Tennessee_Pride
asked on
ISA and DNS
Pre 2k4 build (ISA 2000)
AD domain ------ (internal address: gate = blank) ISA Server(external address : gate = Watchguard)) ------- Watchguard Firewall
DNS...
AD (ISA as forwarder, recursion) <-------> ISA (Stub zone, do not use recursion, forward ti ISP DNS) <-----------> tEh interweb
(DHCP hands out ISA as DNS server AD as secondaries)
Ok..Ive been having random connection issues, during logging ive seen some odd thing. on a RARE occasion DNS timeout, and some packets dropped. I think I may have found ouit what it is but was gonna ask before I proceed. For some reason..when I removed ISA 2k and put in 2k4, DNS was uninstalled from the ISA server. So, AD forwards to ISA that it seems does not have DNS anymore. ShouldI just plop DNS back on and reset my stub zone or, since im in the process, should I redo the whole DNS setup or will it matter. I just dont wanna install DNS and have som M'soft knowdge base come up and bite me in the ass
AD domain ------ (internal address: gate = blank) ISA Server(external address : gate = Watchguard)) ------- Watchguard Firewall
DNS...
AD (ISA as forwarder, recursion) <-------> ISA (Stub zone, do not use recursion, forward ti ISP DNS) <-----------> tEh interweb
(DHCP hands out ISA as DNS server AD as secondaries)
Ok..Ive been having random connection issues, during logging ive seen some odd thing. on a RARE occasion DNS timeout, and some packets dropped. I think I may have found ouit what it is but was gonna ask before I proceed. For some reason..when I removed ISA 2k and put in 2k4, DNS was uninstalled from the ISA server. So, AD forwards to ISA that it seems does not have DNS anymore. ShouldI just plop DNS back on and reset my stub zone or, since im in the process, should I redo the whole DNS setup or will it matter. I just dont wanna install DNS and have som M'soft knowdge base come up and bite me in the ass
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Ok heres how I set it up
Clients (AD is Primary DNS)
|
|
(self primary DNS, forward ISP) AD <-----------------> ISA (AD is primary DNS)
<-------------------------
thats how I set it up now. Ill come back with the 411 after it runs for a bit.
Clients (AD is Primary DNS)
|
|
(self primary DNS, forward ISP) AD <-----------------> ISA (AD is primary DNS)
<-------------------------
thats how I set it up now. Ill come back with the 411 after it runs for a bit.
ASKER
Im still getting some slowness and seeing entries in logging like this (using my ip as a filter)
8080 http proxy Closed Connection 0x80074e21 FWX_E_ABORTIVE_SHUTDOWN
also port 8080 denied 0xc0040017 FWX_E_TCP_NOT_SYN_PACKET_D
and still strange DNS (port 53) timeout me as client and ISA as destination when all I have is AD as my DNS. Ill give it some time and get some user reactions
8080 http proxy Closed Connection 0x80074e21 FWX_E_ABORTIVE_SHUTDOWN
also port 8080 denied 0xc0040017 FWX_E_TCP_NOT_SYN_PACKET_D
and still strange DNS (port 53) timeout me as client and ISA as destination when all I have is AD as my DNS. Ill give it some time and get some user reactions
lol, just realised whose post this was; hello again :)
Yes. If you think abot it, ISA has no real reason to need to ask for dns resolution itself. It can use the same DNS resolvers as the clients do; your internal DNS servers.
port 8080 denied 0xc0040017 FWX_E_TCP_NOT_SYN_PACKET_D
This error is saying that a packet hit the ISA server that was not part of an existing conversation and therefore it was dropped. This can be caused in a number of ways although this is not an exhaustive list by any means....
1. You have set your internal networks in the local lat but not included all of them. For example, the internal lat MUSt be made up of classful subnets ie 10.1.5.0-10.1.5.255. you can't have 10.1.5.1 - 10.1.5.254. ISA will then think that 10.1.5.0 and 10.1.5.255 are external and will behave a little peculiarly.
2. ISA is doing its job. In the GUI, select configuration - general - Enable intrusion detection and there are other checks you an enable/disable.
Cheers
keith
Yes. If you think abot it, ISA has no real reason to need to ask for dns resolution itself. It can use the same DNS resolvers as the clients do; your internal DNS servers.
port 8080 denied 0xc0040017 FWX_E_TCP_NOT_SYN_PACKET_D
This error is saying that a packet hit the ISA server that was not part of an existing conversation and therefore it was dropped. This can be caused in a number of ways although this is not an exhaustive list by any means....
1. You have set your internal networks in the local lat but not included all of them. For example, the internal lat MUSt be made up of classful subnets ie 10.1.5.0-10.1.5.255. you can't have 10.1.5.1 - 10.1.5.254. ISA will then think that 10.1.5.0 and 10.1.5.255 are external and will behave a little peculiarly.
2. ISA is doing its job. In the GUI, select configuration - general - Enable intrusion detection and there are other checks you an enable/disable.
Cheers
keith
ASKER
works for me...and..thanks again
Welcome :)
regards
Keith
regards
Keith
ASKER
So. I could uninstall DNS out if ISA, have the AD boxes do all the resolution (they all point to themselves as primary)...what..just change the forwarders to the external ISP DNS on the AD sytems?