I recently ran into a situation where a machine went into lockdown mode because of a lack of disk space. I won’t tell you how we got into that situation, but it wasn’t my fault

What happens in lockdown mode? Check it out:

• The Firewall Packet Filter Engine (fweng) applies the firewall policy.
• Outgoing traffic from the Local Host network to all networks is allowed. If an outgoing connection is established, that connection can be used to respond to incoming traffic. For example, a DNS query can receive a DNS response, on the same connection.
• No incoming traffic to the firewall is allowed, unless a system policy rule that specifically allows the traffic is enabled. The one exception is Dynamic Host Configuration Protocol (DHCP) traffic, which is always allowed. DHCP requests on User Datagram Protocol (UDP) port 67 are allowed from the Local Host network to all networks, and DHCP replies on UDP port 68 are allowed back in.
• The following system policy rules are still applicable:
  • Allow Internet Control Message Protocol (ICMP) from trusted servers to the local host.
  • Allow remote management of the firewall using MMC (RPC through port 3847).
  • Allow remote management of the firewall using Remote Desktop Protocol (RDP).
• VPN remote access clients cannot access ISA Server. Similarly, access is denied to remote site networks in site-to-site VPN scenarios.
• Any changes to the network configuration while in lockdown mode are applied only after the Firewall service restarts and ISA Server exits lockdown mode. For example, if you physically move a network segment and reconfigure ISA Server to match the physical changes, the new topology is in effect only after ISA Server exits lockdown mode.
• ISA Server does not trigger any alerts.

BTW – you should make sure that you don’t run out of disk space on your firewall. You can use System Center or other network management console to do this. If you want a Windows alert, here’s how you do it in Windows Server 2003 http://support.microsoft.com/kb/324796

HTH,

Tom

Thomas W Shinder, M.D., MCSE
Sr. Consultant / Technical Writer

Prowess Consulting www.prowessconsulting.com
PROWESS CONSULTING | Microsoft Forefront Security Specialist
Email: tshinder@isaserver.org
MVP — Forefront Edge Security (ISA/TMG/IAG)