when I removed ISA 2k and put in 2k4, DNS was uninstalled from the ISA server. So, AD forwards to ISA that it seems does not have DNS anymore. ShouldI just plop DNS back on and reset my stub zone or, since im in the process, should I redo the whole DNS setup or will it matter. I just dont wanna install DNS and have som M'soft knowdge base come up and bite me in the ass
Question by:Tennessee_Pride
    LVL 51

    Accepted Solution

    This is just a suggestion but it has worked on all of my ISA installs. I do not use DNS on ISA2004. Ever. (ISA2000 was different of course). I point the internal ISA NIC at the AD DNS servers so that the AD boxes perform the DNS requests on ISA's behalf. ISA2004 is then told to allow DNS to pass out to the ISP dns servers or to a dns server (if you have one) in the DMZ/perimeter.

    ISA2004 does not require DNS installed but it does not uninstall DNS so not quite sure what would have happened there.

    Let me know if you want more info; I can talk on this for hours.

    Author Comment

    I just didnt uninstall DNS console didnt like to connect to it. I redid my DNS conbsole on my machine and it worked. I was just all confusified.
    So. I could uninstall DNS out if ISA, have the AD boxes do all the resolution (they all point to themselves as primary)...what..just change the forwarders to the external ISP DNS on the AD sytems?

    Author Comment

    Ok heres how I set it up

                                                                  Clients (AD is Primary DNS)
                   (self primary DNS, forward ISP)  AD  <-----------------> ISA (AD is primary DNS)
                                                                        <-----------------------------------> Internet

    thats how I set it up now. Ill come back with the 411 after it runs for a bit.

    Author Comment

    Im still getting some slowness and seeing entries in logging like this (using my ip as a filter)

    8080      http proxy      Closed Connection            0x80074e21 FWX_E_ABORTIVE_SHUTDOWN

    also port 8080 denied 0xc0040017 FWX_E_TCP_NOT_SYN_PACKET_DROPPED
    and still strange DNS (port 53) timeout me as client and ISA as destination when all I have is AD as my DNS. Ill give it some time and get some user reactions
    LVL 51

    Expert Comment

    by:Keith Alabaster
    lol, just realised whose post this was; hello again :)

    Yes. If you think abot it, ISA has no real reason to need to ask for dns resolution itself. It can use the same DNS resolvers as the clients do; your internal DNS servers.

    port 8080 denied 0xc0040017 FWX_E_TCP_NOT_SYN_PACKET_DROPPED

    This error is saying that a packet hit the ISA server that was not part of an existing conversation and therefore it was dropped. This can be caused in a number of ways although this is not an exhaustive list by any means....

    1. You have set your internal networks in the local lat but not included all of them. For example, the internal lat MUSt be made up of classful subnets  ie you can't have - ISA will then think that and are external and will behave a little peculiarly.

    2. ISA is doing its job. In the GUI, select configuration - general - Enable intrusion detection and there are other checks you an enable/disable.


    Author Comment

    works for me...and..thanks again
    LVL 51

    Expert Comment

    by:Keith Alabaster
    Welcome :)

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Join & Write a Comment

    Wikipedia defines 'Script Kiddies' in this informal way: "In hacker culture, a script kiddie, occasionally script bunny, skiddie, script kitty, script-running juvenile (SRJ), or similar, is a derogatory term used to describe those who use scripts or…
    If you are like regular user of computer nowadays, a good bet that your home computer is on right now, all exposed to world of Internet to be exploited by somebody you do not know and you never will. Internet security issues has been getting worse d…
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
    Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

    734 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    24 Experts available now in Live!

    Get 1:1 Help Now