ISA web publishing very slow/unresponsive

[link470]

Hey guys,

 

I tried the ISAserver.org community for this one but nobody has replied in several weeks. I recently configured a new network with ISA server 2006 as a web publishing reverse proxy. I have 3 main servers behind it. No clients, literally a network of 4 machines. 1 ISA server firewall/reverse proxy, 1 web server [server 2008], one database server [server 2003 with MySQL], and 1 mail server [server 2003 running hMailServer with RoundCube as a webmail client]. I originally configured this setup because I wanted to have webmail on the mail server and the websites on IIS 7 using host headers, using the same port 80. Previously I always had to have a different port number on the webmail interface.

 

What I may do if I can't figure this out, is ditch ISA, and then go for something like smoothwall and just use port forwarding and have the webmail client installed on the main web server and point to the mail server. The webmail interface isn't integrated into the mail server software so I should be able to do that.

 

Thanks for your time in advance, here's the copy paste from ISAserver.org, really hoping someone can help me figure this out.

 

--------------FROM ISASERVER.ORG----------------

 

Hello! I've been running ISA as a reverse proxy in production now for a few weeks and I have to say it's done an excellent job for the most part. Nice and fast. I do have one concern however. [note to edugeek, this is getting far far worse...]

 

For the most part, EduGeek.net runs quite nicely and very fast. However, once in awhile when you click a link, the browser taskbar will say "Waiting for...." or "Loading...." and the page won't ever load. We are running the latest version of the phpbb forum software [3.0.6] on our website. Not all of our users know to just reclick the link or hit refresh, so sometimes if they come across an endless loading screen they'll just sit and wait. My guess is that there's something wrong with ISA and that it's not passing through the request. Why, I'm not sure. Again, it's very fast, and works very well for the most part, but clicking the odd link will yield "Waiting..." and nothing will happen unless you re-send the request by clicking the link again or hitting refresh. Worse, I've had this happen once where I sit down at my computer, and instead of a few clicks in until I see "Waiting...", it's the first time I visit the site, so right after I type EduGeek.net into the web address bar and hit enter. To me, that's not good because it would make people think the website is down if it doesn't come up right away.

 

Anybody else noticed this? Again, it could be the web server [Windows Server 2008 running IIS and PHP with FastCGI installed by Web Platform Installer] or it could be something else, but I'm curious to know if this IS ISA or not.

 

I also have my web server and database server on separate boxes. I have skip-name-resolve enabled on MySQL's my.ini config file and that speeds up the processing to what it should be, but I'm not sure if that would be the issue either. My bets are still on ISA but I can't be sure.

 

Please let me know if you need any more information from my web publishing rules or network configuration and I'd be happy to share that information to get an answer.

 

-----

EDIT

-----

 

Still trying to figure this out. It was working great, and now I'm having difficulties with all websites on the system. I can't track down whether it's ISA or whether it's the new server [2008 running IIS]. I'm at work at the moment so I can't go restart them, but I'm thoroughly confused. I couldn't access the website at all this morning when I woke up and I tried to check the ISA logs, but when I started a logging session, all I could see was each time I clicked a button on the website [which of course yielded an endless loading page] all the log would show was "Initiated connection..." from what I can remember, and Allowed, and nothing else. Just initiated connection each time I click a link on the website.

 

Anybody else have any ideas? I'm really confused and can't seem to pinpoint where the problem lies. I think it must be ISA. I'm tempted to just try smoothwall in front and use port forwarding instead of a reverse proxy and see if it's any better. My home router and port forwarding with an old 500MHz server worked more reliably than this.

 

Thanks so much!

------------------END------------------

Edited January 18, 2010 by link470

[SYNACK]

You have probably tried this but have you run the ISA BPA ( http://www.microsoft.com/downloads/details.aspx?FamilyID=D22EC2B9-4CD3-4BB6-91EC-0829E5F84063&displaylang=en ) on the gateway. This will pick up all sorts of stuff, for instance with ISA you must have TCP acceleration switched off on the network cards and have certain TCP windows for it to run at the max speed. If i recall correctly there are also certain processes that benifit from being excluded from lag inducing realtime AV scans.

