Oaktech Posted October 26, 2012 Posted October 26, 2012 We have an ISA server, which we call isa2. It has run for about 4 years in a MS virtual pc on top of our physical isa1 server. the isa 2 is our unfiltered server for slt and us. It started going down hill a while ago, we stopped being able to tsc it directly, it got really laggy and was using 100% cpu a lot of the time. In our infinite wisdom we decided to migrate it from its ms vpc home to a vmware esxi host, which went swimmingly, and it was up and running in no time - but despite a doubling in available memory and the addition of another cpu core it is still using 100% cpu. We are not using SQL logging, but there is an isa instance of sql desktop consuming between 12 and 88% cpu contstantly, and the wspsrv firewall consuming pretty much whatever sql is not consuming, creating a 100% cpu condition, 100% of the time! We've applied all the hotfixes and service packs and supportability packs to it with very little change. WHAT IS WRONG WITH MY [DERP] ISA! We have just decided to use TMG instead, we have read the guide, exported the info from ISA, created a new VMware host on the appropriate IP and i'm just waiting for the ISO to download. Have I just condemned myself?
Ric_ Posted October 26, 2012 Posted October 26, 2012 TMG is undoubtably better... just make sure that you don't install it on 2008R2 because it doesn't work. 1
Oaktech Posted October 26, 2012 Author Posted October 26, 2012 (edited) TMG is undoubtably better... just make sure that you don't install it on 2008R2 because it doesn't work. Oh [insert deity] REALLY i don't have 2008, only r2 in my downloads from msvlc. what doesn't work about it? Le Edit: it appears that it does work, http://blogs.technet.com/b/isablog/archive/2011/03/07/tmg-2010-sp1-and-uag-2010-sp1-are-supported-on-windows-2008-r2-sp1.aspx but only the latest version of TMG, which I think is what i'm downloading. Edited October 26, 2012 by Oaktech
Ric_ Posted October 26, 2012 Posted October 26, 2012 We run many TMGs (7 or 8 I think at the moment) and those that people installed on 2008R2 went badly wrong and needed a re-build... @Domino could explain better. A quick gGoogle looks like some issues have been fixed but you can quickly see a lot of people having issues. 2008 isn't a a big download and it definitely works - not sure why you don't have it in MVLS mind.
SYNACK Posted October 26, 2012 Posted October 26, 2012 Have you looked at the scheduled tasks on the VM to see if it is parsing the logs for previous days, it commits the test details to the SQL database on a schedule, if it stuffs up there it will choke the system. If you have no use for those logs then kill the scheduled tasks. You can also look through your rules to make sure that they do not log an instance to the database every time a rule is hit which is the default system. Other options are exporting the config then uninstalling ISA, reinstalling then reimporting the system.\ Comparatively I have used TMG on a 2008 server with 3-4GB or RAM and 2-4 CPUs, 2008 R2 with much more resources (don't even try unless they have made massie progress in the last six months) with the same amount of RAM or ISA under 2003 R2 with 1500 MB or RAM and no issues in comparison other than the VPN host dies on reboot issue. Your system may differ as ironically it seemed to have issues with Hyper-V but I personally would not trust it (TMG). 1
jamesfed Posted October 26, 2012 Posted October 26, 2012 TMG is undoubtably better... just make sure that you don't install it on 2008R2 because it doesn't work. TMG with web filter, firewall and VPN works fine for us on Server 2008 R2 - all latest updates/patches ect
SYNACK Posted October 26, 2012 Posted October 26, 2012 TMG with web filter, firewall and VPN works fine for us on Server 2008 R2 - all latest updates/patches ect Under Hyper-V, ESXi or native?
jamesfed Posted October 26, 2012 Posted October 26, 2012 Under Hyper-V, ESXi or native? Hyper-V - 4 vprocs, startup RAM is 2GB with the ablity to burst to 8GB and 4 NICs. Looks after a school of ~150 web browsing students with ease.
SYNACK Posted October 26, 2012 Posted October 26, 2012 Hyper-V - 4 vprocs, startup RAM is 2GB with the ablity to burst to 8GB and 4 NICs. Looks after a school of ~150 web browsing students with ease. Wow, maybe they have finally fixed it, we had about a hundred stations running through it (many more pupils) and it lost a good 25-30% of the packets, simply stopped responding for minutes at a time, chewed 4+ GB of RAM. Dropped All connections on VPN connection from outside, stopped responding to internal users while serving external ones fine. Twenty minute boot times, Hyper-V client component failure thanks to the dodgy firewall rules, failure to apply rules for local and remote RDP etc. etc. I'd get RSI/OOS if I listed all the faults, and that was with SP1 Rollup 3 along with insane levels of diagnostics including a 2GB wireshark packet capture to try an find out what its problem was.
jamesfed Posted October 26, 2012 Posted October 26, 2012 Wow, maybe they have finally fixed it, we had about a hundred stations running through it (many more pupils) and it lost a good 25-30% of the packets, simply stopped responding for minutes at a time, chewed 4+ GB of RAM. Dropped All connections on VPN connection from outside, stopped responding to internal users while serving external ones fine. Twenty minute boot times, Hyper-V client component failure thanks to the dodgy firewall rules, failure to apply rules for local and remote RDP etc. etc. I'd get RSI/OOS if I listed all the faults, and that was with SP1 Rollup 3 along with insane levels of diagnostics including a 2GB wireshark packet capture to try an find out what its problem was. Weird one there! We've been running for at least a year and a half since our LEA decided to let us free on our own web filter - worked out cheaper than the £800 they were asking for with Netsweeper.
