Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running IIS 7.5 on Server 2008 R2 virtualized on a Windows Core 2008 R2 server on Intel server hardware sitting behind a Sonicwall firewall.

For a number of months now, we've had a trickle of customers (maybe one per week) contact us to say that they can't access the website. When this happens I immediately start diagnosing the problem and here's what I find:

  1. I can access the website.
  2. Our support staff at other locations can access the website.
  3. Presumably (because we don't hear from them), other customers can access the website.
  4. The customer can ping and tracert to the server.
  5. The customer cannot access other websites on the same server that share the same IP address.
  6. The customer can access other websites on the same server that use different IP addresses.
  7. iisreset does not resolve the problem.
  8. Resetting the customer's router does not resolve the problem.
  9. Flushing our firewall's ARP cache does not resolve the problem.
  10. Changing the customer's browser and/or rebooting his machine does not resolve the problem.
  11. Switching to a different computer behind the customer's router does not resolve the problem.
  12. In 15 - 30 minutes the problem somehow magically resolves itself and the customer can once again access the website.
  13. When it fails, the customer sees a timeout message and the IIS logs show no record of the request at all.

Other notes:

  1. There doesn't seem to be a pattern as to which customers this problem affects.
  2. We are not using load balancing.
  3. Except for the firewall, there is no other security software/hardware in front of IIS.
  4. The IIS VM has all the latest Windows Updates.
  5. The Server Core installation has all the latest Windows Updates.
  6. The Sonicwall is running the latest firmware.

Things I suspect may be the problem:

  1. If the customer's browser was incorrectly resolving the DNS for the website that could cause all of the above problems. Next time it happens I'll use Fiddler to verify the IP address the browser is trying to connect to. Not sure why ping would then be able to resolve it correctly from the command line though.
  2. Perhaps the Sonicwall is somehow blocking the connection. If this is the case, it is blocking only a specific source IP + destination IP + protocol, and only for 15 - 30 minutes. I do not have any of the Sonicwall's advanced filtering services licensed/activated. I can potentially test this theory by resetting the Sonicwall while the problem is happening, which is a bit of a scary proposition considering the other users accessing the server at the same time.
  3. Perhaps the virtual network connection between Server Core (the host O/S) and Server 2008 R2 (the guest O/S) is somehow blocking the connection for some period of time. Not sure how I can test/diagnose this one.
  4. Maybe some weird problem with the NIC drivers on the host machine? Not sure how to test this one either.
share|improve this question
3  
Are there any security/IPS/IDS/fail2ban like systems running that might be locking out specific clients? –  John K Jul 24 '12 at 19:24
    
Good point, I've updated the notes in the question above. –  Mike Jul 24 '12 at 19:25
    
I still suspect the firewall blocking the traffic. Look at the logs. –  MichelZ Jul 24 '12 at 20:03
3  
Have you tried recycling the Sonicwall, or possibly setting it on fire and dropping it into an outhouse where it belongs? I've had similar issues on every Sonicwall I've ever had the misfortune of administering, and rebooting or recycling the services on the thing would fix the problem temporarily, while the solution ultimately ended up being a real firewall. Not sure how helpful that is, but based on my experiences, I'd start troubleshooting by removing the Sonicwall from the mix and seeing if that doesn't solve the problems. –  HopelessN00b Jul 24 '12 at 21:01
1  
Have you checked to see if the clients are running a particular web browser? It could be a browser or addon that is interfering with something. –  Bad Dos Jul 24 '12 at 22:36
show 8 more comments

1 Answer

up vote 0 down vote accepted

It's not a very satisfying resolution, but I wound up moving from the virtualized solution I described above to a standalone server and so far the problem has gone away. I don't know if it was a problem with the previous host machine's network card, the virtual network adapter sitting between the VM and the host machine, or something else entirely, but for the moment things are running smoothly. If the problem pops up again I'll update this question/answer.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.