Problem to configure Web Access Rule on ISA Server 2006

[vitor]

Hello,

 

I have created a web access rule to deny HTTP, HTTPS protocols to internal network from a specific web site defined on a URL Set. This rule is set to a group from Active Directory defined on Users Set. This group owns only one member.

When we try to test internet access on client, ISA Server blocks not only the user group we have set in the rule, but all users from Active Directory.

What could be the problem?

 

Using Windows Server 2008 as a Domain Controller

ISA Server 2006 is runnig on Windows Server 2003

Client machines are using Windows XP SP3

 

Tests are being implement on a virtual network using VirtualBox.

[SYNACK]

Is the deny rule above the allow rule for other http acess as it goes down the list in order. Also are the cliets set to allow Integrated Windows Authentication so that they will pass through the required information to ISA.

[ascott2]

Do you have the firewall client installed on the machine? As far as I was aware, to do any user based control or logging you need to have the client installed.

[teckedd]

As mentioned previously, check you have enabled Integrated Authentication. Configuration -> Networks -> Networks(tab) -> Internal -> right click -> properties -> Web Proxy(tab) ->Authentication - check integrated

 

You cannot use transparent proxy(just setting a default gateway) if you want to use rules requiring authentication. You need to set a proxy server in your Web Browser. Check your web browser is set to use ISA as the proxy server and on the correct port number( ISA default 8080).

Check you rule is configured in the correct direction. Your source should be you internal network and the destination should be the URL set of the address you want to ban if you are trying to block out going requests.

 

If you are still having problems use the Logging tab as it will tell you what rule is denying the request and if your user is authenticated. Monitoring -> Logging (tab)

 

Hope this helps,

Edd