Microsoft KB Archive/326116

= FIX: Cannot Renew DHCP Assigned IP Address on External ISA Interface =

Article ID: 326116

Article Last Modified on 6/14/2007

-

APPLIES TO


 * Microsoft Internet Security and Acceleration Server 2000 Standard Edition
 * Microsoft Internet Security and Acceleration Server 2000 Service Pack 1

-



This article was previously published under Q326116



SYMPTOMS
On a computer running Internet Security and Acceleration Server, where the external interface is configured to have its IP address dynamically assigned from DHCP, you may not be able to renew the IP address on the interface.

For example, if you run ipconfig /release, followed by ipconfig /renew , from a command prompt, you may receive an error message similar to the following:

The following error occurred when renewing adapter MyAdapterName: DHCP Server unreachable

Additionally, you may not be able to turn off and turn on the external network adapter, or to automatically or manually change the assigned IP address on the external network adapter in ISA Server.

This problem also occurs when you have the DHCP Client Static Packet filter turned on in ISA Server.

The only way to renew the IP address is to temporarily turn off packet filtering or restart the computer running ISA Server.



CAUSE
The DHCP Client Static Packet filter only permits you to refresh the already assigned external IP address.

For example, when the DHCP lease has expired and the IP address on the external interface is lost or manually released, a renew of the IP address is blocked by the ISA Server Packet Filter module. The ISA service is not fully Plug and Play when the IP address is released on the external interface. Therefore, packet filtering is still applied to the interface.



RESOLUTION
You must install ISA Server Service Pack 1 (SP1) before you install the following hotfix. For additional information about how to obtain the latest ISA Server service pack, click the article number below to view the article in the Microsoft Knowledge Base:

313139 How to Obtain the Latest Internet Security and Acceleration Server 2000 Service Pack

A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

http://go.microsoft.com/?linkid=6294451

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

To install the fix, run the self-extracting file. You do not have to restart the ISA Server computer. If the computer is part of an ISA Server array, you do not have to shut down the whole array. You can still install this fix on a one-by-one basis.

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. Date         Time    Version        Size      File name

24-Oct-2002  20:21   3.0.1200.179   176,912   Mspadmin.exe 24-Oct-2002  20:20   3.0.1200.179   388,368   W3proxy.exe 24-Oct-2002  20:21   3.0.1200.179   297,232   Wspsrv.exe 24-Oct-2002  20:21   3.0.1200.179    99,600   Msphlpr.dll This fix also applies to the French, German, Spanish, and Japanese versions of ISA Server.



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.



MORE INFORMATION
Note that after you install this hotfix, while you are renewing the DHCP assigned IP address, you may receive an event notice in the Application Event Log similar to the following:

Event Type: Warning

Event Source: Microsoft Firewall

Event ID: 14223

Description:

The description for Event ID (14223) in Source (Microsoft Firewall) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer.

The following information is part of the event:

This event may be logged if some of the packet filters could not be restored when the interface is re-created by using the new IP address. As a result, some active connections may be dropped during the renewal process.

When you release the DHCP assigned IP address, you may also receive an event message similar to the following:

Event Type: Warning

Event Source: Microsoft ISA Server Control

Event Category: Packet filter

Event ID: 15108

Description:

ISA Server detected a spoof attack from Internet Protocol (IP) address 10.10.10.10. A spoof attack occurs when an IP address that is not reachable via the interface on which the packet was received. If logging for dropped packets is set, you can view details in the packet filter log.

For example, this event may appear in the log if the packet filter is currently handling a packet. While you change the IP address on the external adapter, this causes routing table changes in the operating system (OS). Because ISA Server does spoof detection by comparing the interface on which the packet was received to the interface from which a reply to the originating source would be sent, it would consider this to be a spoofed packet if the two interfaces are different.

The following is still not supported after you install this hotfix:
 * If you change the IP address on the internal network adapter, SecureNAT stops functioning.

NOTE: Such changes are rare because in a SecureNAT scenario, the internal IP address of the ISA Server computer should never use DHCP, which must be configured as a gateway on the router or on all computers in the local internal subnet.
 * Dynamic filters for listeners that bind to IP 0.0.0.0 are not opened in the following scenarios:
 * A new external IP is added after the filters for the listener were created.
 * An external network adapter that is not a Routing and Remote Access service demand-dial (that existed when dynamic filters for the listener were created) is turned off, and receives a new IP when it is turned on. The only ISA application filter that opens the listener is the H.323 filter, which opens TCP port 1720 for incoming calls.
 * Local Address Table (LAT) changes that change the status of a network adapter from external to internal, or from internal to external, are not supported. In this case, ISA Management also prompts you to restart the ISA services.

Keywords: kbhotfixserver kbqfe atdownload kbbug kberrmsg kbfix kbisaserv2000presp2fix kbqfe KB326116

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.