ISA 2006 blocking access to IP addresses

[TheCrust]

We run ISA 2006 as an additional layer of filtering to pick up sites our RBC fails to filter (amongst other things). As part of this we regularly monitor the logs to detect common "off task" site accesses - i.e. students accessing proxy websites.

 

We've come across a real vein of proxy websites this morning - loads more than I want to sit and add into the "ban" filter because I've got more pressing things to deal with - but I've noticed they all resolve down to a couple of IP addresses.

 

Is there a way of quickly blocking access to a URL based on the IP address it resolves back to in ISA 2006....? This will enable me to enter in the target IPs quite quickly without having to sit and trawl through a list of websites...

 

Thanks in advance!

 

 

 

Jim

[SYNACK]

Just use a seporate ban rule above the internet access rule that bans any traffic from the internal networks set to the individual host IPs that you want to ban. You can set these up as destinations and add hosts by ip or subnets that you want to block.

[TheCrust]

I was wondering about doing that, but wasn't sure it would work when users were going to URL's rather than trying to hit the IP address directly.

 

Will give it a go - thanks!

[TheCrust]

Just as an update, that seemed to do the job nicely.

 

All I need now is something to inspect incoming HTML and deny access if the page contains a couple of key terms: such as unblock, proxy and bebo.

 

My students hate me - can't think why....

[Azhibberd]

My students hate me - can't think why....

 

Know the feeling dont worry, But as i see it paid to keep it safe not to make friends. I think i managed to upset all the students when i set isa to block all Flash content, .exe's, streaming content, etc etc but the kids do allot more work now they aren't playing games all day.

[localzuk]

Know the feeling dont worry, But as i see it paid to keep it safe not to make friends. I think i managed to upset all the students when i set isa to block all Flash content, .exe's, streaming content, etc etc but the kids do allot more work now they aren't playing games all day.

 

You've blocked flash?! Nearly 90% of our official computer usage is flash based educational sites - educationcity, mathletics, mymaths etc...

[Azhibberd]

Well we are blocking flash content but we have an exception list (Allowing things like mymaths) but unless its educational we wont allow the flash, for the first week of it we just had loads of kids constantly waiting for the game sites to load.... but after a week they realised it wasn't going to (well the site loads just the actually flash game wont)