Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have the following configuration:

  • Windows Server 2008 is installed on Vmware Esxi 4.1 server
    • physical machine - HP server with plenty of resources and no other VMs installed yet.
  • Server 2008 is a domain controller and has Forefront TMG 2010 installed
    • (by the way, is it a valid config?)
  • Forefront uses local dns server which serves internal AD infrastructure, and uses forwarders to ISP DNS
  • The server connects to a satellite modem idirect x3, via 100 Mbit unmanaged switch.

Periodically, Web pages start loading with a delay or fail altogether.

I think that it looks like DNS issue but I also think it's not. I've noticed that pinging internet addresses from the server itself at the time when the problem emerges shows the following results:

  • the first one or two ping fails and the rest work fine.
  • The next ping to the same domain name or ip address is completely successful.
  • And not a single ping is lost in a series of ping of any size of series after the initial connection is established.

The same thing is with web browsing - downloads of large files have stable speed.

The current type of network adapter is E1000. I'm going to try VMXNET3 today.

Maybe that is speed/duplex settings issue - I've tried both autonegotiate and 100 mb full duplex hard set.

By the way, is there a way to check the setting that the devices agreed upon after autonegotiation?

And I have to note the specifics of the satellite connection - ping time is approximately 600 ms. What I've already tried to do:

  • turned off tcp offloading
  • turned on mtu discovery

Any help will be greatly appreciated.

share|improve this question

In short, it sounds like a networking problem.

But... TMG's rule configuration might slow it down due to URL Filtering or DNS resolution interacting badly with your rule setup. For example, if your rules governing DNS resolution accidentally included a Domain Name Set that required DNS resolution, that's a Bad Situation to be in.

So the easiest way to identify whether that's an issue at all is to make a rule set that requires minimal processing, optimized for speed:

  • Globally turn off URL Filtering if it's enabled
    • if MRS is responding slowly, that'll affect the first access to any given URL
  • Create a rule Allow All Outbound From TMG To Anywhere
  • Create a rule Allow Web Protocols From Internal to Anywhere (assuming you have an Internal network defined as your inside subnet)
  • Create a rule Allow All Internal as Allow {TMG/Internal} to {TMG/Internal} - because it's a DC and cutting the DC off from the network is often Suboptimal

These rules should be ordered at the top of the Access Policy list, before any other rules.

  • Disclaimer: These rules assume a multi-NIC TMG setup with the Internal subnet configured correctly, and most likely an external firewall. IF IN DOUBT, HIRE A CONSULTANT THAT KNOWS TMG.

This combination will skip any DNS resolution for outbound traffic. If the situation is 100% improved by these changes, try changing one thing at a time, apply the change, and then wait at least 5 minutes to ensure it's had time to take effect before deciding whether it was helpful, hurtful, or didn't make a difference.

share|improve this answer
In other words, perform standard troubleshooting. – SpacemanSpiff Jun 22 '12 at 12:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.