This Rule generates alerts when A network that is load balanced is behind a network that is not load balanced
The Firewall service generates this alert when NLB integration mode is enabled, and NLB is enabled for the External network (which no physical adapter on ISA server), but is not enabled for the network physically connected to the array.
The NLB configuration may fail when all of the following settings are true:
External network is disconnected
NLB is enabled for the External network
NLB is disabled for the network that is connected to the External network
Disable NLB for the external network.
Enable NLB for the connected network
Target | Microsoft.ISAServer.2006.NLB.ServerRole |
Category | EventCollection |
Enabled | True |
Alert Generate | False |
Remotable | True |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
DS | DataSource | Microsoft.ISAServer.2006.Rule.AlertGenerate.DS | Default |
WA | WriteAction | Microsoft.ISAServer.2006.Rule.AlertGenerate.WA | Default |
<Rule ID="Microsoft.ISAServer.2006.A_network_that_is_load_balanced_is_behind_a_network_that_is_not_load_balanced.Rule" Enabled="onEssentialMonitoring" Target="Microsoft.ISAServer.2006.NLB.ServerRole" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.ISAServer.2006.Rule.AlertGenerate.DS">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Application</LogName>
<EventsPattern>^(21231)$</EventsPattern>
<EventType>1</EventType>
<SourcePattern>[Microsoft Firewall]|[Microsoft ISA Server Control]</SourcePattern>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="Microsoft.ISAServer.2006.Rule.AlertGenerate.WA">
<AlertMessageId>$MPElement[Name="Microsoft.ISAServer.2006.A_network_that_is_load_balanced_is_behind_a_network_that_is_not_load_balanced.AlertMessage"]$</AlertMessageId>
<DomainName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/DomainDnsName$</DomainName>
<Priority>1</Priority>
<Severity>2</Severity>
</WriteAction>
</WriteActions>
</Rule>