Microsoft KB Archive/838706

= Cannot connect to a service from a particular client computer in ISA Server 2004 =

Article ID: 838706

Article Last Modified on 12/4/2007

-

APPLIES TO


 * Microsoft Internet Security and Acceleration Server 2004 Standard Edition
 * Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition

-



SYMPTOMS
A program that is running on a client computer may not be able to connect to a service through Microsoft Internet Security and Acceleration (ISA) Server 2004. In this scenario, the client program may crash or may stop responding (hang). Additionally, the following events may be logged in the Application log in Event Viewer on the ISA Server computer: Event Source: Microsoft Firewall

Event Category: Packet filter

Event ID: 15113

Date:

Time:

Type: Warning

User: N/A

Computer:

Description: ISA Server disconnected the following client:  because its connection limit was exceeded.

Event Source: Microsoft Firewall

Event Category: Packet filter

Event ID: 15112

Description: The client 10.93.1.108 exceeded its connection limit. The new connection was rejected.



CAUSE
This behavior may occur if the computer that the client program is running on has exceeded the number of concurrent connections that ISA Server 2004 allows. ISA Server 2004 implements a connection limit (also known as a quota) mechanism. By default, the number of concurrent connections is limited to 160 for each client computer. If a client computer reaches this connection limit, ISA Server 2004 implements one of the following connection limit mechanisms:
 * For User Datagram Protocol (UDP) connections, if a client program reaches this connection limit, any additional UDP connections cause a previous UDP connection to be dropped.
 * For Transmission Control Protocol (TCP) connections, if a client program reaches this connection limit, no additional connections are permitted.

This functionality is included in ISA Server 2004 to help prevent one particular computer from overloading the ISA Server computer with connections.



RESOLUTION
For information about setting connection limits and about how to troubleshoot this issue, visit the following Microsoft Web site:

Deployment Recommendations for Connection Limits in ISA Server 2004

http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/connectionlimits.mspx



MORE INFORMATION
This behavior occurs on SecureNAT clients and on Microsoft Firewall clients (Web proxy clients appear as SecureNAT client TCP connections to ISA in this respect). This behavior is particularly noticeable if you use a perimeter network (also known as a DMZ, a demilitarized zone, and a screened subnet) with back-to-back ISA Server computers.

If you run your ISA Server computers back-to-back to create a perimeter network, you are more likely to experience this behavior. The internal ISA Server computer translates all the internal clients by using the NAT protocol. The frames are sent to the external ISA Server computer, and this computer uses the NAT protocol to translate all the internal clients again. To the external ISA Server computer, all the connections look similar to one client. The connections use the perimeter network IP address of the internal ISA Server computer. Therefore, to the external ISA Server computer, 40 internal clients look similar to 1 client that has 40 different connections.

Additional query words: timeout, time out, page cannot be displayed

Keywords: kbfirewall kbenv kbeventlog kbprb kbnat KB838706

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.