Error 10060 Connection Timeout on one particular website
We are running ISA Server 2004 on windows Small Business Server 03. When our users try to access www.nsrp.org the gateway give a timeout error 10060. This is the only site that this happens with as of now.
The site works fine from a verizon air card and from my home computer
ISA LOG ERROR:
Failed Connection Attempt SBSRV 4/23/2008 10:54:09 AM
Log type: Web Proxy (Forward)
Status: 10060 A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
Rule: Allow Outbound Protocols
Source: Internal ( 172.20.0.155:0)
Destination: External ( 147.120.13.47:80)
Request: GET http://www.nsrp.org/
Filter information: Req ID: 1c40144c
Protocol: http
User: anonymous
Additional information
Client agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; InfoPath.2; InfoPath.1)
Object source: Internet Processing time: 20921
Cache info: 0x0 MIME type:
Web Browser Error Code
Error Code 10060: Connection timeout
Background: The gateway could not receive a timely response from the website you are trying to access. This might indicate that the network is congested, or that the website is experiencing technical difficulties.
Date: 4/23/2008 2:54:09 PM
Server: sbsrv.RLWINC.inner
Source: Firewall
The site works fine from a verizon air card and from my home computer
ISA LOG ERROR:
Failed Connection Attempt SBSRV 4/23/2008 10:54:09 AM
Log type: Web Proxy (Forward)
Status: 10060 A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
Rule: Allow Outbound Protocols
Source: Internal ( 172.20.0.155:0)
Destination: External ( 147.120.13.47:80)
Request: GET http://www.nsrp.org/
Filter information: Req ID: 1c40144c
Protocol: http
User: anonymous
Additional information
Client agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; InfoPath.2; InfoPath.1)
Object source: Internet Processing time: 20921
Cache info: 0x0 MIME type:
Web Browser Error Code
Error Code 10060: Connection timeout
Background: The gateway could not receive a timely response from the website you are trying to access. This might indicate that the network is congested, or that the website is experiencing technical difficulties.
Date: 4/23/2008 2:54:09 PM
Server: sbsrv.RLWINC.inner
Source: Firewall
ASKER
We have a T1's through D& E communications but it runs over verizon lines. Here is the tracert:
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.
C:\Documents and Settings\DAitkins>tracert www.nsrp.org
Tracing route to www.nsrp.org [147.120.13.47]
over a maximum of 30 hops:
1 3 ms 1 ms 1 ms 216.169.164.33
2 6 ms 6 ms 5 ms cbl172149.sce.ceinetworks.
3 6 ms 6 ms 6 ms ctt191003.ceinetworks.com [216.169.191.3]
4 7 ms 6 ms 6 ms ctt191101.ceinetworks.com [216.169.191.101]
5 13 ms 13 ms 13 ms ewr-edge-01.inet.qwest.net
6 12 ms 13 ms 14 ms ewr-core-01.inet.qwest.net
7 12 ms 13 ms 13 ms ewr-brdr-01.inet.qwest.net
8 20 ms 20 ms 21 ms po2-0.core01.ewr02.atlas.c
.77]
9 20 ms 20 ms 20 ms po6-0.core01.jfk01.atlas.c
145]
10 21 ms 20 ms 21 ms po12-0.core01.jfk02.atlas.
10]
11 21 ms 20 ms 20 ms te3-2.mpd03.jfk02.atlas.co
38]
12 20 ms 20 ms 20 ms te3-1.ccr01.phl01.atlas.co
09]
13 20 ms 20 ms 20 ms te8-2.ccr02.dca01.atlas.co
6]
14 33 ms 32 ms 32 ms te3-3.ccr01.clt01.atlas.co
42]
15 41 ms 36 ms 35 ms 38.104.168.30
16 37 ms 37 ms 37 ms 165.166.22.73
17 106 ms 208 ms 199 ms GigE-4-3.7600.scclma.infoa
18 36 ms 35 ms 35 ms clmasc-pal-bb1-gi-4-0.scan
.47.26]
19 41 ms 41 ms 42 ms chtnsclb-cbr1-sr1-1.scanac
111.129.6]
20 * * * Request timed out.
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 * * * Request timed out.
26 * * * Request timed out.
27 * * * Request timed out.
28 * * * Request timed out.
29 * * * Request timed out.
30 * * * Request timed out.
Trace complete.
C:\Documents and Settings\DAitkins>
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.
C:\Documents and Settings\DAitkins>tracert www.nsrp.org
Tracing route to www.nsrp.org [147.120.13.47]
over a maximum of 30 hops:
1 3 ms 1 ms 1 ms 216.169.164.33
2 6 ms 6 ms 5 ms cbl172149.sce.ceinetworks.
