Microsoft KB Archive/292018

= Slow Response from Downstream ISA Server Using Web Proxy Chaining =

Article ID: 292018

Article Last Modified on 10/26/2007

-

APPLIES TO


 * Microsoft Internet Security and Acceleration Server 2000 Standard Edition

-



This article was previously published under Q292018



IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry



SYMPTOMS
When clients that use a downstream Internet Security and Acceleration (ISA) Server service for Web proxy request a Web site on the Internet, the downstream ISA Server may take a long time to respond. This issue can occur if the following conditions exist:
 * A downstream ISA Server server is configured to chain Web proxy requests to the upstream server.

-and-

The DNS server that ISA Server is configured to use is unable to resolve all possible name resolution requests, which may include names on the internal and external network (intranet and Internet).
 * There is a Site and Content rule that applies to any destination type other than &quot;All destinations.&quot;

-or-
 * There is a Web Publishing rule that applies to any destination type other than &quot;All destinations.&quot;



CAUSE
The ISA Server server's Web proxy server presents all the relevant information about a Web request to the rules engine and allows or denies the request based on the response it gets back. There is no intelligence in ISA Server to predetermine, based on the destination set applicable in a particular rule, if forward or reverse name resolution may or may not be required.

Name resolution is required to for situations in which a user may try to &quot;outsmart&quot; a Web filter by specifying a restricted web site's IP address instead of name or vice versa.

This problem occurs in the configuration described above because ISA Server tries to perform name resolution (forward lookup or reverse lookup) for each request by using its configured DNS server to determine if the request may be denied either by a destination set that uses a IP address, or by name.



RESOLUTION
A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

http://go.microsoft.com/?linkid=6294451

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

The English version of this fix should have the following file attributes or later:   Date       Time    Version      Size     File name 3/21/2001 3:28PM  3.0.1200.57  373,008  W3proxy.exe Note This fix is included in ISA Server 2000 Service Pack 1 and Service Pack 2. For additional information about how to obtain the latest ISA Server 2000 service pack, click the following article number to view the article in the Microsoft Knowledge Base:

313139 How to obtain the latest Internet Security and Acceleration Server 2000 service pack

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

This hotfix provides the ability to control whether name resolution will performed when Site and Content rules or Publishing rules match the configuration described above.

Two global flags are provided, one for Publishing rules and one for Site and Content or Routing rules, that will disable name resolution in rules checking.

To prevent name resolution on Web Publishing rules or Site and Content Rules or Routing rules, install the hotfix and then add the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3Proxy\Parameters\SkipNameResolutionForPublishingRules : DWORD : 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3Proxy\Parameters\SkipNameResolutionForAccessAndRoutingRules : DWORD : 1



WORKAROUND
If external names cannot be directly resolved by the downstream ISA Server by using DNS, you should configure your server in one of the two following ways:
 * Configure the downstream ISA Server with the IP address of a DNS server that can resolve both internal and external domain names.
 * Do not create rules that match the configuration described at the top of this article.



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.



MORE INFORMATION
There are two main scenarios that are affected by this problem:
 * A subnet, in which computers are only identified by name. Requests to this subnet should be routed directly by the downstream proxies while all other request should go to the upstream proxy. This is a case where name resolution is really not needed.
 * A case in which there are rules, usually deny rules for domains, on the downstream proxy because each branch (possibly located in a different country) needs to block a different set. Here ISA Server is resolving IP addresses to check if they much the names and also resolving names to IP addresses, which is relevant mainly in intranet scenarios.

Additional query words: HF 57 HF57 ISAHF57.exe

Keywords: kbproductlink kbqfe kbhotfixserver kbenv kbprb KB292018

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.