近来有工作人员反映360安全卫士的“修复漏洞”功能下载不到补丁了,360的免费杀毒软件也不能在线升级
打开360安全卫士界面,ISA客户端红叉,用“测试服务器”后红叉消失,但再次打开360后依然红叉
windows应用程序日志里有错误
ID 2 来源 Microsoft Firewal
应用程序 [360Safe.exe]。身份验证失败。ISA 服务器没有接受用户的凭据。请确认运行此应用程序的用户帐户有要求的权限。如果以系统帐户运行此应用程序,您可以通过客户端配置和 FwcCreds.exe 来为此应用程序应用不同的凭据。
客户机 XP SP3, 服务器是 WINDOWS 2003 SP2 + ISA 2004标准版 SP3
排查过程是曲折和艰辛的,最终找到了答案
In our environment (ISA 2004), this issue was corrected with assistance from Microsoft. Open the ISA console, expand "Configuration" and click "General". Click "Define firewall client settings", click the "Application settings" tab, scroll down to "svchost" and make sure both "DisableEx" and "Disable" are set to "1". We were having this problem when "DisableEx" was set to 0. Changing it to 1 corrected the issue.
Disable和DisableEx的作用类似,新键设置的时候只建DisableEx就可以了,DisableEx比Disable权限和优先级更大
下班回家,一会该没公交了
补充,第2天发现问题,360依然下载不到更新文件,使用FwcCreds也没有改善
在DNS上启用日志
很快在日志中找到了360系列软件需要对外访问的域名
20091224 16:13:25 2A4 PACKET 020177E0 UDP Rcv 192.168.20.16 996b Q [0001 D NOERROR] A (2)up(1)f(3)360(2)cn(0)
20091224 16:13:25 2A4 PACKET 02654470 UDP Snd 202.96.64.68 5490 Q [0001 D NOERROR] A (2)up(1)f(3)360(2)cn(0)
20091224 16:17:02 2A8 PACKET 029DB5F0 UDP Rcv 192.168.20.16 fa59 Q [0001 D NOERROR] A (8)download(9)microsoft(3)com(0)
20091224 16:17:02 2A8 PACKET 02B14A60 UDP Snd 202.96.64.68 8cd9 Q [0001 D NOERROR] A (8)download(9)microsoft(3)com(0)
随后在ISA上建立策略,到如下域名集,所有用户
*.360.cn
*.360safe.com
*.qihoo.com
dl.360safe.com
download.microsoft.com
qh.dlservice.microsoft.com
sdl.360safe.com
up.f.360.cn
目前更新正常