Error message when you try to access Web sites through a downstream server after you enable hotfix 927265 on an upstream server that is running ISA Server 2004 or ISA Server 2006: "502 Proxy Error"

Article translations Article translations
Article ID: 938465 - View products that this article applies to.
Expand all | Collapse all

SYMPTOMS

Consider the following scenario:
  • A downstream server is chained to an upstream server that is running Microsoft Internet Security and Acceleration (ISA) Server 2004 or Microsoft Internet Security and Acceleration (ISA) Server 2006.
  • A client computer is configured to use the downstream server as the proxy server.
  • On the upstream server, you have enabled the hotfix that is described in the following Microsoft Knowledge Base article:
    927265 Authentication fails when client computers use Internet Explorer 7 to authenticate with an upstream ISA Server computer through a downstream ISA Server computer that does not require authentication
However, when a user on the client computer tries to access Web sites through the downstream server, the user receives the following error message:
Error Code: 502 Proxy Error. Logon Failure: Unknown user name or bad password. (1326)

CAUSE

This problem occurs because proxy-to-proxy authentication fails. The downstream server expects the upstream server to return "Negotiate" as a supported authentication scheme for Windows Integrated authentication. However, after you enable hotfix 927265, the upstream server is configured to return only "NTLM" as an authentication scheme for Windows Integrated authentication. Therefore, the downstream server and the upstream server cannot authenticate one another.

RESOLUTION

A hotfix package is available to resolve this problem. For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:
938466 Description of the Internet Security and Acceleration Server 2004 hotfix package: June 5, 2007
954258 How to obtain the latest Internet Security and Acceleration (ISA) Server 2006 service pack

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

MORE INFORMATION

The authentication process between the downstream server and the upstream server uses a special URL request. After you apply hotfix 938466, the upstream ISA Server computer will return "Kerberos" and "Negotiate" as supported authentication schemes if there is a special ISA-to-ISA authentication URL request.

Properties

Article ID: 938465 - Last Review: October 24, 2008 - Revision: 2.1
APPLIES TO
  • Microsoft Internet Security and Acceleration Server 2004 Standard Edition
  • Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition
  • Microsoft Internet Security and Acceleration Server 2006 Standard Edition
  • Microsoft Internet Security and Acceleration Server 2006 Enterprise Edition
Keywords: 
kberrmsg kbtshoot kbexpertiseinter kbprb KB938465

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com