The routing table for a network adapter includes IP address ranges that are not included in the array level network to which it is bound

Microsoft.ISAServer.2006.The_routing_table_for_a_network_adaptor_includes_IP_address_ranges_that_are_not_included_in_the_array_level_network_to_which_it_is_bound.Rule (Rule)

This Rule generates alerts when The routing table for a network adapter includes IP address ranges that are not included in the array level network to which it is bound

Knowledge Base article:

Summary

The RPC filter cannot use the defined port.

Causes

The port is already in use.

Resolutions

Another application is already bounded to the RPC port. Use netstat and tasklist to find the application. Resolve the multiple bind issue by configuring the application to use a different port.

Element properties:

Target	Microsoft.ISAServer.2006.ServerRole
Category	EventCollection
Enabled	True
Alert Generate	False
Remotable	True

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.ISAServer.2006.Rule.AlertGenerate.DS	Default
WA	WriteAction	Microsoft.ISAServer.2006.Rule.AlertGenerate.WA	Default

Source Code:

<Rule ID="Microsoft.ISAServer.2006.The_routing_table_for_a_network_adaptor_includes_IP_address_ranges_that_are_not_included_in_the_array_level_network_to_which_it_is_bound.Rule" Enabled="onEssentialMonitoring" Target="Microsoft.ISAServer.2006.ServerRole" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Microsoft.ISAServer.2006.Rule.AlertGenerate.DS">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <EventsPattern>^(21265)$</EventsPattern>

      <EventType>1</EventType>

      <SourcePattern>Microsoft Firewall</SourcePattern>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WA" TypeID="Microsoft.ISAServer.2006.Rule.AlertGenerate.WA">

      <AlertMessageId>$MPElement[Name="Microsoft.ISAServer.2006.The_routing_table_for_a_network_adaptor_includes_IP_address_ranges_that_are_not_included_in_the_array_level_network_to_which_it_is_bound.AlertMessage"]$</AlertMessageId>

      <DomainName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/DomainDnsName$</DomainName>

      <Priority>1</Priority>

      <Severity>2</Severity>

    </WriteAction>

  </WriteActions>

</Rule>