3 6 ms 6 ms 6 ms ctt191003.ceinetworks.com [216.169.191.3]
4 7 ms 6 ms 6 ms ctt191101.ceinetworks.com [216.169.191.101]
5 13 ms 13 ms 13 ms ewr-edge-01.inet.qwest.net
6 12 ms 13 ms 14 ms ewr-core-01.inet.qwest.net
7 12 ms 13 ms 13 ms ewr-brdr-01.inet.qwest.net
8 20 ms 20 ms 21 ms po2-0.core01.ewr02.atlas.c
.77]
9 20 ms 20 ms 20 ms po6-0.core01.jfk01.atlas.c
145]
10 21 ms 20 ms 21 ms po12-0.core01.jfk02.atlas.
10]
11 21 ms 20 ms 20 ms te3-2.mpd03.jfk02.atlas.co
38]
12 20 ms 20 ms 20 ms te3-1.ccr01.phl01.atlas.co
09]
13 20 ms 20 ms 20 ms te8-2.ccr02.dca01.atlas.co
6]
14 33 ms 32 ms 32 ms te3-3.ccr01.clt01.atlas.co
42]
15 41 ms 36 ms 35 ms 38.104.168.30
16 37 ms 37 ms 37 ms 165.166.22.73
17 106 ms 208 ms 199 ms GigE-4-3.7600.scclma.infoa
18 36 ms 35 ms 35 ms clmasc-pal-bb1-gi-4-0.scan
.47.26]
19 41 ms 41 ms 42 ms chtnsclb-cbr1-sr1-1.scanac
111.129.6]
20 * * * Request timed out.
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 * * * Request timed out.
26 * * * Request timed out.
27 * * * Request timed out.
28 * * * Request timed out.
29 * * * Request timed out.
30 * * * Request timed out.
Trace complete.
C:\Documents and Settings\DAitkins>
hmm, okay so it definately leaves your network. I don't think it is an ISA issue.
I have tested the site on 2 different ISPs here (in Canada).
Both of them fail, both of the tracert stop at the same host as yours.
12 62 ms 59 ms 59 ms chtnsclb-cbr1-sr1-1.scanac
111.129.6]
I cannot access it via my blackberry either.
It appears the problem is with the nsrp.org site itself, or their ISP.
I suspect that the verizon air card works because of a verizon proxy server, local cache on that pc, or possibly because the site is on the verizon network and it is just external clients that are affected.
I have tested the site on 2 different ISPs here (in Canada).
Both of them fail, both of the tracert stop at the same host as yours.
12 62 ms 59 ms 59 ms chtnsclb-cbr1-sr1-1.scanac
111.129.6]
I cannot access it via my blackberry either.
It appears the problem is with the nsrp.org site itself, or their ISP.
I suspect that the verizon air card works because of a verizon proxy server, local cache on that pc, or possibly because the site is on the verizon network and it is just external clients that are affected.
is your home ISP also verizon?
ASKER
One more thing to note, i spoke with the guys at D & E and they said they could access the site from over there.
ASKER
I have verizon DSL at my house
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Here is what there support personnel are saying:
I have attached the traceroute taken from our internet connection in Ephrata (which is different then our pipe in State College). While the site does not accept pings and the traceroute timesout I can still get to the website. This is not unsual. I have attached the screenshot of the website.
I checked our DNS servers and we're not having any trouble resolving the name. When you try to ping it, are you able to resolve the name to an IP? When you try to resolve it, if it goes to 147.120.13.47 then it should be ok. If you show a different IP, you'll need to check your DNS servers and make sure they're not caching old data.
There traceroute:
Tracing route to www.nsrp.org [147.120.13.47]
over a maximum of 30 hops:
1 2 ms 1 ms 1 ms 10.219.5.2
2 <10 ms <10 ms <10 ms 10.202.1.9
3 <10 ms <10 ms <10 ms 10.207.1.12
4 <10 ms <10 ms <10 ms 66.109.238.249.static.deja
9]
5 1 ms 1 ms 1 ms 66.109.238.177.static.deja
7]
6 9 ms 9 ms 9 ms dcp-edge-01.inet.qwest.net
7 9 ms 9 ms 15 ms dcx-core-02.inet.qwest.net
8 9 ms 9 ms 9 ms dcp-brdr-01.inet.qwest.net
9 9 ms 9 ms 9 ms gi7-16.ccr02.iad01.atlas.c
.137]
10 10 ms 9 ms 9 ms te8-4.mpd01.dca02.atlas.co
61]
11 10 ms 10 ms 10 ms vl3493.ccr02.dca01.atlas.c
229]
12 24 ms 24 ms 24 ms te3-3.ccr01.clt01.atlas.co
42]
13 28 ms 27 ms 27 ms 38.104.168.30
14 28 ms 28 ms 31 ms 165.166.22.73
15 28 ms 27 ms 27 ms gige-4-3.7600.scclma.infoa
16 27 ms 27 ms 27 ms clmasc-pal-bb1-gi-4-0.scan
.47.26]
17 32 ms 33 ms 32 ms chtnsclb-cbr1-sr1-1.scanac
111.129.6]
18 * * * Request timed out.
