Re: Firewall Shutdown - Please help

It sounds like you have an MSDE problem since both the firewall logging and
SharePoint seem to be complaining. Anything more informative in the logs?
Also, see
http://eventid.net/display.asp?eventid=21192&eventno=7738&source=Microsoft%20Firewall&phase=1

The default ISA configuration shuts down ISA if logging fails. IMO this is
overkill in a small business. You can have it report a log failure to the
event logs unless you have a situation where you feel 100% uptime for
firewall logging is necessary.

Open the ISA console and click Monitoring in the left pane. In the right
pane, click Configure Alert Definitions. Click Log Failure -> Edit ->
Actions. Clear the "Stop selected services" box to prevent ISA from
stopping when logging fails.


"AAS" <AAS@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:BC98FACA-2E69-4A2E-8F5F-5AC95350F389@xxxxxxxxxxxxxxxx
I have a small consulting firm and use SBS 2003 Premium Edition.
Unfortunately, while I was on travel the last two weeks, the firewall
service
kept shutting down every couple of days and i had to have my employees
reboot
the server so that i could connect to it. in addition my exchange was
also
down. I discovered the following errors in the event log:

Source: Microsoft Firewall Event ID: 21192
The Microsoft Firewall was unable to connect to MSDE database. The MSDE
Error description is: Timeout expired.

Source: Windows Sharepoint Server Event ID: 1000
#50070: Unable to connect to the database STS_CONCORRFS01_1 on
CONCORRFS01\SharePoint. Check the database connection information and
make
sure that the database server is running.

Source: Microsoft Firewall Event ID: 14182
The Firewall service was stopped gracefully.

Source Microsoft ISA Server Control Event ID: 14079
Due to an unexpected error, the service fwsrv stopped responding to all
requests. Stop the service or the corresponding process if it does not
respond, and then start it again. Check the Windows event Viewer for
related
error messages.

Source Microsoft Firewall Event ID: 15108
ISA Server detected a spoof attack from Internet Protocol (IP) address
12.110.82.179. A spoof attack occurs when an IP address that is not
reachable
via the interface on which the packet was received. If logging for dropped
packets is set, you can view details in the packet filter log.

As i travel a lot, i really cannot afford to have the firewall go down
like
this. So i changed the default values in the Firewall Service to restart
after a failure.

Any help will be greatly appreciated.

Thanks in advance


--
AAS


.

Relevant Pages

  • Re: Firewall Shutdown - Please help
    ... The default ISA configuration shuts down ISA if logging fails. ... Unfortunately, while I was on travel the last two weeks, the firewall ... Source: Microsoft Firewall Event ID: 21192 ... The Microsoft Firewall was unable to connect to MSDE database. ...
    (microsoft.public.windows.server.sbs)
  • Re: Firewall Shutdown - Please help
    ... The default ISA configuration shuts down ISA if logging fails. ... Unfortunately, while I was on travel the last two weeks, the firewall ... Source: Microsoft Firewall Event ID: 21192 ... The Microsoft Firewall was unable to connect to MSDE database. ...
    (microsoft.public.windows.server.sbs)
  • Re: Firewall Shutdown - Please help
    ... The default ISA configuration shuts down ISA if logging fails. ... Unfortunately, while I was on travel the last two weeks, the firewall ... Source: Microsoft Firewall Event ID: 21192 ... The Microsoft Firewall was unable to connect to MSDE database. ...
    (microsoft.public.windows.server.sbs)
  • Re: Data Mining for PIX Firewall Logs
    ... Data Mining for PIX Firewall Logs ... > Can anyone here please suggest to me some type of logging and more ...
    (Pen-Test)
  • RE: [fw-wiz] Log checking?
    ... tend to evaluate where and what logging is important in a different light. ... I've been happy to analyze a year's worth of firewall denied logs, ... have denied firewall traffic logs or denied logs with any relevant data. ...
    (Firewall-Wizards)
Loading