ISA Server has become invisible...

[Ravening_Wolf]

As is always the case, I have come into work this morning and something has me tearing my hair out!

 

Our ISA 2004 Server has disappeared off the network and all of our students have lost their internet access as a consequence. I have managed to get the girls back online by passing them directly to our LEA proxy but the ISA issue remains.

 

The most frustrating aspect of this issue is that the server appears to be running happily and it can access whatever it likes on the network. It does not however respond to external pings, Remote Desktop sessions or anything else you care to name. I'm at a loss. :?

 

Any ideas anyone?

[Geoff]

Have any updates been applied to the machine recently? Does a reboot help?

[Ravening_Wolf]

I have rebooted a few times without any chance in circumstance. A quick glance at the Application log shows that a few .Net hotfixes have been applied by WSUS too, although our other server have not been affected in this way.

 

I have also discovered that the Domain Admin account does not have permission to open the Network and Dial-up connections folder in the Control Panel! :x

 

For background info, the affected machine is running Win2K Server.

[Geoff]

Er, Virus and spyware scan is in order I believe.

[Disease]

Have you checked that it is still in the DNS list on the DNS server, we had a server that dropped off of the dns list for some reason, just re added the record and it was found again.

 

But it should still ping via IP though so maybe not.

 

Maybe worth a look.

[Ric_]

Might seem obvious but have youy checked that the firewall process is running? If it is, restart it

[NetworkGeezer]

What does IPconfig say? Is there acitivity on the green NIC?

Is the switch it's attached to OK on?

[Ravening_Wolf]

Virus scan and adware scan = negative

DNS entry exists and correct

Microsoft Firewall process = cannot start (service-specific error code 212994)

IPConfig = all present and correct

NIC status light = everything ok

Network Switch = everything ok

 

I hate Mondays.

[DMcCoy]

Have you rebooted it? Sometime the firewall service can misbehave. Also remember that isa 2004 will block ping and rdp by default and it has to be enabled in the policy section in the isa manager. Is there are rule allowing clients to connect to the isa proxy? are they set to access it as a proxy or with the firewall client?

 

Edit: I see you did reboot it :/

 

Any errors in the event log?

[NetworkGeezer]

Microsoft Firewall process = cannot start (service-specific error code 212994)

 

Have a look on eventID.net

[DMcCoy]

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q300215

[spc-rocket]

Hi there,

 

If the firewall service is not started the isa server will go into lock-down mode and will not let anything pass at all. This is why you can't pint the server as well. I think this is a security design implemented by MS.

 

There may be ways to exclude some services when the firewall services crashes so it doesn't lock them out but i'm not too sure how to go about do this.

 

Try and find out why the firewall service crashed and how to get it back online again. You should find that once the firewall service is back up all other things will works again.

 

HTH,

 

Ash.

[Ravening_Wolf]

Thanks for the heads-up Ash, I went back to Microsoft online support and found that certain updates will knock out the firewall services causing the symptoms described previously.

 

To "fix" the problem, one must do a "Modify" installation of ISA Server and de-select Advanced Logging. Once the install process completes, traffic through ISA resumes as per normal. The second step of the M$ "fix" is to reinstall the Advanced Logging option, but this failed for me. I will have a nother look when time permits (ha ha ha).

 

For future reference, the Microsoft Knowledgebase article is available here.

 

Thanks to one and all for their assistance.