We have ISA Server 2004 running on Windows Server 2003 SP2.

It has 2 NICs - one internal called LAN on, with a subnet of, and one external called WAN on 93.x.x.2. The default gateway is 93.x.x.1 (our modem). This machine also accepts VPN connections.

We are having a problem with a scanner, which is trying to save a scan into a network share.

Every time we try to scan, ISA Server logs the following Denied Connection

  • Log type: Firewall service
  • Status: A packet was dropped because ISA Server determined that the source IP address is spoofed.
  • Rule:
  • Source: Internal (
  • Destination: Internal (
  • Protocol: NetBios Name Service

Pinging from the ISA Server works fine.

In ISA Server, going into Configuration → Networks, there are 5 Networks : - External (inbuilt) - Internal (defined as → - Local Host (inbuilt) - Quarantined VPN Clients (inbuilt) - VPN Clients (inbuilt)

Finally, under Network Connections → Advanced → Advanced Settings..., the connections are in the following order : - LAN - WAN - [Remote Access Connections]

If we try to scan onto a workstation it works fine.

Please let me know if you need any more info - many thanks.



I strongly suspect that your scanning problem has nothing to do with the ISA firewall, and more to do with SMB protocol security restrictions on the server computer where you're attempting to target the scan. I suspect this because, primarily, I'm guessing that the server you're attempting to send the scans to has a IP address and, as such, communication between the scanner and the server won't need to move through the ISA Server.

The dropped packet is almost certainly a red herring.

The packet you're seeing dropped there is a NetBIOS name service-related broadcast. These are normal packets generated by implementations of the Microsoft file and print sharing protocol, SMB. This makes me wonder if you have a layer 2 connection between the "outside" network segment and your "inside" network segment and broadcasts from the "inside" are also showing up on the "outside" segment, too. Running a sniffer on the "outside" segment would tell you that quickly and easily. Is "the modem" attached directly to the ISA Server computer, or do you have it plugged into a switch/hub that might have other connections?

Most crappy copier/MFP devices that I've worked with require SMB signing to be disabled on the server computer to enable "scan to folder" functionality. There's some discussion about this in reference to Ricoh machines here on Server Fault. I'd strongly suspect this is your problem.

  • Your diagnosis of the scanner issue was spot-on - thanks so much! It's connecting perfectly now. I understand what you mean about the spoofing issue as well - that does describe our layout, so I'm going to read up a bit more on this topic. – RB. May 26 '10 at 16:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.