A long time delay occurs when you reconnect an IPSec connection from a computer that is running Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, or Windows Server 2008 R2

Consider the following scenarios.

Scenario 1

• You have a Windows Server based cluster that uses Windows Network Load Balancing, Failover Clustering, a hardware load balancer, or a hardware cluster product.
• You establish an Internet Protocol Security (IPsec) connection to the cluster virtual IP from a computer that is running one of the following operating systems:
  • Windows Server 2003
  • Windows Vista
  • Windows Server 2008
  • Windows 7
  • Windows Server 2008 R2
• One node fails in the cluster, or you manually restart the node, or you fail the node so that another node picks up the client connection.

Scenario 2

• A non-cluster Windows Server 2003-based operating system restarts in less than 6 minutes (such as a virtual machine), or restarts automatically within 6 minutes after a Stop error occurs.
• You establish an IP security (IPsec) connection to the operating system from another computer that is running one of the following operating systems:
  • Windows Server 2003
  • Windows Vista
  • Windows Server 2008
  • Windows 7
  • Windows Server 2008 R2

In these scenarios, you experience a long time delay (about two or three minutes) when the client computer reestablishes the IPsec connection to the cluster in scenario 1 and the non-cluster computer in scenario 2.

This issue occurs because IPsec is not optimally designed for reconnection scenarios. A large time-out value is associated with the current IPSec security association (SA). We also try an additional negotiation which has to time out.

After you install the hotfix package, you must create the following registry subkeys on the Windows Server 2003-based client computer:Or, create the following registry subkeys on the client computer that is running Windows Vista, Windows Server 2008, Windows 7, or Windows Server 2008 R2: To do this, follow the steps that are described in the Registry information section.

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

To apply this hotfix, you must be running one of the following operating systems:

• Windows Server 2003 Service Pack 2 (SP2)
• Windows Vista Service Pack 2 (SP2)
• Windows Server 2008 Service Pack 2 (SP2)
• Windows 7
• Windows 7 Service Pack 1 (SP1)
• Windows Server 2008 R2
• Windows Server 2008 R2 Service Pack 1 (SP1)

For more information about how to obtain a Windows Server 2003 service pack, click the following article number to view the article in the Microsoft Knowledge Base: For more information about how to obtain a Windows Vista service pack, click the following article number to view the article in the Microsoft Knowledge Base: For more information about how to obtain a Windows Server 2008 service pack, click the following article number to view the article in the Microsoft Knowledge Base: For more information about how to obtain a Windows 7 or Windows Server 2008 R2 service pack, click the following article number to view the article in the Microsoft Knowledge Base:

Registry information

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: After you install the hotfix package, you must create the following two registry subkeys on the Windows Server 2003-based client computer:

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPSec\NlbsIdleTime
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent\Oakley\NlbsIdle

To do this, follow these steps:

1. Click Start, click Run, type Regedit, and then click OK.
2. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPSec
3. On the Edit menu, point to New, and then click DWORD Value.
4. Type NlbsIdleTime, and then press ENTER.
5. Right-click NlbsIdleTime, and then click Modify.
6. In the Value data box, type 5, and then click OK.
   
   Note The range of values is from 5 to 60.
7. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent\Oakley
8. On the Edit menu, point to New, and then click DWORD Value.
9. Type NlbsIdle, and then press ENTER.
10. Right-click NlbsIdle, and then click Modify.
11. In the Value data box, type 1, and then click OK.
12. Exit Registry Editor.

After you install the hotfix package, you must create the following registry subkey on the client computer that is running Windows Vista, Windows Server 2008, Windows 7, or Windows Server 2008 R2:To do this, follow these steps:

1. Click Start, click Run, type Regedit, and then click OK.
2. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IKEEXT\Parameters\
3. In the Edit menu, point to New, and then click DWORD Value.
4. Type NlbsIdleTime, and then press ENTER.
5. Right-click NlbsIdleTime, and then click Modify.
6. In the Value data box, type a value between five and 60, and then click OK.

Note This value governs the quick mode SA idle time-out limit for SAs to cluster peers that are identified by the Network Load Balancing (NLB) vendor ID. This value also determines whether the hotfix is enabled or not. Without this registry entry setting, the changes in the hotfix are not enabled.

After the quick mode SA times out, the client computer tries another quick mode negotiation two times in a period of three seconds. If the quick mode negotiations fail, a main mode negotiation is tried. This behavior works for usual cluster node migration scenarios, and the failover time is about 15 seconds. However, the Server node may not actually crash. For example, the server node may be busy, or there may be heavy network traffic. Therefore, the Server node cannot respond. In these situations, a fresh main mode negotiation is an additional overhead. If you encounter this issue, you may increase the duration of the quick mode negotiation attempts to a value greater than the default three seconds. To do this, configure the following registry entry. Without the following registry entry, the default value of three seconds is applied.

