ISA Server dropping packets as it believes they are spoofed

Posted by RB on Server Fault See other posts from Server Fault or by RB
Published on 2010-05-26T16:05:36Z Indexed on 2010/05/26 16:11 UTC
Read the original article Hit count: 377

Filed under:

isa

|

isa-2004

|

packetloss

|

spoofing

We have ISA Server 2004 running on Windows Server 2003 SP2.

It has 2 NICs - one internal called LAN on 192.168.16.2, with a subnet of 255.255.255.0, and one external called WAN on 93.x.x.2. The default gateway is 93.x.x.1 (our modem). This machine also accepts VPN connections.

We are having a problem with a scanner, which is trying to save a scan into a network share.

Every time we try to scan, ISA Server logs the following Denied Connection

Log type: Firewall service
Status: A packet was dropped because ISA Server determined that the source IP address is spoofed.
Rule:
Source: Internal ( 192.168.16.54:1024)
Destination: Internal ( 192.168.16.255:137)
Protocol: NetBios Name Service

Pinging 192.168.16.54 from the ISA Server works fine.

In ISA Server, going into Configuration → Networks, there are 5 Networks : - External (inbuilt) - Internal (defined as 192.168.16.0 → 192.168.16.255) - Local Host (inbuilt) - Quarantined VPN Clients (inbuilt) - VPN Clients (inbuilt)

Finally, under Network Connections → Advanced → Advanced Settings..., the connections are in the following order : - LAN - WAN - [Remote Access Connections]

If we try to scan onto a workstation it works fine.

Please let me know if you need any more info - many thanks.

RB.

© Server Fault or respective owner

Related posts about isa

How to have internet connection over VPN while "Microsoft Firewall Client for ISA server" is running

as seen on Server Fault - Search for 'Server Fault'
I have the software mentioned in the title running on my machine. When I connect over VPN to my company's network, my internet connection gets borked, because somehow the ISA firewall blocks it. This is completely idiotic, because my work involves extensive use of the internet, so having to disconnect… >>> More
TeamCity EC2 Integration via ISA Server

as seen on Server Fault - Search for 'Server Fault'
I have a TeamCity server which is actually installed on SBS 2003 Premium with ISA Server (firewall/proxy) installed. My ADSL connection has multiple IP addresses, which all resolve directly to my SBS external NIC. The NIC is therefore multi-homed and I have allocated one of the IP addresses specifically… >>> More
ISA forms authentication problems after installing moss sp2

as seen on Server Fault - Search for 'Server Fault'
Guys I have a problem that's flared back up after installing WSS and MOSS service pack 2. The problem centers around the users being prompted to enter credentials when interacting with office documents. This problem came up before and I was able to go into ISA server and configure a persistent cookie… >>> More
No sound after video card replaced (AMD Radeon HD 7770)

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
Issue: no sound System: Dual boot Windows 7 (sda) Ubuntu 12.04 (sdb) 2 harddrives Dell XPS 730 Video card: AMD Radeo HD 7770 Diamond Multimedia Sound card: Creative Labs SB X-Fi Additional info: My sound used to work. Then, my old video card (NVIDIA geforce 280) died. I bought and… >>> More
Moose ,isa and regex

as seen on Stack Overflow - Search for 'Stack Overflow'
Can I use isa in Moose with a regex as a parameter ? If not possible can I achieve the same thing with someothing other than ->isa ? >>> More

Related posts about isa-2004

Exchange 2010 Deployment Notes - ISA 2004 Server Issue

as seen on Geeks with Blogs - Search for 'Geeks with Blogs'
An interesting ISA 2004 tidbit … While we were setting up our Exchange 2010 ActiveSync environment, we encountered a problem where we could not successfully telnet over port 443 from one of our ISA 2004 Servers to our Exchange 2010 Client Access Server Array. When we tried to telnet… >>> More
Microsoft ISA 2004 - Failed Connection Attempt

as seen on Server Fault - Search for 'Server Fault'
I have an issue where users with Android tablet cannot download apps through ISA 2004. This is what I get from the ISA 2004 logging: I did try to add the source ip address and the destination ip address in All for All Modified rule. However, it does not fix that problem. I also use GFI Web Monitoring… >>> More
isa 2004 - banned site rule cause slow internet

as seen on Server Fault - Search for 'Server Fault'
Hi Gods, We have windows server 2003 with isa 2004. Our clients uses internet with proxy. We have two isa rule: order name action protocolls from/listener to condition 1. trafic ALLOW all outbound all networks all networks… >>> More
ISA - Why do i suddenly need to specify settings on the client machines?

as seen on Server Fault - Search for 'Server Fault'
Have been pulling my hair out over this one for hours, and wondering if someone can help. I have a server with two network interfaces that was running isa 2004 and humming until i installed sbs service pack + isa 2004 service pack 3. Grrrrrrrrrr I can get the client machines to connect to the internet… >>> More
ISA Server dropping packets as it believes they are spoofed

as seen on Server Fault - Search for 'Server Fault'
We have ISA Server 2004 running on Windows Server 2003 SP2. It has 2 NICs - one internal called LAN on 192.168.16.2, with a subnet of 255.255.255.0, and one external called WAN on 93.x.x.2. The default gateway is 93.x.x.1 (our modem). This machine also accepts VPN connections. We are having a problem… >>> More