I recently installed ISA Server 2006 and was unable to add the second server to the array. While investigating the issue, I could see RPC failures in the log. It was showing that the traffic was being allowed by one of the system rules, but the server failed to connect. I was able to telnet to the target domain controller on port 135 with the Microsoft Firewall disabled, but as soon as the firewall was running this communication would quit functioning. I was able to overcome the issue by changing the following registry keys:

HKLM\SYSTEM\CurrentControlSet\Services\TCPIP\Parameters

EnableRSS Change to 0

EnableTCPA Change to 0

     One of the common mistakes I see people make when dealing with ISA is not waiting enough time for the firewall to synchronize with the configuration database. Changes made in the client are modified in the database first, then the firewall polls this database for changes and synchronizes these with it’s local ADAM directory. This allows ISA to maintain it’s configuration without the need for access to the configuration database. By default, the firewall will poll for changes every 15 seconds. You can see this setting here:

As you can see, I changed mine to 5 seconds. I have done this while I was doing the initial configuration, but will change it to a higher value, once I have everything stable. You can verify that all ISA servers in the array have been synchronized by looking at the Monitoring->Configuration tab

As you make changes to ISA, you must wait until the status shows “Synced”, this will ensure that you are testing against the most recent changes committed to the database. This should save you some major headaches and possible hair loss. Good luck….