Slow Response from Downstream ISA Server Using Web Proxy Chaining (292018)

SYMPTOMS

When clients that use a downstream Internet Security and Acceleration (ISA) Server service for Web proxy request a Web site on the Internet, the downstream ISA Server may take a long time to respond. This issue can occur if the following conditions exist:

A downstream ISA Server server is configured to chain Web proxy requests to the upstream server.

-and-

The DNS server that ISA Server is configured to use is unable to resolve all possible name resolution requests, which may include names on the internal and external network (intranet and Internet).
There is a Site and Content rule that applies to any destination type other than "All destinations."

-or-
There is a Web Publishing rule that applies to any destination type other than "All destinations."

CAUSE

The ISA Server server's Web proxy server presents all the relevant information about a Web request to the rules engine and allows or denies the request based on the response it gets back. There is no intelligence in ISA Server to predetermine, based on the destination set applicable in a particular rule, if forward or reverse name resolution may or may not be required.

Name resolution is required to for situations in which a user may try to "outsmart" a Web filter by specifying a restricted web site's IP address instead of name or vice versa.

This problem occurs in the configuration described above because ISA Server tries to perform name resolution (forward lookup or reverse lookup) for each request by using its configured DNS server to determine if the request may be denied either by a destination set that uses a IP address, or by name.

RESOLUTION

A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Only apply it to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next ISA Server service pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

NOTE: In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The typical support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

The English version of this fix should have the following file attributes or later:

   Date       Time    Version      Size     File name  
   ----------------------------------------------------
   3/21/2001  3:28PM  3.0.1200.57  373,008  W3proxy.exe

Note This fix is included in ISA Server 2000 Service Pack 1 and Service Pack 2. For additional information about how to obtain the latest ISA Server 2000 service pack, click the following article number to view the article in the Microsoft Knowledge Base:

313139 How to obtain the latest Internet Security and Acceleration Server 2000 service pack

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

This hotfix provides the ability to control whether name resolution will performed when Site and Content rules or Publishing rules match the configuration described above.

Two global flags are provided, one for Publishing rules and one for Site and Content or Routing rules, that will disable name resolution in rules checking.

To prevent name resolution on Web Publishing rules or Site and Content Rules or Routing rules, install the hotfix and then add the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3Proxy\Parameters\SkipNameResolutionForPublishingRules : DWORD : 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3Proxy\Parameters\SkipNameResolutionForAccessAndRoutingRules : DWORD : 1

MORE INFORMATION

There are two main scenarios that are affected by this problem:

A subnet, in which computers are only identified by name. Requests to this subnet should be routed directly by the downstream proxies while all other request should go to the upstream proxy. This is a case where name resolution is really not needed.
A case in which there are rules, usually deny rules for domains, on the downstream proxy because each branch (possibly located in a different country) needs to block a different set. Here ISA Server is resolving IP addresses to check if they much the names and also resolving names to IP addresses, which is relevant mainly in intranet scenarios.