[link470]

This will pick up all sorts of stuff, for instance with ISA you must have TCP acceleration switched off on the network cards and have certain TCP windows for it to run at the max speed. If i recall correctly there are also certain processes that benifit from being excluded from lag inducing realtime AV scans.

 

Thanks for your reply!

 

You have probably tried this but have you run the ISA BPA ( http://www.microsoft.com/downloads/details.aspx?FamilyID=D22EC2B9-4CD3-4BB6-91EC-0829E5F84063&displaylang=en ) on the gateway.

 

You guessed it, I've already tried running the BPA and I have it installed and run it now again after making changes. It doesn't pick up anything significant. I have a weird range 10.0.0.1 to 10.0.0.10 and it always flags that saying that anything out of that range in that subnet will be marked as spoofed. But I know that, I made it 10 IP's on purpose, I only have 3 servers behind it Otherwise nothing else out of the ordinary.

 

This will pick up all sorts of stuff, for instance with ISA you must have TCP acceleration switched off on the network cards and have certain TCP windows for it to run at the max speed. If i recall correctly there are also certain processes that benifit from being excluded from lag inducing realtime AV scans.

 

I couldn't find the TCP acceleration, is that inside ISA preferences or Windows Networking preferences? I couldn't find it in either but I must admit I didn't look very long, because I noticed what you said next and saw that AVG Network Edition was installed on the server. I actually completely uninstalled that because I think I don't need it after reading around some. The server is locked down enough as it is, it's ISA and only specific protocols are allowed and the 2 or 3 that are allowed are heavily monitored. So I'm not worried anytime soon. The web server has antivirus software itself so if something is uploaded that is dangerous it will be flagged at that point and not bog down ISA.

 

It's so weird, at times it works, at times it doesn't. Were you successful in viewing the site? It's either incredibly fast, or lags our or gives incomplete pages. Very unpredictable.

[SYNACK]

I couldn't find the TCP acceleration, is that inside ISA preferences or Windows Networking preferences?

 

It's so weird, at times it works, at times it doesn't. Were you successful in viewing the site? It's either incredibly fast, or lags our or gives incomplete pages. Very unpredictable.

 

The TCP/IP acceleration would have been picked up by the BPA, you may also want to look at boosting the connection limits for the webservers internal IP as if it is creating lots of connections then it will hit a limiting rule. It is also best to map via subdomains as the subfolder mapping seems to be a bit slower.

 

When I loaded it it did take about 4 seconds for the initial connection and load but that is not too bad from NZ. After that it behaved much faster than edugeek from here, EG seems to be under a fair bit of load and is behaving rather badly here at the moment with timeouts etc.

[elaborate]

thanks v much

_________________

[elaborate]

thanks v much for the info

[link470]

Hey SYNACK, normally I'd change the subject of my post to [ANSWERED] or [sOLVED] at the beginning, but just wanted to let you know you were a huge help and I really appreciate it. Relieved a ton of stress from me with your info. Not only did I fix the one problem, but I fixed about 10 others inadvertently So thank you very much.

 

What I ended up doing was simply uninstalling AVG Network Edition after I figured you know what, this box is already insanely secure, it's running ISA...duh. Only access to it is on specific ports for me for administration and from me only. So that's all fixed, and I also adjusted the TCP limit within ISA to a higher number. I notice a HUGE improvement already. The other major issue it fixed is I could NOT run Windows/Microsoft update on ISA, or any machines behind it, and a download over 10MB or so would crash ISA. All seems great now, I'll update with more information if there is, but for now, thank you very much!

 

::EDIT::

 

No way...it fixed my webmail as well. That was ALSO broken. Logs in perfectly now, lol. Was testing something and expected it to fail as usual and it went in right away. I've NEVER been successful at logging into to my webmail service since I tried launching it. Very happy, thanks!

 

::EDIT::

 

WOW...lol, WOW, and now my other issue is fixed, only one person used to be able to connect to VPN at once, that's resolved as well. That's EVERY issue I had on my network here, resolved. Things are going excellent so far!

Edited January 20, 2010 by link470

[SYNACK]

Happy to help and hear that it is all up and running for you