Forefront TMG entered a state in which all traffic is blocked

Microsoft.Forefront.TMG.Forefront_TMG_entered_a_state_in_which_all_traffic_is_blocked.Rule (Rule)

This Rule generates alerts when Forefront TMG entered a state in which all traffic is blocked.

Knowledge Base article:

Summary

Forefront TMG entered a state in which all traffic will be blocked.

Causes

The event is caused by an internal error.

Resolutions

To resolve this problem, restart firewall engine driver by entering the following commands at a command-line prompt:

net stop fweng /y
net start fwsrv

Element properties:

Target	Microsoft.Forefront.TMG.Server
Category	EventCollection
Enabled	True
Alert Generate	False
Remotable	True

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Forefront.TMG.Rule.AlertGenerate.DS	Default
WA	WriteAction	Microsoft.Forefront.TMG.Rule.AlertGenerate.WA	Default

Source Code:

<Rule ID="Microsoft.Forefront.TMG.Forefront_TMG_entered_a_state_in_which_all_traffic_is_blocked.Rule" Enabled="true" Target="Microsoft.Forefront.TMG.Server" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Microsoft.Forefront.TMG.Rule.AlertGenerate.DS">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <EventsPattern>^(23453)$</EventsPattern>

      <EventType>1</EventType>

      <SourcePattern>Microsoft Forefront TMG Firewall</SourcePattern>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WA" TypeID="Microsoft.Forefront.TMG.Rule.AlertGenerate.WA">

      <AlertMessageId>$MPElement[Name="Microsoft.Forefront.TMG.Forefront_TMG_entered_a_state_in_which_all_traffic_is_blocked.AlertMessage"]$</AlertMessageId>

      <DomainName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/DomainDnsName$</DomainName>

      <Priority>2</Priority>

      <Severity>2</Severity>

    </WriteAction>

  </WriteActions>

</Rule>