30 Responses to “Service Pack 3 Released for the ISA Firewall”

1. Craig Winter Says:

   May 2nd, 2007 at 6:22 pm

   Tom,

   I just saw sp3 pop up as a critical update on my isa 2004 firewall (using msft updates) I clicked install it went through, then said the installation failed, then the firewall service wouldn’t start. Only entry in the event logs was an eventID 1023 with an error code of 1603… After that the firewall service wouldn’t start…

   I was able to get back up by going to add/remove, and doing a repair install. I rebooted and tried the SP3 update again through the full download with the same results.

   I’m going to build a test box to see if I can reproduce on a clean install. Just wanted to let you know in case anyone else is having the same issue.

   Craig Winter

2. Thomas Shinder Says:

   May 2nd, 2007 at 6:25 pm

   Hi Craig,

   Thanks for the info!

   Hopefully other people with the same problem will be able to report their expereinces here.

   When you did the Add/Remove, what was it that you removed?

   Thanks!
   Tom

3. Craig Winter Says:

   May 2nd, 2007 at 6:30 pm

   Add or Remove Programs
   Microsoft ISA Server 2004 (change/remove, then select repair)

   It was a last ditch effort before wiping the box, but it worked fine and left me on SP2…

4. Shabir Says:

   May 3rd, 2007 at 1:02 am

   Tom

   Myself also experience the same problem with Craig. And also get ISA firewall started back by repairing through Add/Remove.

   Hope U may provide us with the solution

   Thanks

5. Shabir Says:

   May 3rd, 2007 at 1:03 am

   Tom

   Myself also experience the same problem with Craig. And also get ISA2004 firewall started back by repairing through Add/Remove.

   Hope U may provide us with the solution

   Thanks

6. Craig Mc Says:

   May 3rd, 2007 at 5:59 am

   I had the same problem. To fix I had to go Control Panel > Add/Remove > Show Updates > Then Remove the previous update for ISA

   Not sure what update it was I removed but log shows

   Product: Microsoft ISA Server 2004 - Update ‘Microsoft ISA Server 2004 KB916106′ was successfully removed.

   ISA worked after this.

   You might want to disable auto install on server as I noticed it had rescheduled the Sp3 installation again for 3am tomorrow and I don’t think todays fix will work again tomorrow.

7. H S Sagar Says:

   May 3rd, 2007 at 7:37 am

   I have also experience the same problem. I have corrected back to working ISA firewall service by reinsatlling SP2.

8. Todd Garrison Says:

   May 3rd, 2007 at 10:06 am

   Same problem here,

   We have two ISA boxes here, a main office in CA and a branch office in DE. We upgraded one box to SP3 yesterday and it died, and the firewall service refused to start. The other box picked up the critical update from windows update at 4am this morning and promptly died with the firewall service refusing to start.

   We’re SA customers so we actually decided to do a rapid upgrade to ISA 2006 which has worked just fine. That being said, I’m really disappointed. The fact that 7 responses indicate this problem only a few days after release means that there was a major bug that didn’t get caught during testing.

   If it were a minor Office but, I’d understand … when it’s my firewall, I’m less forgiving.

9. Thomas Shinder Says:

   May 3rd, 2007 at 10:25 am

   Hey guys,

   Thanks for the input. I’m sure they’re working on a solution and will have it out as fast as possible.
   Thanks!
   Tom

10. Tarek Majdalani Says:

    May 3rd, 2007 at 5:21 pm

    Hi ,

    I Do not allow automatic installation of updates on my servers ( via WSUS 2.0 )

    2moro i am going to do the installation manually and check the result, if anything appeared will report it back

    Thanks,
    Tarek

11. Thomas Shinder Says:

    May 3rd, 2007 at 5:26 pm

    Hi Tarek,

    Check my post about some information on the ISA Team Product blog for more information on installation and installation failures.

