TCP settings that can impact BizTalk Server

1. On the SQL server running on Windows Server 2003, set the SynAttackProtect registry key to 0 by using the steps in Microsoft Knowledge Base (KB) article 899599. If you have incoming TCP/IP traffic (HTTP, WCF, WSE or other adapters are using TCP/IP), you may have to set this on the BizTalk servers also:
   
   899599 A BizTalk Server Host instance fails, and a "General Network" error is written to the Application log when the BizTalk Server-based server processes a high volume of documents
   
   
   Note The SynAttackProtect registry key is not applicable on Windows Server 2008, Windows Vista, and later Windows versions.
2. On all the BizTalk and SQL servers running on Windows Server 2003, use the steps in KB article 948496 to disable the Scalable Networking Pack (SNP) features:
   
   948496 An update to turn off default SNP features is available for Windows Server 2003-based and Small Business Server 2003-based computers
   
   To disable TCP Chimney Offload feature of the Scalable Networking Pack (SNP), you can also install the hotfix in KB article 940202:
   
   940202 A Windows Server 2003-based computer may stop responding during shutdown after you install the Scalable Networking Pack
   
   On all the BizTalk and SQL servers running on Windows Server 2008, use the steps in KB article 951037 to disable Receive Side Scaling (RSS) and the TCP Chimney Offload features of the Scalable Networking Pack (SNP):
   
   951037 Information about the TCP Chimney Offload, Receive Side Scaling, and Network Direct Memory Access features in Windows Server 2008
   
   Note You may also have to disable the Receive Side Scaling (RSS) and the TCP Chimney Offload features in the network adapter advanced properties as the network adapter drivers may override Windows settings that set earlier in this section in some cases.
3. On all BizTalk servers running on Windows Server 2003, increase the ephemeral ports and reduce the TCP reuse timeout setting by modifying the MaxUserPort and TCPTimedWaitDelay registry keys documented at the link below:
   
   BizTalk Server Database Optimization
   
   You can modify these settings at the HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters registry key. The table below lists the recommended values:
    

   Value name	Value	Comment
   MaxUserPort	0xFFFE (65534)	Prevents port exhaustion
   TcpTimedWaitDelay	0x1E (30)	Release unused ports as quickly as possible

   
   On all BizTalk servers running on Windows Server 2008, there are 16383 ports (port 49152 to port 65535) and it around 4 times more ports than the default ports number in Windows Server 2003, we recommend that you only increase the ephemeral ports if the default range is not enough.
   
   Note You can use the netstat –an command to see all TCP/IP ports. If you determine that additional dynamic ports are needed, refer to KB article 929851:
   929851 The default dynamic port range for TCP/IP has changed in Windows Vista and in Windows Server 2008
    
   
   The TCP reuse timeout setting can also be reduced by modifying the TCPTimedWaitDelay registry key.
   
   Note It is recommend referring earlier in this section to increase the number of ports first before changing the settingFor more information on this registry key in Windows Server 2003, refer to the following site:
   
   TCP TIME-WAIT Delay
    
4. 929851 The default dynamic port range for TCP/IP has changed in Windows Vista and in Windows Server 2008 
    
   
   The TCP reuse timeout setting can also be reduced by modifying the TCPTimedWaitDelay registry key. For more information on this registry key in Windows Server 2003, refer to the following site:
   
   TCP TIME-WAIT Delay
5. On all the BizTalk and SQL servers running on Windows Server 2003, use the steps in KB article 906736 to disable Privilege Attribute Certificate (PAC) verification. On all BizTalk and SQL servers running on Windows Server 2008, refer to KB article 906736 for more information on Privilege Attribute Certificate (PAC) verification.
   906736 You experience a delay in the user-authentication process when you run a high-volume server program on a domain member in Windows 2000 or Windows Server 2003
    
6. When you have many or complex group policies set on the user accounts and computer accounts that are used in BizTalk and SQL Server environment, the domain controllers may be too overloaded to respond to incoming authentication traffic. In this situation, you may have to optimize or exclude BizTalk and SQL Server servers from group policies and make sure that you have domain controllers which can handle such load. BizTalk uses multiple host instances and many threads which are continuously authenticated by the domain controllers. We also recommend that you use Kerberos authentication instead of NT LAN Manager (NTLM) authentication as it has certain cache. You can also handle "double-hop" scenarios, for example in multi-server environments.
7. When BizTalk servers are communicating with the computers that are running SQL Server on Windows Server 2008 with full encryption enabled mode, you may experience network timeouts issue intermittently. This issue occurs because the SQL Server servers are handling the Advanced Encryption Standard (AES) and Transport Layer Security (SSL) variable length encryption packets. To work around this issue, you have to disable full encryption or move the SQL Server instances to Windows Server 2003 or Windows Server 2008 R2. If you are using full encryption mode, it may decrease the performance significantly. It may be better to protect servers through other methods. For example: encrypted data, IPsec, network segmentation, firewalls or limited access.

RESTART REQUIREMENT