Users may receive slow responses when you enable the Cache Array Routing Protocol in ISA Server 2004, Enterprise Edition or ISA Server 2006, Enterprise Edition

When a server is running Microsoft Internet Security and Acceleration (ISA) Server 2004, Enterprise Edition or Microsoft Internet Security and Acceleration (ISA) Server 2006, Enterprise Edition, users who access intranet Web sites may receive slow responses. Additionally, the domain controllers may receive excessive authentication requests from the computer that is running ISA Server.

This problem occurs if the following conditions are true:

• You have enabled the Cache Array Routing Protocol (CARP) in the ISA Server array.
• The members of the array belong to an Active Directory domain.
• The computer names of the array members are configured in a disjoint namespace.

This problem occurs because ISA Server passes incorrect authentication information to the Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO). Therefore, SPNEGO issues an invalid Kerberos ticket request. When SPNEGO cannot obtain a Kerberos ticket for the target server, it uses NTLM authentication. Because of the additional NTLM authentication requests, HTTP requests may generate very long response times.

To resolve this problem, obtain the latest ISA Server service pack. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

NTLM authentication puts additional load on the domain controller. This may cause remote procedure call (RPC) time-outs and Net Logon time-outs. The authentication delay causes slow response times.

The server may also fail over to another domain controller. If the other domain controller is not local, response times are even slower.

Disjoint namespaces

When you use a primary domain name system (DNS) suffix that does not represent an Active Directory domain, the domain namespace is a disjoint namespace. For example, the following represents a disjoint namespace: In this example, the FQDN of the computer resembles the following:Here, Sub-domain is not an Active Directory domain.

For more information about domain architecture, visit the following Microsoft Web site:For more information about the terms that are used to describe software updates, click the following article number to view the article in the Microsoft Knowledge Base: