Re: problems with KB951746

Okay....so time to dig deeper.

You originally posted this a couple weeks ago as a different thread. "Attn: Susan Bradley" or somesuch. As I recall, it was ONE SBS server and as of the end of the week last week, you had decided to contact Microsoft CSS. So, my questions are:

1) What did CSS say?
2) Did you make changes to the other three servers within the last week? I'm trying to pinpoint why the problem has spread...
3) Do any of the four servers run *without* ISA? I'd like to troubleshoot on a network as 'clean' as possible...
4) Do all four servers connect to the internet using the same ISP?

-Cliff


"Gary Karasik" <gkarasik@xxxxxxx> wrote in message news:ug9WDl0$IHA.1180@xxxxxxxxxxxxxxxxxxxxxxx
Agreed. But in this case it's moot. The issue persists even if both firewalls are bypassed.

--

GaryK


"Cliff Galiher" <cgaliher@xxxxxxxxx> wrote in message news:hIadnXIUU8UcpjvVnZ2dnUVZ_j6dnZ2d@xxxxxxxxxxxxxx
Depends on how aggressive the firewall is with its intrusion prevention measures. Blocking legitimate IP addresses responding on ports the firewall doesn't expect will cause problems. And three or more people using the net will cause the firewall to block IPs more rapidly. Never *assume* that the problem isn't somewhere. Test and verify...test and verify... :)

-Cliff

"Gary Karasik" <gkarasik@xxxxxxx> wrote in message news:u7%23gyc0$IHA.3756@xxxxxxxxxxxxxxxxxxxxxxx
Also, if this were a firewall issue, I think it would be there all the time, not just when the system is under load.

--

GaryK


"Cliff Galiher" <cgaliher@xxxxxxxxx> wrote in message news:I5OdnRWuYKkGijvVnZ2dnUVZ_uqdnZ2d@xxxxxxxxxxxxxx
Gary,

I doubt the patch, or SBS, is the problem here. What I suspect is happening is that the patch is doing what it is supposed to do. But one of the things the patch does is cause the source port to be randomized. If your firewall is not configured to allow DNS traffic from a random source port then your recursive DNS requests are being stopped at the firewall...and you'll get the symptoms you describe. It is also possible, but less likely, that your ISP's DNS servers are misconfigured and are unable to reply on odd source ports.

So this is where I'd start....look at your network perimeter and see if you can verify there is a firewall issue.
Then, if you are CONFIDENT that you are okay there and the speed issue remains, reconfigure SBS (CEICW) and point it to another DNS server that is known to be patched and working (openDNS is a good option here).

Let me know if that helps,

-Cliff

I'm fairly confident you'll be able to fix the issue from there.
"Gary Karasik" <gkarasik@xxxxxxx> wrote in message news:%236rvj2y$IHA.5660@xxxxxxxxxxxxxxxxxxxxxxx
Hi,

I can't decide how to proceed with getting this problem solved. Wien the server-side DNS-vulnerability patch (951746) is installed, all my SBS2K3 systems are exhibiting the same problem: extremely show internet access when the system is under load, meaning when three or more clients are trying to access the internet at once.

With the patch uninstalled everything returns to normal. This is not resolved by reserving ports as one fix suggests.

The problem seems to be that DNS can't resolve quickly when the patch is installed. Sometimes it is so slow that the system times out. I've tried different forwarders, different DNS servers, and root hints only. If the patch is installed, nothing helps.

Someone has posted a message about this in the SBS private forum, but he isn't getting much help.

My indecision stems from the fact that no symptoms show if there is no load, so if I call CSS after hours I can't show them any symptoms, and I don't want to load the patch during a work day because access is so slow that client work slows to a virtual standstill, the remote branches connections to Exchange server stop responding, and local clients can't do any work that involves the internet.

I think I'm just going to have to live with this and hope that MS comes up with a fix for someone else and I hear about it.

Maybe someone here can suggest an approach, because I'm stumped as to how to proceed.

--

GaryK










.

Relevant Pages

  • Re: problems with KB951746
    ... I don't run ISA on SBS and haven't for many years although I run it standalone in front of SBS quite a bit. ... What I suspect is happening is that the patch is doing what it is supposed to do. ... If your firewall is not configured to allow DNS traffic from a random source port then your recursive DNS requests are being stopped at the firewall...and you'll get the symptoms you describe. ... It is also possible, but less likely, that your ISP's DNS servers are misconfigured and are unable to reply on odd source ports. ...
    (microsoft.public.windows.server.sbs)
  • Re: problems with KB951746
    ... What I suspect is happening is that the patch is doing what it is supposed to do. ... If your firewall is not configured to allow DNS traffic from a random source port then your recursive DNS requests are being stopped at the firewall...and you'll get the symptoms you describe. ... It is also possible, but less likely, that your ISP's DNS servers are misconfigured and are unable to reply on odd source ports. ... Then, if you are CONFIDENT that you are okay there and the speed issue remains, reconfigure SBS and point it to another DNS server that is known to be patched and working. ...
    (microsoft.public.windows.server.sbs)
  • Re: Need help with DNS design and settings
    ... about forest root and tree root domains. ... The name servers box is usually populated automatically (at least I ... thought so) with the DNS servers you have the AD integrated zones on. ... > forwarders for internet queries, I put the address of my 2 external DNS ...
    (microsoft.public.win2000.dns)
  • Re: Need help with DNS design and settings
    ... we often point all servers at the ... provided all DNS servers have a consistent copy of the zone. ... Name server box is only the servers authoritative for that zone. ... >>> forwarders for internet queries, I put the address of my 2 external DNS ...
    (microsoft.public.win2000.dns)
  • Re: How to host email using Exchange 2003
    ... > You Own SMTP Mail using Exchange 2000" and think the instructions will ... So their DNS your company is using is Internet "facing". ... record specific Emails servers. ... The ISP DNS servers will do the job of sending Internet mails out. ...
    (microsoft.public.exchange.setup)