RE: List Consensus Please??
- From: "Mike Anderson" <mike@xxxxxxxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Thu, 2 Dec 2004 23:08:34 -0600
Thanks Thomas,
I am starting to feel a little better... Most of my problems, were in
fact revolving around Site-to-Site connections. Others though, revolved
around other threads that you, I, and others discussed a ways back -
regarding RPC and getting Backup Domain Controllers to properly
communicate over a Site-to-Site link to the Primary Domain Controller
sitting on the other side. I never did get this perfected either - but
the moment I went back to ISA 2000, ALL the traffic flowed seamlessly
with no problems at all. If I did decide to give ISA 2004 another
chance, I will have to get to the bottom of that discussion - and see
why ISA is not allowing that particular traffic.
Real quick, can you confirm something for me? When making changes on
the ISA 2004 Firewall, of course, you have to hit the Apply Button to
make the changes go into effect. However, those changes really wouldn't
work (well some of them), until you did a reboot. Then stuff worked
right.
In the Event Log, there would be a message stating that the Server
required a Reboot for changes to go into effect.
How is the tech supposed to know that, if they don't get a dialog box
stating they need to reboot the server? That is plain silly - not only
should the Apply Button, apply the changes after modifying the running
config, but if a reboot is in fact required, the tech should be told
that.
Can you elaborate on that topic?
Thanks so much for your help,
Mike
-----Original Message-----
From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxx]
Sent: Thursday, December 02, 2004 10:59 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: List Consensus Please??
http://www.ISAserver.org
Hi Mike,
You'll need to call PSS for the fix, as its not downloadable yet. Just
let them know that you're having a problem with site to site VPN
connections dropping. There is a KB article on this on the Microsoft
site, but I don't recall the number at the moment. Serveral people on
the Web boards at www.isaserver.org have mentioned that its fixed their
site to site VPN issues.
HTH,
Tom
www.isaserver.org/shinder
Tom and Deb Shinder's Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
-----Original Message-----
From: Mike Anderson [mailto:mike@xxxxxxxxxxxx]
Sent: Thursday, December 02, 2004 10:50 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: List Consensus Please??
http://www.ISAserver.org
Hi Thomas and All,
You mentioned that fix for the Site-to-Site VPN - is that directly
accessible from the Microsoft Site? You mentioned PSS - so I am just
curious...
Thank you,
Mike
-----Original Message-----
From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxx]
Sent: Thursday, December 02, 2004 10:40 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: List Consensus Please??
http://www.ISAserver.org
Hi Mike,
I've been running my own business, and several others using the full
feature set included with the new ISA firewall, and haven't had the same
problems. I travel much more these days than I like, and manage many
networks remotely via VPN, and don't have these problems.
Are you problems primarily with site to site VPNs? If so, there is a fix
from PSS that will correct that problem.
Are you having problems with remote access VPNs?
I KNOW 2004 is quite stable. If not, I'd be the first one going back to
the 2000 ISA firewall, as I've had firewall service uptimes of over 200
days with it (and don't lay into me about hotfixes :-) I'm seeing the
same stablity with 2004 using the firewall, web proxy and VPN
components. This has been true with T-level, cable and DSL connections.
HOWEVER, I don't monkey around with dynamic addresses on the external
interface of the firewall. If a hobbiest account is being used, I put a
NAT device in front of the ISA firewall to handle the dynamic
addressing.
HTH,
Tom
www.isaserver.org/shinder
Tom and Deb Shinder's Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
-----Original Message-----
From: Mike Anderson [mailto:mike@xxxxxxxxxxxx]
Sent: Thursday, December 02, 2004 10:29 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: List Consensus Please??
http://www.ISAserver.org
Thanks Shawn.
I try not to bash MS Products - especially since ISA 2000 has been
absolutely spectacular, and has brought me much joy - since I've been
able to VPN in 100% of the time, no matter where in the world I was at
the time (even Cruise Ships using Sat-Links). The ability to remote in,
to support my clients networks has been invaluable - and ISA has been
just such a wonderful product, and a snap to configure. And all the
money it's saved not having to purchase Firewall Appliances, well that's
a whole new topic...
After installing ISA 2004, I just dropped my jaw - as it didn't resemble
2000 at ALL, and that's when I truly realized that MS finally created an
industrial strength Firewall, which closely resembles an Object Oriented
approach of allowing and disallowing "objects" (which can be Computers,
Networks, Users, etc.) to access specific network resources. I am an OO
Programmer, and I instantly fell in love with their new methodology.
