I spent more time than I should have trying to diagnose, what turned out to be, a relatively simple problem last week.

 

We were using an ISA 2006 Array to load balance a Silverlight App between multiple web servers. Each server was added to a web farm in ISA and the rule was configured using the ISA publishing wizard. The app was accessed via the Internet over SSL with the SSL connection terminating on the ISA server.

 

Having applied the rule changes I attempted to access the website through the browser only to be greeted with a dirty great 500 internal server error. I double checked the settings for the rule and clicked the 'test rule' button and everything seemed to be correct. Slightly baffled I confirmed that I could access each of the web servers directly, and again didn't get any errors.

 

Next I clicked on the Monitoring option in ISA and navigated to the monitoring tab, I setup a filter to monitor traffic specifically for the rule and could see the requests were reaching the relevant ISA Server then bombing out with the 500 error.

 

It was only when I clicked the connectivity verifier tab that I noticed the big red x-marks next to each of the servers. It transpires that ISA had setup a connectivity verifier in the format https://*/ which had of course failed because the servers were serving requests over http not https. As each verifier failed ISA removed the offending server from the array leaving no available servers to handle requests!

 

Once I'd updated the connectivity verifier everything settled down and started working correctly.

 

In hindsight if I'd bothered to check the Event Viewer on each of the ISA servers I'd have spotted the root cause much sooner… you live and learn.