Application filter events are not triggered on a computer that is running ISA Server 2004 with Service Pack 2 (919871)

The information in this article applies to:

Microsoft Internet Security and Acceleration Server 2004 Service Pack 2, when used with:
- Microsoft Internet Security and Acceleration Server 2004, Enterprise Edition
- Microsoft Internet Security and Acceleration Server 2004, Standard Edition

SYMPTOMS

You are using an application filter as an extension of the Microsoft Firewall service on a computer that is running Microsoft Internet Security and Acceleration (ISA) Server 2004 with Service Pack 2. However, some of the application filter events are not triggered.

For example, the following events are not triggered:

The fwx_ConnectionTerminating event is not triggered in a custom application filter when a connection is closed.
When a remote server uses FTP to connect to an FTP client, only the fwx_Listen event is triggered. The Fwx_Bind_Tcp and fwx_AcceptedConnection events are not triggered.
For User Datagram Protocol (UDP) connections, only the fwx_Udp_Destination event is triggered. The fwx_Bind_Udp event is not triggered.
The fwx_Connect_Tcp event for secondary outbound connections is not triggered in a custom application filter. However, this event may be triggered for the first outbound connection.

RESOLUTION

How to obtain the hotfix

This issue is fixed in the ISA Server 2004 Hotfix Package dated May 31, 2006. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

919621 Description of the ISA Server 2004 hotfix package: May 31, 2006

The fwx_ConnectionTerminating event is not triggered even after you apply this hotfix. To work around this problem, use the IFWXDataFilter::Detach method for fwx_ConnectionTerminating events.

For more information about the IFWXDataFilter::Detach method, visit the following Microsoft Web site:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/isasdk/isa/ifwxdatafilter_detach.asp

For more information about fwx_ConnectionTerminating events, visit the following Microsoft Web site:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/isasdk/isa/fwxendconnectionevent.asp

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

MORE INFORMATION

For more information about application filter events, visit the following Microsoft Web site:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/isasdk/isa/fwxfirewalleventtype.asp

Modification Type:	Major	Last Reviewed:	8/3/2006
Keywords:	kbHotfixServer kbQFE kbprb KB919871 kbAudITPRO