ISA Server or Microsoft Forefront Threat Management Gateway, Medium Business Edition prevents a file from being downloaded, and the "FWX_E_ABORTIVE_SHUTDOWN" error code is logged

Applies to: Microsoft Forefront Threat Management Gateway Medium Business Edition

Symptoms


A Web browser client is located behind a server that is running Microsoft Internet Security and Acceleration (ISA) Server or Microsoft Forefront Threat Management Gateway, Medium Business Edition. When this client tries to download a file from an external Web site, ISA Server or Microsoft Forefront Threat Management Gateway, Medium Business Edition prevents the file from being downloaded. Additionally, the Firewall service returns following error code. This error code appears as a result code in the ISA Server or Microsoft Forefront Threat Management Gateway, Medium Business Edition log:
FWX_E_ABORTIVE_SHUTDOWN
Note This error code represents the following error description:
A connection was abortively closed after one of the peers sent an RST packet.
A network trace of the problem may resemble the following:
Frame(s)DirectionComments
1ISA <-> SvrTCP handshake
2ISA <-> SvrHttp: Request, GET test.php
3Svr -> ISATCP_ACK to frame #2
4Svr -> ISAHttp: Response, HTTP/1.1, Status Code = 200
ProtocolVersion: HTTP/1.1
StatusCode: 200, Ok
Reason: OK
Server: Microsoft-IIS/5.0
Date: Date Time
Connection: close
XPoweredBy: PHP/4.3.10
ContentType: application/octetstream
ContentLength:
Content-Disposition: attachment; filename="FileName"
HeaderEnd: CRLF
5ISA -> SvrTCP_FIN_ACK
6Svr -> ISA Http: HTTP Payload (attachment referenced in frame 4 content-disposition header)
7ISA -> SvrTCP_RST

Cause


This problem occurs if the HTTP response from the Web server does not include the file size in the ContentLength header. This situation may occur if the Web server is not RFC-compliant.

The network trace shows the following:
  • In frame 4,the ContentLength header does not include the file size.
  • In frame 5,the server closes its end of the connection by sending a FIN_ACK response to the upstream server.
  • In frame 7, the server sends an RST packet to the upstream server. Therefore, ISA Server or Microsoft Forefront Threat Management Gateway, Medium Business Edition logs the FWX_E_ABORTIVE_SHUTDOWN error code.

More Information


This problem occurs even in the following situations:
  • You create a new protocol definition for port 80, and you do not include a proxy filter.
  • You directly disable the Web Proxy filter.