Proxy 2.0 Packet Filtering May Not Allow Dynamic IP on External NIC (259637)

SYMPTOMS

When you turn on packet filtering on the external interface, Microsoft Proxy Server is unable to obtain an IP address (Domain Host Connection Protocol (DHCP) Client). This occurs after the installation of an xDSL or cable modem on a Microsoft Proxy Server 2.0 that must receive an external IP from an Internet Standard Protocols (ISP) DHCP. When you are using packet filtering, with no predefined BOOTP filter, Proxy does not allow the server to obtain an IP.

CAUSE

By default, Proxy 2.0 Dynamic Packet Filtering requires you to open ports to allow packets in and out. Proxy does not have a predefined filter for BOOTP (DHCP clients/Server). Therefore, Packet Filtering blocks the client (DHCP discover) from the ISP's DHCP Server.

RESOLUTION

To create a DHCP Custom Packet Filter, follow these steps:

In Microsoft Management Console, right-click Web Proxy, and then click Properties.
Click Security, turn on Dynamic Packet Filtering, and then click ADD.
Select the following option buttons to enable the DHCP UDP ports through the firewall.

Custom Filter
Protocol ID: UDP - Direction: Both
Local Port: Remote Port:
Fixed Port: 68 - Fixed Port: 67
Local host: Remote Host:
Specific Proxy ID: 0.0.0.0 - Remote host: Any Host
Click OK to save Packet Filter Properties.
Click OK to save Security Properties.
Click OK to save Web Proxy Service Properties.
Open a command prompt and type Ipconfig /renew.

MORE INFORMATION

For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

257685 Proxy Server 2.0 Security Checklist