FIX: New connections are not accepted on a specific web proxy or web listener in Threat Management Gateway 2010

A server that is running Microsoft Forefront Threat Management Gateway (TMG) 2010 may stop accepting new connections on a specific web proxy or web listener. This problem may occur after several hours to several days of server uptime.
This problem occurs when TMG stops accepting new connections on the web listener. This soon fills the backlog queue for the ancillary function driver (AFD) socket. After the backlog queue is full, the server starts to reset new incoming connections. If you monitor the server by using Network Monitor in this situation, you may notice a SYN, ACK/RST pattern for each new connection attempt.
To resolve this problem, install Rollup 5 for Forefront Threat Management Gateway (TMG) 2010 Service Pack 2.
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
More information
After you install Rollup 5, you must enable the functionality to time out idle accept calls. To do this, follow these steps:
  1. Copy the following script into Notepad, and then save the file as SetAcceptIdleTimeout.vbs:
    'Define the constants needed.Const strVpsGUID = "{143F5698-103B-12D4-FF34-1F34767DEABC}"Const strVpsPropertyName = "AcceptIdleTimeout"Const Error_FileNotFound = &H80070002Set objArgs = wscript.Argumentsif objArgs.Count > 0 then    uAcceptIdleTimeout = objArgs(0)end ifif objArgs.Count <> 1 then    wscript.echo "Usage: SetAcceptIdleTimeout.vbs <timeout>"    wscript.echo    wscript.echo "Set async accept timeout to <timeout> value (in sec)"    wscript.echo "To disable async accept timeout set it to 0"    wscript.Quit 2end ifset objArray = CreateObject("FPC.Root").GetContainingArray()Set objVPSet = OpenVPSet(objArray, strVpsGUID)objVPSet.Value(strVpsPropertyName) = uAcceptIdleTimeoutobjArray.Save()objArray.RestartServices(1)function OpenVPSet(objParent, strVpsGUID)    Set objVPSets = objParent.VendorParametersSets    On Error Resume Next    Set OpenVPSet = objVPSets.Item(strVpsGUID)    ' Save the Err properties in case it needs to be re-raised    errNumber      = Err.Number    errSource      = Err.Source    errDescription = Err.Description    errHelpFile    = Err.HelpFile    errHelpContext = Err.HelpContext        On Error GoTo 0        if errNumber = Error_FileNotFound Then        Set OpenVPSet = objVPSets.Add(strVpsGUID)    Elseif errNumber < 0 Then        ' An error other than "file not found" occurred -- re-raise the error,        ' this time not under "On Error Resume Next"        Err.Raise errNumber, errSource, errDescription, errHelpFile, errHelpContext    End Ifend function

  2. Run the script on one of the TMG servers. For example to set the time-out period to 5 minutes, run the following from an administrative command prompt:

    cscript.exe SetAcceptIdleTimeout.vbs 300
  3. To make this change take effect, restart the firewall service on all array members.

To undo this change, run the following command to set the idle time-out to 0:

cscript.exe SetAcceptIdleTimeout.vbs 0

Learn about the terminology that Microsoft uses to describe software updates.

Article ID: 2967726 - Last Review: 06/21/2015 17:36:00 - Revision: 2.0

Microsoft Forefront Threat Management Gateway 2010 Enterprise, Microsoft Forefront Threat Management Gateway 2010 Standard

  • kbqfe kbfix kbexpertiseinter kbbug kbsurveynew KB2967726