IIS7/2008 Sql/Service Connection Issues

Question

While trying to get a 2008 server to connect to a sql server, I noticed a change in the 2008 IP stack that has me a bit flummoxed. I'm looking for either an OS way to override this, or a programmatic way in .NET to override this.

For the sake of this argument, assume I have a web server with multiple IP addresses to server multiple sites, connecting to multiple resources (web service, sql, etc) behind a firewall.

SERVER IP:   10.10.10.1
SITE1 IP:    10.10.10.10
SITE2 IP:    10.10.10.11

SQL SERVER:  10.10.10.2
WEB SERVICE: 10.10.10.15

The firewall is setup naturally to deny all, allow only what is needed. In other words:

ALLOW FROM 10.10.10.1 TO 10.10.10.2
ALLOW FROM 10.10.10.1 TO 10.10.10.15
DENY ALL

Prior to Windows 2008, Windows 2000/2003 always used the machines base IP (10.10.10.1) when requesting network resources. Thus, the firewall rules were met and access was granted. Under 2008, it appears that it's picking the closest match:

Connecting to 10.10.10.2 comes from IP 10.10.10.1. Firewall is happy. Connecting to 10.10.10.15 comes from IP 10.10.10.11, firewall denies connections.

Removing all virtual IPS from the NIC of course makes things work because every will then come fro 10.10.10.1

Now, I understand slightly that were this machine to have two NICs, this makes sense because of changes to implement RFC3484 and IPv6 (http://support.microsoft.com/kb/968920) and strong/weak host model comes into play, but for the life of me, I don't understand why this should have changed how IP works with a single NIC card.

I have a support case open and I'm getting nowhere. I hear muttering of "just open up your firewall to allow connections from 10.10.10.11". That's not practical. This would mean adding a allow rule for every ip address on a multihomed single nic machine just for windows 2008. I can't believe poking more holes in your firewall just for 2008s ip stack is a good answer.

Is there a way to disable this "feature" in 2008 at the machine level? Is there a way to disable this in .NET at the machine level? Is there a way to disable this per connection (SqlConnection, WebClient)?

Answer 1

You're seeing the side-effect of Automatic Route Metric computation. When multiple addresses have route to an address and Automatic Metrics (in the Advanced... settings under TCP) is enabled, Windows will use try and predict the "fastest" path to that address.

I suspect both your interfaces (virtual or otherwise) have the similar route metrics so the choice is non-deterministic. You could encourage it from using your "back-edge" address for by setting a higher route-metric on your .10/.11 addresses. With automatic metrics disabled you could also prescribe an explicit static route using your 10.10.10.1 address.

More detail on TechNet - search on page for Automatic Metrics.

http://technet.microsoft.com/en-us/library/bb727001.aspx

For better or worse. If both interfaces advertise a path with equal metrics - either interface can win. The behavior in the past was nondeterministic - it's changed.

The best approach is to use route at the command-line to either create a static persistent TCP route with lower or lowest cost between .1 and .2. Alternately increase the cost of every route on .14 & .15 addresses. I'd use the former since there is less to maintain and less side-effects on other communications.