Hey guys, 

I've been having an issue with a client's ISA Server for the past couple of weeks and haven't been able to understand why this is happening.

They have a couple of ISA Servers Enterprise Edition in an array. This ISA Servers give Internet access to the entire company. They have significant amount of traffic through a Cisco Iron Port that all the users proxy settings are configured to this device and the Iron Port forwards the requests to the ISA Servers.

This implementation have been working fine for months, until a few weeks back that started to have slow response problems from the ISA Servers.  Analyzing the reports from the ISA Servers, I've noticed an increased amount of traffic a few times this has happened and mostly from the Iron Port. The Cisco people says this increase amount is due to the fact that the ISA Server stops responding and new requests are made at the moment from the device. We have configured the Iron port IP in the exceptions of the Flood Mitigation Settings of the ISA Server, and configure it to take more than 20,000 connections.

Still after this configuration, the same problem raised a couple of days back. The ISA Servers stops responding and they need to be forced shut down and restarted to get them back to work.

There are also some errors from some other internal IPs that it reaches maximum connection limits, but these are about 10 errors like this only. I was thinking maybe there are some infected computers or something but they said that they scanned the ones that show the errors and nothing is detected.

From the ISA reports of the time of the incident, I saw that it reached more than 15,000 concurrent connections. More than double of what it usually handles throughout the day.

I don't know if there is like a connection limit that the ISA can handle before it hangs of something? 

Is there any ideas on what can be happening with this? 

Thanks for any replies!

Hi,

Have you check the Event logs on the ISA Server? Any error?

You could use ISABPA to do some basic troubleshootings.

http://www.microsoft.com/en-hk/download/details.aspx?id=811

Best Regards,

I did checked for errors on the event logs but no information other than the IP addresses reaching maximum connections are given. 

I think for now the issue has been normalized, still dont know the root cause of this but if I find it out Ill let everyone know.

Thanks!