Connecting to Website through ISA is very slow

You are welcome. Please note that the previous suggestions you were given are absolutely fine and bang on the button - except when ISA Server is involved, and then everything changes.

Finally, the reason why you see Anonymous is because this is by design.
If you have used the All Users authentication policy then you are stating that you do not care who uses that rule and that anyone is 'authorised' for it. ISA sees this and decides that if YOU do not care, then it doesn't either and so logs the source IP address and the user as anonymous.

If you have elected to use authenticated users only or an AD group then it is slightly different. For example, you - as a user - decide to access a web site through your browser. ISA receives the request, checks its rules and decides it is allowed. At this point, ISA sees this as an anonymous request from a source IP address and writes an anonymous log entry. ISA also sees that the rule is ONLY allowed by an AD group, for example. ISA now sends a request back to you asking for your credentials. Your web browser responds, ISA checks the cerdentials and then either allows or denies the request as per the AD group membership list. This time, ISA will write a second log entry with the users credentials rather than anonymous.

it is worth being aware of this as it is another key area. It is also why FTP clients often fail when using ISA. For example, a web browser has the capability of passing, upon request, the users credentials. An FTP client does NOT and so will work fine when the All Users (anonymous) access is used. However, if you use the AD group approach described above, it will fail because when ISA asks you for your credentials the ftp client will not know how to respond.

The way around this is to use the ISA Firewall Client. This acts as a wrapper, for want of a better expression, around the ftp client and other simialr sorts of 'dumb' apps. The ISA firewall client 'listens' for credential requests from the ISA Server and sends them back to ISA on behalf of the FTP or like-minded application.

This is one of the main reasons why we tend to put different requirements etc into their own rules ie one rule for outbound http, another for outbound smtp, another for DNS etc. It allows the granular control of which rules use All Users (personally I NEVER use that option) and which need AD or selective access to be granted.

I know this sounds like a diatribe but is core knowledge if you are going to get any more than about 10% return on investment from the ISA product. There is very little it cannot do once you know and understand the product.

Keith - ISA MVP