Event ID 14120 - The ISA server Services Cannot create a packet filter

We are using a single windows 2000SBS and exchange for the past couple of years. Everything has been working fine until this morning. I have looked in the Event Application Log and notice that we are getting hundreds of the same error listing every couple of seconds. The error reads :-

Event ID 14120
The ISA Server Services cannot create a packet filter

The issue which drew my attention to this was that we could not send out any e-mail. E-mail was being received OK. I have resolved this issue, by re setting the SMTP mail server location within the SMTP connector, but the error messages described above continue to register.

I have seen a few postings here which talk of 2 network cards etc, but this is a problem which has just occured having been working fine for months. Everything seems to be working OK, but I don't like all of these messages springing up from nowhere!

Does anone have any ideas where to start?
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Keith AlabasterEnterprise ArchitectCommented:
What version f ISA are you running? If you are on sbs and have had the same setup for years I assume it is isa2000?

The error is telling you that the 'link' / binding to the external nic has become corrupted. You are correct regarding the two cards/one card issue generating the message but it does not just mean that it will occur if you have one card installed. If the second card is not visible/accessible to ISA then the symptoms are the same. ie ISA server installed in integrated mode but with only one network card being seen.

Have you 'played with' or amended with the ISA configuration?
If you have added the IP addresses that are on the external nic & subnet to the internal Local address table (LAT) then ISA will also see this as a single network card installation. For example, i have seen people try to bridge their internal lan by either having the same IP address on both the internal and external isa nics oe by on the internal and on the external. Laughable but they do try it. These situations could also cause that error message.

Have you changed the config of your network at all? Remember the internal local address table can have ONLY the ip addresses that are contactable through the internal nic. Anything on or addressable through the external nic must NOT be listed.
Do a route print on the SBS server. Does it correspond to your LAT entries?

Should do for starters.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
nigelbeatsonAuthor Commented:
I would like to check the ISA config, but cannot see any utilities to enable me to do so. I suppose what I am saying is - how do we look at / change the ISA config?

This is only a single NIC configuration, and no one has made any changes to the network recently (as far as we can know).

How can we check the LAT, to ensure no other external listings are registered?

I think the theory that something has become corrupt would be the best guess here, as the customer knows less than I do, and he would not attempt to make this kind of change. Can the ISA and LAT be verified in any way?

I am not on site, as I write, but will check the route print info when there.
Keith AlabasterEnterprise ArchitectCommented:
In the start - program files you should see the entry for ISA server.
nigelbeatsonAuthor Commented:
Sorry for the delay, been on holiday.

Strangely upon my return, the problem had cleared, thanks for your help, the points are yours anyway!

Regards, Nigel.
Keith AlabasterEnterprise ArchitectCommented:
lol - it happens - thanks Nigel
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Forefront ISA Server

From novice to tech pro — start learning today.