19 * * * Request timed out.
20 * * * Request timed out.
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 * * * Request timed out.
26 * * * Request timed out.
27 * * * Request timed out.
28 * * * Request timed out.
29 * * * Request timed out.
30 * * * Request timed out.
Trace complete.
I have attached the traceroute taken from our internet connection in Ephrata (which is different then our pipe in State College). While the site does not accept pings and the traceroute timesout I can still get to the website. This is not unsual. I have attached the screenshot of the website.
I checked our DNS servers and we're not having any trouble resolving the name. When you try to ping it, are you able to resolve the name to an IP? When you try to resolve it, if it goes to 147.120.13.47 then it should be ok. If you show a different IP, you'll need to check your DNS servers and make sure they're not caching old data.
There traceroute:
Tracing route to www.nsrp.org [147.120.13.47]
over a maximum of 30 hops:
1 2 ms 1 ms 1 ms 10.219.5.2
2 <10 ms <10 ms <10 ms 10.202.1.9
3 <10 ms <10 ms <10 ms 10.207.1.12
4 <10 ms <10 ms <10 ms 66.109.238.249.static.deja
9]
5 1 ms 1 ms 1 ms 66.109.238.177.static.deja
7]
6 9 ms 9 ms 9 ms dcp-edge-01.inet.qwest.net
7 9 ms 9 ms 15 ms dcx-core-02.inet.qwest.net
8 9 ms 9 ms 9 ms dcp-brdr-01.inet.qwest.net
9 9 ms 9 ms 9 ms gi7-16.ccr02.iad01.atlas.c
.137]
10 10 ms 9 ms 9 ms te8-4.mpd01.dca02.atlas.co
61]
11 10 ms 10 ms 10 ms vl3493.ccr02.dca01.atlas.c
229]
12 24 ms 24 ms 24 ms te3-3.ccr01.clt01.atlas.co
42]
13 28 ms 27 ms 27 ms 38.104.168.30
14 28 ms 28 ms 31 ms 165.166.22.73
15 28 ms 27 ms 27 ms gige-4-3.7600.scclma.infoa
16 27 ms 27 ms 27 ms clmasc-pal-bb1-gi-4-0.scan
.47.26]
17 32 ms 33 ms 32 ms chtnsclb-cbr1-sr1-1.scanac
111.129.6]
18 * * * Request timed out.
19 * * * Request timed out.
20 * * * Request timed out.
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 * * * Request timed out.
26 * * * Request timed out.
27 * * * Request timed out.
28 * * * Request timed out.
29 * * * Request timed out.
30 * * * Request timed out.
Trace complete.
I can confirm that the site is now up from all three ISP's and my blackberry.
At the very least it seems to be intermittent. Can you now connect from yoru SBS network?
At the very least it seems to be intermittent. Can you now connect from yoru SBS network?
ASKER
I get the same darn error code each time but i can get to it from my windows mobile device. Im baffled at this point.
hmm, can we try to isolate ISA?
Is it possible for you to connect a computer in front of ISA so that we can tell if it is ISA or ISP?
Is it possible for you to connect a computer in front of ISA so that we can tell if it is ISA or ISP?
ASKER
ok i plugged it in infront of ISA and it still cannot be found. Took a screen shot of the error and my settings to send to D & E thanks for the help.
great, it is probably a routing issue on their end.
I recently ran into the same erorr running ISA Sever 2006 Standard Edition. It really led us on a wild goose chance since every time we bypassed ISA it seemed that the error corrected itself. As dumb luck would have it, it only appeared that ISA was the issue. In fact, ISA wasn't the problem whatsoever. The issue turned out to be the firewall that we were using. It was a Cisco ASA 5505 that was only licensed for 10 users/hosts - We were under the impression it was a 50 user. So, when the firewall maxed out on connections ISA would choke and kick up the 10060 error. However, in our situation it was every site we tried to access through ISA. Again, some workstations got through, some didn't. Just wanted to share in the event someone ran into a similar issue.
Is your company ISP also Verizon? Different ISP's can have different routes/backbone access/dns. It is possible for a site to be unreachable from one ISP and not another.