Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 20063 Source: MicrosoftISAFirewallH.323Filter

H.323 filter is not configured to register with an H.323 Gatekeeper, attempting to find a gatekeeper using multicast discovery. Inbound H.323 calls will not succeed while the filter is not registered with a gatekeeper. To configure the filter to use a particular gatekeeper, edit the H.323 filter Call Control properties and enter the H.323 gatekeeper to register with.
I had this error when i stopped the h.323-gatekeeper service and deactivated it respectively setting it's status to manual. After restarting the ISA-Server Control Service event 20063 appeared in my event logs. I activated the h.323-gatekeeper service again for starting automatically and the problem was solved.
If you don't use conferencing at all, you can just simply switch it off. Go to the ISA Management console, choose your server, then to the Extensions and select Application Filters. Right click on H.323 Filter, select Properties and uncheck Enable this filter checkbox. And don't forget to restart your services!
I installed my ISA Server without H.323 Gatekeeper, by default the 20063 warning appears in the event log when I start the ISA-Server. Here the steps to get rid of this event message:
- In the ISA Management goto Extensions -> Application Filter
- Disable H.323 Filter (because it is not installed)
This event means the H.323 Filter under the Application Filter section is enabled but the filter does not have a Gatekeeper configured.

To prevent this warning message, either disable the filter (if you do not use Netmeeting or have not configured a gatekeeper) or configure a Gatekeeper on the Call Control tab of the properties of the H.323 Filter.
Upon installing ISA Server, you need to configure the H.323 Application Filter. If you are using the filter, you need to configure a "Gatekeeper" on the "Call Control" tab of the properties page for the H.323 filter. If the filter is not being used, just right-click on the H.323 filter object and disable it.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.