Content cache issues on downstream ISA Server computer (821098)



The information in this article applies to:

  • Microsoft Internet Security and Acceleration Server 2000 SP1
  • Microsoft Internet Security and Acceleration Server 2000

IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SYMPTOMS

This article discusses problems that you may experience when you cache Hypertext Transfer Protocol (HTTP) content on a downstream Internet Security and Acceleration (ISA) Server. In these scenarios, all the following configuration conditions apply:
  • The downstream ISA Server computer does not request authentication.
  • The downstream ISA Server computer is chaining to an upstream proxy server and you have not set the connection user in the Routing rule of the downstream server.
  • The upstream proxy server requests authentication.

Scenario 1

You may notice that users can retrieve HTTP content, although the upstream proxy server does not allow these users to view the content.

Note This problem is fixed in ISA Server Service Pack 1 (SP1).

Scenario 2

The downstream ISA Server computer no longer caches content, although you want it to cache content for network configuration and performance reasons.

This problem appears only after you install ISA Server SP1 on the downstream ISA Server computer.

CAUSE

Scenario 1

Because of the rule configuration on the upstream proxy server, the downstream ISA Server computer caches requests from users who are permitted to retrieve content. Users who do not have permission to gain access to the same content can request this content because it is served directly from the cache of the downstream ISA Server computer. The content is not requested through the whole proxy chain (downstream/upstream).

Scenario 2

After you install ISA Server SP1 on the downstream ISA Server computer, the computer no longer caches content that requires client authentication at the upstream proxy server.

RESOLUTION

Scenario 1

To fix this problem, install ISA Server SP1.
The following file is available for download from the Microsoft Download Center:
DownloadDownload the 821098 package now.

After you install ISA Server SP1 on the downstream ISA Server computer, the computer no longer caches content that requires authentication at the upstream proxy server.

Scenario 2

The fix for this issue is mentioned in the following Knowledge Base article:

830221 Your ISA Server 2000 server stops responding to SSL CONNECT requests

After you install ISA Server SP2 and apply this hotfix, you can set the downstream ISA Server computer to cache or not to cache HTTP content. If you have installed ISA Server SP1 or SP2 on the downstream ISA Server computer, and you want to revert to scenario 1 to enable caching of HTTP content on authenticated requests, through the downstream/upstream chain, make sure that ISA Server SP2 is applied, and then install the hotfix. You must also modify the registry.

Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

Add the following registry subkey on the downstream ISA Server computer:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3Proxy\Parameters\ DontMarkSessionAsPrivateifProxyAuthSeen

Set the DWORD value to 1.

Note If you create this registry key, the behavior that scenario 1 describes will return. Be aware of the security issues that are raised in the "Symptoms" section for scenario 1.

If you want the downstream ISA Server computer to disable caching of HTTP content that was retrieved through the downstream/upstream chain through an upstream authentication request, add the following registry subkey on the downstream ISA Server computer:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3Proxy\Parameters\ DontMarkSessionAsPrivateifProxyAuthSeen

Set the DWORD value to 0.

Note By default, this is the setting after you install ISA Server SP1 or SP2 on the downstream ISA Server computer.

Modification Type:MinorLast Reviewed:10/26/2005
Keywords:kbHotfixServer kbQFE kbHotfixServer kbQFE kbISAServ2000preSP2fix kbSecurity kbCaching kbQFE kbfix kbBug KB821098 kbAudDeveloper kbAudITPRO