ISA server fun!

[e_g_r]

Anyone help me out here as out LEA guru who used to look after our ISA/Websence server has left and i now have a problem that i am struggling with.

 

School has purchased an online report writing solution. Staff are getting Network Access errors Code 10061 sometimes when they are trying to write reports in school.

 

Full error as follows;

 

Network Access Message: The Page cannot be displayed

 

Explanation: The Web server refused the connection.

 

Try the following:

 

Refresh Page

Check Speeling

Access from a link

Contact website

 

Technical Information (for support personnel)

 

Error Code 10061: Connection refused

Background: The server you are attempting to access has refused the connection with the gateway. This usually results from trying to connect to a service that is inactive on the server.

 

Server: our server

 

Source: Remote server

 

I have spoken to the people who own the site who claim that the other 100+ schools that use their services don't have a problem.

 

It looks to me that their is some kind of time out between our ISA server and their reports server.

 

How/Where can i check on our ISA server what the connection time limit is set to?

 

Any pointers much appreciated as when i googled it there wasn't much help

[danrhodes]

Download Fiddler Fiddler Web Debugger - Freeware HTTP(S) debugging tool

 

Run Fiddler then using IE re-create the error, Fiddler will output everything that is happending you should then be able to pinpoint the error.

 

D

[artsaudi]

Hi.

Can you go to the loggin in the isa and start a query for that specific remote server. Check if ISA was able to contact the remote server and in what port is being used.

[e_g_r]

How would i do that? Am a total ISA novice

[artsaudi]

Go to the ISA server and find the ISA Server Management. Expand the Server name and click on Monitoring, then select the Logging tab. On the Task Pane on the right, click on Edit Filter. Make sure these three filters are in.

 

• Log Record Type Equals Firewall or Web Proxy Filter
  
• Log Time Live
  
• Destination IP Equals "Remote Server IP address"
  

Replace Remote Sever IP addres with the real IP address of your remote server. Then click on the Start Query.

 

Now let the user start the report writing.

[e_g_r]

Just setup the query and it says its fetching results. How long does this usualy take?

[spc-rocket]

Just setup the query and it says its fetching results. How long does this usualy take?

 

I would use the Client IP and then replace the IP address of the client PC where the user is running the report from.

 

Ash.

[artsaudi]

Ashok is right, it should have been the Client IP of the user running the report.

[ZeroHour]

Does it work for you?

Is the site secure?

[e_g_r]

The site works and then after a time dosn't. Tried another Proxy server that seems to work and then have the same problem. I just want to find out who's problem it is, ours, theirs or a combination.

 

Added to this is that home users with customized browsers are having problems as well and the site owners just say get them to use IE7 or Firefox. FFS these are home users who want to browse the way they want to.

[SYNACK]

Could be ISA rewriting the packets to make them comply with standards, I have had that issue before with cisco VPNs. You may need to relax some of hte safety features on the HTTP filter just for that site with an allow rule above your main rule with lapse filtering:

 

Configuring the ISA Server 2006 HTTP Filter

 

their server or clientside code could be sending large amounts of stuff back and foward in a suspect way and tripping the filter.