Archive

Archive for January, 2012

Resources for Migrating from Microsoft ISA Server to Forefront TMG 2010

January 24, 2012 Comments off

As Yuri Diogenes reminded us on his blog a few days ago, Microsoft ISA Server 2006 ended mainstream support on January 10, 2012, which leaves organizations without an extended support contract with no support for ISA Server 2006 at all. With that, planning a migration from ISA server to Forefront TMG 2010 has never been more urgent or important. To assist you in that endeavor, here are some resources that I’m certain you will find helpful:

Don’t wait! Start planning your migration from ISA Server 2006 to Forefront TMG 2010 today!

Forefront TMG 2010

Configuring SQL Memory Limits on Forefront TMG 2010

January 23, 2012 21 comments

When Forefront TMG 2010 is installed, an instance of SQL Server 2008 Express is also installed to facilitate local firewall and web proxy logging. Some TMG administrators have reported that the SQL server process (sqlservr.exe) may consume an excessive amount of memory.

This occurs because SQL server performs its own internal memory management. By design it will consume large amounts of memory and hold it in reserve, which may appear to be a memory leak. However, if you observe the memory consumed by SQL server over an extended period of time, you will notice that it will periodically release memory as well.

In most cases, allowing SQL to handle the job of managing its memory without restriction poses no real problem. However, if your system is exhibiting signs of high memory pressure and you are confident that there are no other processes that are consuming excessive amounts of memory, you can configure SQL to limit the amount of memory that it will reserve. Before manually configuring SQL memory limits, review this blog post for a list of recommended settings.

Next, open an elevated command prompt and enter the following command:

osql –E –S .\msfw

After connecting to the SQL instance, enter the following commands:

USE master
GO

EXEC sp_configure 'show advanced options', 1
RECONFIGURE WITH OVERRIDE
GO

EXEC sp_configure 'max server memory (MB)', 1024 --configure 1GB limit, adjust as needed
GO

EXEC sp_configure 'show advanced options', 0
RECONFIGURE WITH OVERRIDE
GO

This script assumes that you’ve chosen a 1GB (1024MB) memory limit. You can adjust the script above to reflect the values for your environment as required. Once complete, restart the SQL server service for the changes to take effect.

To view the currently configured memory limit, simply omit the numeric value after max server memory (MB), as shown here:

EXEC sp_configure 'max server memory (MB)'

To make things easier you can download these as script files and execute them using the following command:

osql –E –S .\msfw -i <path to script file>

You can find script files to show and set SQL memory limits here:

showsqlmem.sql
setsqlmem.sql

Hotfix Rollup 1 for Forefront TM 2010 SP2 Now Available

January 16, 2012 Comments off

A hotfix rollup for Forefront TMG 2010 SP2 is now available. The hotfix rollup resolves several reported issues with TMG, including:

KB2654016 – A client may be unsuccessful in accessing a Java SSO application published to the web by Forefront TMG 2010

KB2653703 – “Error: Subreport could not be shown” error message in the User Activity or Site Activity report in Forefront TMG 2010

KB2654585 – UDP packets may become backlogged when you increase the “maximum concurrent UDP sessions per IP address” setting in Forefront TMG 2010

KB2624178 – Forefront TMG 2010 administrators may be unable to generate reports

KB2636183 – Both sides of a TCP connection are closed when the client or remote application half-closes the TCP connection in Forefront TMG 2010

KB2653669 – Summary information for the Top Overridden URLs table and for the Top Rule Override Users table display incorrect information in Forefront TMG 2010

KB2617060 – Forefront TMG 2010 enables L2TP site-to-site connections in RRAS

KB2655951 – Japanese characters in the subject line of an Alert email message are not readable in the Japanese version of Forefront TMG 2010

KB2654068 – “The Web Listener is not configured to use SSL” warning message may occur when you configure a Web Listener to use a valid SSL certificate in Forefront TMG 2010

KB2654193 – You receive a “Bad Request” error message when you try to access Outlook Web App published by Forefront TMG 2010

KB2654074 – String comparison may become case-sensitive when you published a website using Forefront TMG 2010

KB2658903 – Forefront TMG 2010 firewall service (wspsrv.exe) may crash frequently for a published website secured by SSL after you install Service Pack 2.

Hotfix rollup 1 for Forefront TMG 2010 SP2 can be downloaded here. After applying this update, the new Forefront TMG 2010 build number will be 7.0.9193.515.

TrainSignal Forefront TMG 2010 Training

January 9, 2012 2 comments

Are you looking for Forefront TMG 2010 training? If so, take a look at TrainSignal’s Forefront TMG 2010 training package. This is a comprehensive video training course that includes 8 hours of video instruction over 21 modules. Scott Lowe does an excellent job of delivering the course, which is available online and on disc. I had the privilege of serving as the technical reviewer for this video training series, so I can assure you the material is exceptional.

If you are planning to deploy Forefront TMG 2010 in the future, or perhaps you are considering a migration from previous versions of ISA server to Forefront TMG 2010, the TrainSignal Forefront TMG 2010 video training series is an excellent investment. Check it out now!

Error 0xc0040431 When Creating a Forefront TMG 2010 Enterprise Array

January 3, 2012 8 comments

When attempting to join a Forefront TMG 2010 enterprise edition firewall to an Enterprise Management Server (EMS) managed array, you may encounter one of the following error messages:

The operation failed.
Error: 0xc0040431
Forefront TMG Services failed to start after array join or an array
disjoin. Check alerts, fix the configuration, and attempt to restart the
services.

The operation failed.
Error: 0xc0040410
The file cannot be imported because the enterprise management mode is
2010SP1 in the exported file and 2008-only in the stored configuration.

You may also encounter one of the following error messages when attempting to create a standalone array with two or more Forefront TMG 2010 enterprise edition firewalls:

The operation failed.
Error: 0x80004002
No such interface supported

The operation failed.
Error: 0xc0040410
The file cannot be imported because the enterprise management mode is
in the exported file and in the stored configuration.

Any of these errors can occur when you attempt to join a pre-SP2 Forefront TMG 2010 firewall to an EMS-managed array running Forefront TMG SP2, or when you attempt to create a standalone array with one node running Forefront TMG SP2 and another node running SP1.

To resolve this issue, make certain that Forefront TMG 2010 firewalls are all at the same service pack and update level before joining an EMS-managed array or creating a standalone array. For information about determining which version of ISA or TMG is installed, refer to one of the following blog posts:

https://tmgblog.richardhicks.com/2010/10/11/how-to-determine-tmg-version/
https://tmgblog.richardhicks.com/2010/12/03/more-about-determining-tmg-version-numbers/

For a documented reference of ISA and TMG build numbers, click here.