    Thanks!
    Tom

12. Tarek Majdalani Says:

    May 3rd, 2007 at 5:31 pm

    Hi Tom,

    i was just reading it in ISA Team Product blog and came back here to post it , but i saw that you posted it

    Thanks,
    Tarek

13. Art Luden Says:

    May 4th, 2007 at 11:00 pm

    Hello
    I had the same problem after installing ISA2004 SP3, that is the installation failed and the firewall service would not restart. I then restored ISA2004 by selecting Add/Remove Programs and choosing to repairing ISA 2004.

    I lost four hours of a work day troubleshooting and fixing this problem. Thanks Microsoft, you have given me the incentive to finally make the switch to Astaro Gateway after considering moving off ISA for a while. I am sick of ISA Service Packs breaking things. SP2 broke my RPC comms on the ISA box causing my RADIUS server to fail.

    For an excellent alternative to ISA 2004 check out Astaro Gateway. BTW This is not a paid advert but a message from a very unhappy user of ISA 2004.

    Art L.
    MCSE

14. Tarek Majdalani Says:

    May 5th, 2007 at 1:42 am

    I installed SP3 and there was no issue with it, Except i suspect its not playing good with GFI WM3 !!

    when the filter of GFI WM3 is enabled , iam recieving proxy error message # 502 !!

    once the filter is disabled everything back to normal.

    Will check this with GFI Support.

    Thanks,
    Tarek

15. Thomas Shinder Says:

    May 5th, 2007 at 11:22 am

    Hi Art,

    I understand how you feel, but I think after a year of pulling your hair out with the Astaro product (and you will, believe me), you’ll come back to ISA happy that you have a real software company and community backing you up, in contrast of the Astaro “black box” who will end up boxing you into submission in just a few months

    HTH,
    Tom

16. Tarek Majdalani Says:

    May 7th, 2007 at 5:43 am

    Yep , i was right, GFI WM3 DOES NOT Support ISA Server 2004 SP3 !!

    read more here : http://forums.gfi.com/m_900748521/mpage_1/key_/tm....748565

17. Scott Miller Says:

    May 7th, 2007 at 11:16 am

    We installed SP3 to 6 ISA 2004 server. Only had a problem with one of them. Our solution was to uninstall and reinstall ISA from scratch, which worked fine.

    However, I have stumbled upon what I believe is a bug in the management console. I use the logging feature heavily, copying the information to Excel spreadsheets for analysis by others. With this service pack, the copy selected results to clipboard and copy all results to clipboard is broken. If there are more than 1850 lines in the selection result, the copy fails with a “catastrophic failure.” Nothing crashes, it just won’t copy the log entries. Nothing on Microsoft’s site yet refers to this. I’m trying to confirm the problem and then hopefully will be able to report it to product support.

    I just thought people should be aware of this problem.

18. 4sysops -- Quite a few Microsoft releases relevant for sys admins these days Says:

    May 7th, 2007 at 11:25 pm

    […] ISA Server 2004 SP3 If you use Microsoft ISA Server as firewall, then you probably know that ISA Server 2006 has been available for sometime. We use ISA Server 2006 as http proxy and didn’t encounter any problems so far. However, we didn’t update our ISA Server 2004 firewall since we feared that some of our scripts might not work properly anymore and also because the new features of ISA Server 2006 seemed irrelevant for us. Thus, we’ll probably install ISA Server 2004 SP3 mostly for security reasons very soon. New features of ISA Server 2004 SP3 include new troubleshooting tools, improved log viewer functionality, and support for publishing Exchange Server 2007. By the way, an excellent source for information about ISA Server is Tom Shinder’s blog. Some guys discussing the SP3 in a blog post there. Forefront Client Security So Microsoft finally entered the market for enterprise malware protection. We have been using Sophos Antivirus for a long time now and are not satisfied with it, anymore. With every new release, we encounter new problems. As an educational institution we get Microsoft software for a reasonable price. That’s why I am quite interested in Forefront Client Security. However, I reported some time ago that Microsoft can’t still compete with major anti-virus software vendors. Anyway, I am curious enough to want to take a look at it soon. […]

19. SYED Says:

    May 8th, 2007 at 1:57 am

    Hi,

    I was just looking for the problelms before installing SP3.
    So better to wait for few days to be aware about all probelms.