To create the following registry entry if you have to increase the QM retransmission duration, follow these steps:

1. Click Start, click Run, type Regedit, and then click OK.
2. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IKEEXT\Parameters\
3. On the Edit menu, point to New, and then click DWORD Value.
4. Type NlbsQMRetransmitDuration, and then press ENTER.
5. Right-click NlbsQMRetransmitDuration, and then click Modify.
6. In the Value data box, type a value between three and 60 and then click OK.

Note You must make sure that the following registry subkeys exist on all Windows Server based cluster nodes and that the value of the registry subkey is 1 when you create an IPSec connection to a cluster node. This enables the client computers to identify the connection to a cluster resource.

For Windows Server 2003-based cluster nodes or non-cluster servers:

Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent\Oakley\

Name: nlbsflags

Type: REG_DWORD

Value: 1

For Windows Server 2008-based or Windows Server 2008 R2-based cluster nodes or non-cluster servers:

Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IKEEXT\Parameters\

Name: nlbsflags

Type: REG_DWORD

Value: 1

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace a previously released hotfix.

File information

The global version of this hotfix installs files that have the attributes that are listed in the following tables. The dates and the times for these files are listed in Coordinated Universal Time (UTC). The dates and the times for these files on your local computer are displayed in your local time together with your current daylight saving time (DST) bias. Additionally, the dates and the times may change when you perform certain operations on the files.

Windows Server 2003 file information notes

• In addition to the files that are listed in these tables, this hotfix also installs an associated security catalog file (KBnumber.cat) that is signed with a Microsoft digital signature.

For all supported x86-based versions of Windows Server 2003

For all supported x64-based versions of Windows Server 2003

For all supported IA-64-based versions of Windows Server 2003

Windows Vista and Windows Server 2008 file information notes

Important Windows Vista hotfixes and Windows Server 2008 hotfixes are included in the same packages. However, only "Windows Vista" is listed on the Hotfix Request page. To request the hotfix package that applies to one or both operating systems, select the hotfix that is listed under "Windows Vista" on the page. Always refer to the "Applies To" section in articles to determine the actual operating system that each hotfix applies to.

• The files that apply to a specific product, SR_Level (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table.
  Collapse this tableExpand this table

  Version	Product	SR_Level	Service branch
  6.0.600 2 . 22xxx	Windows Vista and Windows Server 2008	SP2	LDR

• The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately in the "Additional file information for Windows Server 2008 and for Windows Vista" section. MUM files and MANIFEST files, and the associated security catalog (.cat) files, are extremely important to maintain the state of the updated components. The security catalog files, for which the attributes are not listed, are signed with a Microsoft digital signature.

For all supported x86-based versions of Windows Server 2008 and of Windows Vista

For all supported x64-based versions of Windows Server 2008 and of Windows Vista

For all supported IA-64-based versions of Windows Server 2008

Windows 7 and Windows Server 2008 R2 file information notes

• The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.1.760 0.16xxx	Windows 7 and Windows Server 2008 R2	RTM	GDR
  6.1.760 0.20xxx	Windows 7 and Windows Server 2008 R2	RTM	LDR
  6.1.760 1.17xxx	Windows 7 and Windows Server 2008 R2	SP1	GDR
  6.1.760 1.21xxx	Windows 7 and Windows Server 2008 R2	SP1	LDR

• GDR service branches contain only those fixes that are widely released to address widespread, extremely important issues. LDR service branches contain hotfixes in addition to widely released fixes.
• The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately in the "Additional file information for Windows Server 2008 R2 and for Windows 7" section. MUM and MANIFEST files, and the associated security catalog (.cat) files, are extremely important to maintain the state of the updated components. The security catalog files, for which the attributes are not listed, are signed with a Microsoft digital signature.

For all supported x86-based versions of Windows 7

For all supported x64-based versions of Windows 7 and of Windows Server 2008 R2

For all supported IA-64-based versions of Windows Server 2008 R2

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base: For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Additional file information

Additional file information for Windows Vista and for Windows Server 2008

Additional files for all supported x86-based versions of Windows Vista and of Windows Server 2008

Additional files for all supported x64-based versions of Windows Vista and of Windows Server 2008

Additional files for all supported IA-64-based versions of Windows Server 2008

Additional file information for Windows 7 and for Windows Server 2008 R2

Additional files for all supported x86-based versions of Windows 7

Additional files for all supported x64-based versions of Windows 7 and of Windows Server 2008 R2

Additional files for all supported IA-64-based versions of Windows Server 2008 R2