event id: 14120

[Dmitri Zaichkine]

I cannot get rid of this event id from the application
log.
I am not quite sure how to create an A record. I know how
to create Type A record but what name and address do you
put in for that.
I checked to make sure that my lat does not include
outside ip addresses.

Event Type: Error
Event Source: Microsoft Web Proxy
Event Category: None
Event ID: 14120
Date: 4/18/2001
Time: 2:08:35 PM
User: N/A
Computer: computer name
Description:

The ISA Server services cannot create a packet filter
24.25.66.26. This event occurs when there is a conflict
between the LAT configuration and the Windows 2000 routing
table. Check the routing table and the LAT to find the
source of the conflict.

You have configured ISA Web publishing to an internal Web
server, or to the local IIS server on the ISA server.
An internal client requests the Web site using a fully
qualified domain name (FQDN) that resolves to the external
IP address of ISA.
ISA has both NICs in the same segment and outbound packets
go out through the same NIC where the client's request
arrived (because that is where the default gateway is
configured).

CAUSE
This behavior occurs because when the ISA Web service
listens on the external IP address on behalf of the Web
server, and the internal client tries to access that
service, Web proxy tries to create a packet filter for
that address because the proxy views that the address as
external (which it is). The packet filter driver fails to
create the filter because the address is not reachable
through the external interface; instead, the address is
reachable through the loopback interface. The result is
the event log entry.

RESOLUTION
Although you can ignore this event, you can also resolve
this behavior. To do so, on the DNS server that is being
used for internal name resolution, create a host record (A
record) for the fully qualified domain name that is used
by internal users and that resolves to the internal IP
address or the IP address of the Web server on which the
Web site is hosted.

 

[Marina Roos]

Is this a W2K-server with ISA 2000? How many nics in the server? Make sure
that the external nic doesn't show up in the LAT.

Marina

 

[Larry Brasher]

Hello,

Marina is right, usually having the external IP address in the LAT will
cause this error. It can also be caused by having the internal NIC having
an external DNS IP addresslisted instead of a internal DNS. Remove
external DNS server/s IP address/es from internal adapter's TCP/IP
properties.

Another source can be:
Q288236 Microsoft Web Proxy Event 14120 for every web request

CAUSE
=====
ISA generates a dynamic packet filter for every outgoing connection object
so it can listen to the reply from the requested web server. On a machine
with only one interface this will fail as it is not possible to do packet
filtering.
Installing ISA Server in Integrated or Firewall mode requires a minimum of
two network interface cards (NICs) for the packet filtering and Network
Address Translation to work properly. This can either be two NICs or one
NIC and one dial-up adapter. If you install ISA server in Integrated mode
on a computer with only one network interface, ISA Server may log an event
14120 for each Web Proxy request.

RESOLUTION
==========
Installing ISA Server in Integrated or Firewall mode on a computer with
only one network interface is not supported. To resolve this problem,
uninstall ISA Server and install it in Cache mode or add an additional
network interface.


Larry Brasher
MCSE (2000,NT),MCSA, A+
Microsoft Platforms Support
Windows NT/2000 Networking