Slow Response from Downstream ISA Server Using Web Proxy Chaining

When clients that use a downstream Internet Security and Acceleration (ISA) Server service for Web proxy request a Web site on the Internet, the downstream ISA Server may take a long time to respond. This issue can occur if the following conditions exist:

• A downstream ISA Server server is configured to chain Web proxy requests to the upstream server.
  
  -and-
  
  The DNS server that ISA Server is configured to use is unable to resolve all possible name resolution requests, which may include names on the internal and external network (intranet and Internet).
• There is a Site and Content rule that applies to any destination type other than "All destinations."
  
  -or-
• There is a Web Publishing rule that applies to any destination type other than "All destinations."

The ISA Server server's Web proxy server presents all the relevant information about a Web request to the rules engine and allows or denies the request based on the response it gets back. There is no intelligence in ISA Server to predetermine, based on the destination set applicable in a particular rule, if forward or reverse name resolution may or may not be required.

Name resolution is required to for situations in which a user may try to "outsmart" a Web filter by specifying a restricted web site's IP address instead of name or vice versa.

This problem occurs in the configuration described above because ISA Server tries to perform name resolution (forward lookup or reverse lookup) for each request by using its configured DNS server to determine if the request may be denied either by a destination set that uses a IP address, or by name.

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.
The English version of this fix should have the following file attributes or later: Note This fix is included in ISA Server 2000 Service Pack 1 and Service Pack 2. For additional information about how to obtain the latest ISA Server 2000 service pack, click the following article number to view the article in the Microsoft Knowledge Base:
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

This hotfix provides the ability to control whether name resolution will performed when Site and Content rules or Publishing rules match the configuration described above.

Two global flags are provided, one for Publishing rules and one for Site and Content or Routing rules, that will disable name resolution in rules checking.

To prevent name resolution on Web Publishing rules or Site and Content Rules or Routing rules, install the hotfix and then add the following registry keys:

If external names cannot be directly resolved by the downstream ISA Server by using DNS, you should configure your server in one of the two following ways:

• Configure the downstream ISA Server with the IP address of a DNS server that can resolve both internal and external domain names.
• Do not create rules that match the configuration described at the top of this article.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

There are two main scenarios that are affected by this problem:

• A subnet, in which computers are only identified by name. Requests to this subnet should be routed directly by the downstream proxies while all other request should go to the upstream proxy. This is a case where name resolution is really not needed.
• A case in which there are rules, usually deny rules for domains, on the downstream proxy because each branch (possibly located in a different country) needs to block a different set. Here ISA Server is resolving IP addresses to check if they much the names and also resolving names to IP addresses, which is relevant mainly in intranet scenarios.