Hello all,
Once again please forgive me I am new to ISA but learning alot.....
I have an ISA 2006 Standard that I have set up for Remote client VPN access. I can configure the client to connect using MS connection wizard just fine. The only problem is that once the client connects they cannot surf the internet. They can only access internal web apps. What do I need to do to allow "split tunneling" or in other words allow the client to still be able to access the internet and internal apps at the same time?
Right no I only have one rule in my policy that allows the VPN client to connect.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
__________________________
What you may consider doing is creating a rule to allow the VPN clients to have web access on the ISA. Create a rule for the VPN clients object to have HTTP and HTTPS access to the external network. This lets you monitor and secure the web sites your VPN machines are going to. It may slow down the browsing experience of the users, but in my option, is the better way to go.
--------------------------
This is what i did and it seems to be working.
I thing that I have encountered now is that the laptop that I was using to connect with was recently on the domain. I was logging into the laptop locally and everything seemed to be fine. But when I removed the laptop from the domain I can still connect to the vpn but it will not allow me to access the internal web apps with DNS (http://webapp) I can enter the IP address but it will ask me to login again. Is there any way around that???
Here are my rules....
1 -Allow VPN Clients Full Access - Allow - All Outbound Traffic - VPN Clients - Internal - All Users
2- Allow VPN Clients Webess - Allow - HTTP,HTTPS -VPN Clients - External- All Users
Thanks again
You need to add the FQDN of the webapp server (or the IP in your case) to the Intranet Zone of IE to allow Integrated Authentication pass-thru. You should also modify the Intranet Zone settings to allow 'Automatic logon only in Intranet Zone' if it's not configured already.
Please refer to this KB Article below for more information on IE integrated authentication.
http://supp
Tha
Raj
Business Accounts
Answer for Membership
by: What90Posted on 2009-03-11 at 01:17:20ID: 23854784
Hello there,
Split tunneling is considered a security issue as an attacker can bounce through your VPN connection into the corporate network. Not good.
What you may consider doing is creating a rule to allow the VPN clients to have web access on the ISA. Create a rule for the VPN clients object to have HTTP and HTTPS access to the external network. This lets you monitor and secure the web sites your VPN machines are going to. It may slow down the browsing experience of the users, but in my option, is the better way to go.
Otherwise...
Should you have a very good firewall and AV on the client machines, split tunneling is enabled on the Microsoft VPN client by removing the checkmark in the VPN clients Networking Properties dialog box for the Use default gateway on remote network setting.