    Thanks all
    SYED

20. Simon Hill Says:

    May 10th, 2007 at 3:34 am

    Hi,

    Just wanted to record the fact that we have now seen two of our customers ISA servers fail due to this service pack being installed automatically overnight. The nature of the failure was the same as that seen by Craig W, i.e. ISA service failed with errors in the log, SP3 was unavailable for un-install from Add-Remove Programs.

    However in both cases we were able to fix the issue by reinstalling SP3 manually. Both servers have been working for around a week now.

    cheers,

    Simon.

21. Thomas Shinder Says:

    May 10th, 2007 at 8:13 am

    Hi Simon,

    Thanks for the update!
    Tom

22. Jason Street Says:

    May 10th, 2007 at 10:42 am

    chaps

    I have been dealing with MS support on a different matter. the engineer sent me this warning about SP3. I dont know if this is relavent to the problem you guys are having, but I thought Id share it anyway.

    hope it helps

    Jase

    Regarding SP3, then make sure you close all MMC’s before you install it. We have had a few reports from customers running into issue with the Microsoft Update deployments. This seems to have been linked to the automatic Microsoft Update installs and machines left logged in with the MMC console open while the install took place.

    See the ISA Team blog for more information.
    http://blogs.technet.com/isablog/archive/2007/05/0...n.aspx

    Installing it manually is fine.

    Thanks,

23. Thomas Shinder Says:

    May 14th, 2007 at 6:33 am

    Hi Jase,

    Thanks!
    Tom

24. Mark Hollings Says:

    May 18th, 2007 at 4:46 am

    Feeling brave I ran microsoft update this morning on m ISA2k4 server. Have been having problems getting the firewall to start after reboots and after running the ms update got several updates but SP3 wouldn’t load and firewall woundn’t go either so no browser access to the net.

    Rebooted and still no firewall so tried to apply SP3 again, but got a warning that the mmc was running, killed the mmc and SP3 applied successfully. Rebooted firewall came up and full services resumed.

    ;-)

25. Thomas Shinder Says:

    May 18th, 2007 at 5:17 am

    Hi Mark,

    Thanks for sharing the happy ending!

    Tom

26. textguru Says:

    May 23rd, 2007 at 5:29 pm

    I am planning to install SP3 on my ISA 2004 SP2 running on Windows Server 2003 SP1 R2 and kinda thinking if its really safe and I will not be encountering any errors during the update. Have created new thread on this: http://forums.isaserver.org/fb.aspx?m=2002044984

27. Thomas Shinder Says:

    May 24th, 2007 at 8:38 am

    Hi TextG,

    I’ve found it to be quite safe as long as you do a manual installation.

    HTH,
    Tom

28. Jim Harrison Says:

    June 19th, 2007 at 9:35 am

    Scott - did you ever contact PSS about your copy to clipboard problem?

29. Guru Says:

    September 21st, 2007 at 8:51 am

    Hi All, out of 6 ISA2004EE servers in our enterprise we have successfully updated SP3 from SP2, but failing in only 1 and that too will be done soon once MS fixes some unknown issues in SP3. Overall, SP3 is fine and troubleshooting is quite quick. Also note, found that installing Windows Server 2003 SP2 in ISA2004EE server would block firewall from starting automatically. Even it cannot be started manually. And found windows firewall interrupting. Take care of this if you face such problem. Cheers, Guru.

30. Stewart Says:

    September 25th, 2007 at 11:10 am

    I was planning on upgrading our ISA Server 2004 SP1 directly to SP3 (manually) as they are supposedly cumulative. I read the before installing SP2, you had to install Feature Pack 1. Does this hold true when bypassing SP2 and going directly to SP3 or will it install FP1 automatically? Any advice before I update would be greatly appreciated because I have to upgrade to SP3 in order to get my Outlook on 2003 Terminal Server running properly.

    TIA,
    Stewart

Leave a Reply