Article ID: 2967726 - View products that this article applies to.
Expand all | Collapse all

Symptoms

A server that is running Microsoft Forefront Threat Management Gateway (TMG) 2010 may stop accepting new connections on a specific web proxy or web listener. This problem may occur after several hours to several days of server uptime.

Cause

This problem occurs when TMG stops accepting new connections on the web listener. This soon fills the backlog queue for the ancillary function driver (AFD) socket. After the backlog queue is full, the server starts to reset new incoming connections. If you monitor the server by using Network Monitor in this situation, you may notice a SYN, ACK/RST pattern for each new connection attempt.

Resolution

To resolve this problem, install Rollup 5 for Forefront Threat Management Gateway (TMG) 2010 Service Pack 2.

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

More information

After you install Rollup 5, you must enable the functionality to time out idle accept calls. To do this, follow these steps:
  1. Copy the following script into Notepad, and then save the file as SetAcceptIdleTimeout.vbs:
    'Define the constants needed.
    Const strVpsGUID = "{143F5698-103B-12D4-FF34-1F34767DEABC}"
    Const strVpsPropertyName = "AcceptIdleTimeout"
    Const Error_FileNotFound = &H80070002
    Set objArgs = wscript.Arguments
    if objArgs.Count > 0 then
        uAcceptIdleTimeout = objArgs(0)
    end if
    if objArgs.Count <> 1 then
        wscript.echo "Usage: SetAcceptIdleTimeout.vbs <timeout>"
        wscript.echo
        wscript.echo "Set async accept timeout to <timeout> value (in sec)"
        wscript.echo "To disable async accept timeout set it to 0"
        wscript.Quit 2
    end if
    set objArray = CreateObject("FPC.Root").GetContainingArray()
    Set objVPSet = OpenVPSet(objArray, strVpsGUID)
    objVPSet.Value(strVpsPropertyName) = uAcceptIdleTimeout
    objArray.Save()
    objArray.RestartServices(1)
    function OpenVPSet(objParent, strVpsGUID)
        Set objVPSets = objParent.VendorParametersSets
        On Error Resume Next
        Set OpenVPSet = objVPSets.Item(strVpsGUID)
        ' Save the Err properties in case it needs to be re-raised
        errNumber      = Err.Number
        errSource      = Err.Source
        errDescription = Err.Description
        errHelpFile    = Err.HelpFile
        errHelpContext = Err.HelpContext
        
        On Error GoTo 0
        
        if errNumber = Error_FileNotFound Then
            Set OpenVPSet = objVPSets.Add(strVpsGUID)
        Elseif errNumber < 0 Then
            ' An error other than "file not found" occurred -- re-raise the error,
            ' this time not under "On Error Resume Next"
            Err.Raise errNumber, errSource, errDescription, errHelpFile, errHelpContext
        End If
    end function

  2. Run the script on one of the TMG servers. For example to set the time-out period to 5 minutes, run the following from an administrative command prompt:

    cscript.exe SetAcceptIdleTimeout.vbs 300
  3. To make this change take effect, restart the firewall service on all array members.

To undo this change, run the following command to set the idle time-out to 0:

cscript.exe SetAcceptIdleTimeout.vbs 0

References

Learn about the terminology that Microsoft uses to describe software updates.

Properties

Article ID: 2967726 - Last Review: June 27, 2014 - Revision: 1.0
Applies to
  • Microsoft Forefront Threat Management Gateway 2010 Enterprise
  • Microsoft Forefront Threat Management Gateway 2010 Standard
Keywords: 
kbqfe kbfix kbexpertiseinter kbbug kbsurveynew KB2967726

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com