Firewall Client-Based Client Computers Are Unable to Access Resources

When you migrate from a Microsoft Proxy Server version 2.0-based array to an Internet Security and Acceleration (ISA) Server-based array, some of the Firewall Client-based client computers may sometimes be unable to access resources that are available to the earlier Winsock Proxy (WSP)-based clients.

This behavior can occur if both Proxy Server 2.0-based and ISA Server-based servers are being accessed interchangeably by either client.

Although the Firewall Client program is fully backward compatible with the WSP service of Proxy Server 2.0, Proxy Server 2.0 expects a client that connects to Proxy Server, to advertise and use server protocol version 10. However, by default, the Firewall Client of ISA Server uses protocol version 11, unless the Firewall Client has been configured in the Mspclnt.ini file to use version 10.

The Mspclnt.ini file contains the server protocol version. If the server protocol is missing, version 10 (for Proxy Server 2.0) is selected. ISA Server-based computers have an .ini file with version 11 and the name of the array. The behavior in the "Symptoms" section of this article occurs if the name resolves to a set of computers that include both Proxy Server 2.0-based and ISA Server-based computers. If a client attempts to connect to a Proxy Server 2.0-based computer with protocol 11, the client is rejected.

To work around this behavior, remark out the value for ServerVersion=11 in the Mspclnt.ini file on ISA Server-based servers and on the Firewall Client-based clients as follows by using the Update button:

rem ServerVersion=11

-or-

;ServerVersion=11