Eventlog error message 11001 and 11005

[Christoph Dill]

Hi
recently my ISA server (SP1), which is configured as an array member, has
started to fill the eventlog with the following messages:

Event ID: 11001
Microsoft Firewall failed. The failure occurred during Initialization of
reverse Network Address Translation (NAT). because the configuration
property ClientSetsExcluded of the key
LDAP://cambodia.int.1ch.1ee/CN={FD5133B1-28DA-4071-8DCD-BD3EFE6FA138},CN=PNA
TServerMappings,CN=Publishing,CN={48F047DA-6982-44F7-90E2-4D0046CC5F84},CN=A
rrays,CN=Fpc,CN=System,DC=int,DC=1ch,DC=1ee could not be accessed. Use the
source location 3.1061.3.0.1200.166 to report the failure. The error code in
the Data area of the event properties indicates the cause of the failure.
For more information about this event, see ISA Server Help. The error
description is: The system cannot find the file specified.

Event ID: 11005
Microsoft ISA Server Control failed. The failure occurred during Handling
request to add bandwidth flow because the system call TcModifyFlow failed.
Use the source location 202.487.3.0.1200.166 to report the failure. The
error code in the Data area of the event properties indicates the cause of
the failure. For more information about this event, see ISA Server Help.

Any idea?

[Thomas W Shinder [MVP]]

Hi Chris,

Make sure to turn off the RRAS NAT service. Just delete it from the RRAS
console.

HTH,
--
Tom
www.isaserver.org/shinder
Get the book!

"Christoph Dill" <cd...@1eeurope.ch> wrote in message
news:#Kp42EqxBHA.1648@tkmsftngp04...

[Christoph Dill]

Hi Tom
Unfortunately there is no NAT enabled that I can turn off...In deed last
week I was configuring something on the RRAS, as I remember I have disabled
the RRAS and than I ran the VPN wizard from ISA server which enables the
RRAS again...but I didn't find NAT enabled in RRAS.

Any other idea?

"Thomas W Shinder [MVP]" <tshi...@hotmail.com> schrieb im Newsbeitrag
news:eMtQAHsxBHA.2728@tkmsftngp03...

[David Chadwick]

Hi Chrisoph,

I don't know about the 11005 errors, but the 11001 errors can be fixed by
doing the following:

The error is generated only if you are publishing any servers. It is
looking for a registry key (or in your case an AD object) called
"ClientSetsExcluded" which it simply does not create when you create the
publishing rule.

To fix it go into the properties of every one of your published servers and
click the "Applies To" tab. On that tab there is an "Exceptions" area. Add
a client set to the exceptions. Hit ok and wait a few seconds, then go back
in and remove the exception. Adding and removing the exception creates the
registry key (and for you I hope it will create the AD object) that it is
looking for and the errors stop.

I have only fixed this with a server that was not a member of an array. I
can only assume that the same logic applies in your case.

Seeya,

...David

"Christoph Dill" <cd...@1eeurope.ch> wrote in message
news:#Kp42EqxBHA.1648@tkmsftngp04...