Firewall Clients Are Unable to Use the Upstream Proxy (275234)

SYMPTOMS

Clients can access external Web sites through an Internet browser, but they cannot connect to external locations using other Winsock programs. This behavior can occur under the following circumstances:

A computer's access to the Internet is through chained servers that have Microsoft Internet Security and Acceleration (ISA) Server installed.
All Internet access for the computer is provided through the upstream server and no direct network connection is available from the downstream clients to the upstream server that has ISA Server installed.

CAUSE

This behavior can occur because only the routing rules have been configured. You must configure firewall service chaining (Winsock proxy chaining) and specify the upstream server.

RESOLUTION

To resolve this behavior, you can configure firewall service chaining by performing the following steps:

Start the ISA Server Administration tool. On the View menu, click Taskpad.
Expand the Server menu items.
Click Network Configuration.
In the right pane, click Configure Firewall Chaining.

Use the wizard to configure the proper information for the upstream server. The upstream server can be Microsoft Proxy Server version 2.0 or a server with ISA Server installed. The Firewall chaining option makes the server with ISA Server installed act like a firewall client to the upstream server.

MORE INFORMATION

The routing rules and all configuration settings only apply to Web browser proxy requests. You must also configure firewall service chaining (Winsock proxy chaining) and specify the upstream server.