ISA Server 2006 drops the HTTP CONNECT request that is used to establish an SSL tunnel when DiffServ-based network traffic prioritization is enabled

In Microsoft Internet Security and Acceleration (ISA) Server 2006, you enable network traffic prioritization that is based on differentiated services (DiffServ). Then, an HTTP client establishes a TCP connection for HTTP communication that is not secured by the Secure Socket Layer (SSL) protocol. However, when the client reuses the TCP connection to try to establish an SSL tunnel, ISA Server 2006 drops the HTTP CONNECT request.

This problem occurs because the DiffServ filter cannot parse the URL when the HTTP client sends an HTTP CONNECT request on a TCP connection that has already been used for non-SSL communication. In this situation, the DiffServ filter stops trying to establish the SSL tunnel. The filter then sends a TCP FIN packet to the HTTP client.

To resolve this problem, apply the hotfix rollup package that is described in the following Microsoft Knowledge Base article:

To work around this problem, disable the DiffServ filter. To do this, follow these steps:

1. Click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
2. In the console tree, expand Microsoft Internet Security and Acceleration Server 2006.
3. If you are running ISA Server 2006 Enterprise Edition, expand Arrays, and then expand the node that corresponds to the array. If you are running ISA Server 2006 Standard Edition, expand the node that corresponds to the server.
4. Expand Configuration, and then click Add-ins.
5. In the details pane, click the Web Filters tab, click to select the DiffServ Filter item, and then click Disable selected Filters.
6. Click Apply.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

To enable the network traffic prioritization as the "Symptoms" section describes, perform the following actions:

• Enable the DiffServ filter.
• Enable the Enable the network traffic prioritization according to DiffServ (Quality of Service) bits option.
• Define at least one priority.