SYNACK Posted October 26, 2012 Posted October 26, 2012 Weird one there! We've been running for at least a year and a half since our LEA decided to let us free on our own web filter - worked out cheaper than the £800 they were asking for with Netsweeper. Don't get me wrong, ISA was good and TMG was too on some deployments but there was a reason they discontinued TMG about a month after they released it, even they can't figure out what it is doing when it goes wrong. UAG and basic Server 2012 are the new standards, TMG is a horror movie for many that will never get a sequel. I thing it was @Domino that tried TMG as an upgrade to ISA in a large corp setting and ditched it entirely for a separate solution given the amount of problems it caused them. It is a great product if it works for you but if not either downgrade or go to a different product to save your budget and sanity.
jamesfed Posted October 26, 2012 Posted October 26, 2012 Only let down for me is no more web filtering from Microsoft we pay just £320 for the WHOLE school a year - find me a filter that is cheaper than that. (Yes others maybe more advanced (Smoothwall) but it keeps out 99% of what we don't want).
SYNACK Posted October 26, 2012 Posted October 26, 2012 Only let down for me is no more web filtering from Microsoft we pay just £320 for the WHOLE school a year - find me a filter that is cheaper than that. (Yes others maybe more advanced (Smoothwall) but it keeps out 99% of what we don't want). Stage direction: Pulls cable from primary network feed. SYNACK: filtered 100% of badness in one go The filtering is quite good
jamesfed Posted October 26, 2012 Posted October 26, 2012 Stage direction: Pulls cable from primary network feed. SYNACK: filtered 100% of badness in one go The filtering is quite good But how will people get onto the interwebs!
SYNACK Posted October 26, 2012 Posted October 26, 2012 But how will people get onto the interwebs! Stage direction: Add A record for http://www.google.com;www.google.co.uk, point to local intranet server SYNACK: Alakazam!!! the internet works
jamesfed Posted October 26, 2012 Posted October 26, 2012 Stage direction: Add A record for http://www.google.com;www.google.co.uk, point to local intranet server SYNACK: Alakazam!!! the internet works A while back our internal web host went down (which in turn hosts a staff/student internal homepage) - we've got it setup so that on loading IE or clicking home you get that intranet page AND the schools main website (in a second tab). With the server down the intranet didn't load but the school website was up and running fine - would be amazed at how many calls we got asking if the internet was down only for us to respond with no its just the intranet.
SYNACK Posted October 26, 2012 Posted October 26, 2012 A while back our internal web host went down (which in turn hosts a staff/student internal homepage) - we've got it setup so that on loading IE or clicking home you get that intranet page AND the schools main website (in a second tab). With the server down the intranet didn't load but the school website was up and running fine - would be amazed at how many calls we got asking if the internet was down only for us to respond with no its just the intranet. Oh I have suffered from the same stupidity; OMG!!!; teh internetz is down, I can has soccer results?!! SYNACK: shakes head then smacks head into wall repeatedly SYNACK: (via translation matrix) Teh Soccer results site is, done, breaked!!! User: Butz, myz, resultzz, Hows can I,z teach SYNACK: I really don't know, on the best of days, I really don't know??? User: But Soccer??? Synack: where is a high place to jump off??? Please!!!! Anyone!!! Etc. Etc. Etc.... 1
Domino Posted October 26, 2012 Posted October 26, 2012 So, we only use TMG for our web logging and publishing MS stuff now, which it's fine for. The 2008 R2 issues were to do with the flood mitigation, site-to-site vpns and malware blocking not working (well, working initially, then freaking the server) if the ISA's internal interface wasn't the first ip on the internal subnet (eg: x.x.x1 for most people) - apparently this was due to changes in the R2 IP stack. Due to this we never build them on R2, if they can't get that right, what else is wrong....? As long as you don't want it do to any traffic routing, it's fine. I imagine most schools environments wouldn't hit the issues we did. BUT, rebuilding an ISA isn't that much work. I did it in an afternoon a couple of weekends ago: export all certs and private keys, copy out static routes, backup isa config rebuild OS and install ISA to same patch level import everything you backed up. ISA/TMG appears to need this fairly regularly IMHO. As an aside, Myself and the @Ric_ 's manager were at a Exchange 2010 migration course at MS reading when it came out - and got some time with the head of UK development. After chatting hyper-v and other things for a while, he brought up TMG. and was subjected to 20mins of my rants on the subject. three weeks later they announced the product was being dropped....whoops :-/
Ric_ Posted October 26, 2012 Posted October 26, 2012 @Domino I would drop a product too if it stopped you ranting at me :-P
Domino Posted October 26, 2012 Posted October 26, 2012 Really? sweet anyone got the number for Symantec?
SYNACK Posted October 27, 2012 Posted October 27, 2012 Really? sweet anyone got the number for Symantec? Small fries, who has Adobe's number???
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now