All I can say about ISA 2004 is that it's BRILLIANT - and it breaks my
heart, that I am now unable to use it - and upgrade all my customers to
it as well. Since I wasted so much time getting the Win2K3 and ISA2K4
to work, that I didn't have the luxury of installing ISA 2004 on Windows
2000 and see if THAT worked. I have a gut feeling that it will work -
and will play with it when I get more time.
There is nothing nicer, than to have other people confirm suspicions -
so I'd love to hear more from everybody. Still, what a kick in the
butt, to see MS's latest OS not play nice with it's very own latest
Firewall product. I have to admit, I am really bummed about this.
Thanks and hope to hear more people jump in on this thread.
Mike
-----Original Message-----
From: Quillman Shawn (RBNA/CSA1) * [mailto:Shawn.Quillman@xxxxxxxxxxxx]
Sent: Thursday, December 02, 2004 10:12 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: List Consensus Please??
http://www.ISAserver.org
Hi Mike,
I'm sorry I can't really say anything to your question as I don't have
any experience with that combo yet. But I do want to point out that I
appreciate the manner in which you brought this message to the list
instead of bashing things like you could have easily done. I do hope
you get some helpful answers. I would also encourage anyone reading
this thread that could share information to do so, whatever the outcome.
It's far too rare that someone shows this level of patience in such an
obviously frustrating situation.
-Shawn
-----
Shawn R. Quillman
Robert Bosch Corporation RBNA/CSA1
38000 Hills Tech Drive
Farmington Hills, MI 48331
(248) 553-1164 (P) (248) 848-6969 (F)
shawn.quillman@xxxxxxxxxxxx
-----Original Message-----
From: Mike Anderson [mailto:mike@xxxxxxxxxxxx]
Sent: Thursday, December 02, 2004 10:10 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] List Consensus Please??
http://www.ISAserver.org
Hello Everyone,
Could I please pester you all, and get your experiences with Windows
2003 Server running ISA Server 2004? I am running this OS and Software
combo, at 3 locations, on 3 different hardware brands (a Dell, a Compaq,
and a Clone machine).
FLAKEY is the only word that comes to mind when describing the overall
performance - and the chances of this happening on THREE different
brands of computers is almost mind boggling. The only conclusion then,
is that there are issues with Windows 2003 Server running ISA Server
2004. Can anybody solidify my findings and experiences?
Briefly, it will stop accepting VPN connections after a while. If I
make several configuration changes and then restart the service - I am
unable to perform a clean reboot when the time comes to do so (and that
royally sucks, when I am Terminal Served in across the USA and I have to
call somebody at the Office to reboot it for me) it just hangs on the
"saving settings" message during the shutdown process. If a remote VPN
network end (the other ISA 2004 Server across town) drops off and then
tries to reconnect it just refuses the connection, unless I then reboot
BOTH sides of the connection one more time. Etcetera, Etcetera,
Etcetera... I have many more things to list, but these are the main
ones. Its just unreliable overall, and it's cost me my credibility with
my client, and we just reverted back to Windows 2000 Server with ISA
2000.
Thanks everybody for offering any information regarding this. I'd
rather use the latest and greatest software (and I LOVE ISA 2004), but
not if it makes me look like a technical buffoon. What a terrible 3
weeks it's been for me.
Mike -
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com Leading
Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org Windows
Security Resource Site: http://www.windowsecurity.com/ Network Security
Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
shawn.quillman@xxxxxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com Leading
Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org Windows
Security Resource Site: http://www.windowsecurity.com/ Network Security
Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
mike@xxxxxxxxxxxx To unsubscribe visit
http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com Leading
Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org Windows
Security Resource Site: http://www.windowsecurity.com/ Network Security
Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
tshinder@xxxxxxxxxxxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com Leading
Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org Windows
Security Resource Site: http://www.windowsecurity.com/ Network Security
Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
mike@xxxxxxxxxxxx To unsubscribe visit
http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com Leading
Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org Windows
Security Resource Site: http://www.windowsecurity.com/ Network Security
Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
tshinder@xxxxxxxxxxxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com Leading
Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org Windows
Security Resource Site: http://www.windowsecurity.com/ Network Security
Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions:
http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
mike@xxxxxxxxxxxx To unsubscribe visit
http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx
Other related posts:
