Solved

Issue with forced web proxy authentication - ISA 2004

Posted on 2006-11-20
2
1,078 Views
Last Modified: 2012-06-21
Hi Experts,

I am very new to ISA 2004 and to ISA in general.  We just upgraded to from SBS standard to SBS premium, we did it mainly for the sql server, but it also comes with ISA 2004 so we are going to start using it for web control.

So far this is what I have accomplished:
ISA is set up in single network adapter mode, my internal network is 10.10.0.X, so I have my internal network defined in isa as 10.10.0.0 to 10.10.0.255.  I then set up a group policy that forces IE to use the ISA server as a web proxy.  At that point I was seeing clients in the web proxy logging but everyone was showing up as anonymous.  So then I went in the properties of the local network in ISA and clicked the web proxy tab, then authentication, and ticked the box to require authentication.  Then usernames magically started showing up in the logs using windows integrated authentication.

Now my problem is this is small buisness server, so we also have an internal web site running and outlook web access.  We would like some upper level management to not run through the proxy, but for some reason they get blocked from internal websites then.  They get a 403 error saying ISA has blocked the URL.  In the log in ISA I see the denied http request, but there is no rule associated with the deny, and of course the username is anonymous.

I tried modifying my local network to exclude the server, but then I can't browse the web from the server.  So is there anyway to force this authentication but still allow anonymous requests to the server?  If you need any more explanation please ask, I tried to explain this the best I could.
0
Comment
Question by:lukeca
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 51

Accepted Solution

by:
Keith Alabaster earned 500 total points
ID: 17993644
If you have users for whom you want to bypass the authentication then exclude their machines from the group policy you have created. As you have only one nic in the SBS server (thats unusual these days for sbs 2003 premium) the default gateway on your machines will be pointing at the router, not the SBS box as is normally the case.

0
 
LVL 7

Author Comment

by:lukeca
ID: 17995641
Sorry, guess I didn't explain it well enough, I already know how to exclude users from using the proxy.  The problem is that the users that are excluded from using the proxy can not view the internal website hosted on the server.  They get an access denied message from the ISA server.  It seems as if all the web traffic from the server is going through ISA and if I force authentication, then users that are not going through the proxy never get authenticated and ISA denies them from viewing websites hosted on the server.  I still want to force authentication, but I want to allow non-authenticated users to view websites hosted on the server.

And I have already tried publishing the web site, it doesn't work.  The rules never get applied, it just instantly denies it because it see this anonymous request.  The problem I think is I forced authentication on the local network and I can't exclude the server on the local network because that just causes other problems.  But now I think I just thought of something, I wonder if I can create another network set that does exclude the server and force authentication on that.  I'll give that a try and see what happens.
0

Featured Post

How our DevOps Teams Maximize Uptime

Our Dev teams are like yours. They’re continually cranking out code for new features/bugs fixes, testing, deploying, responding to production monitoring events and more. It’s complex. So, we thought you’d like to see what’s working for us. Read the use case whitepaper.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
assessing firewall rules 3 93
Trojan blocked 11 111
Questions on windows ports 13 85
Allowing Youtube access only for 30 PCs on the network - BLOXX filtering system 3 105
Wikipedia defines 'Script Kiddies' in this informal way: "In hacker culture, a script kiddie, occasionally script bunny, skiddie, script kitty, script-running juvenile (SRJ), or similar, is a derogatory term used to describe those who use scripts or…
Do you have a windows based Checkpoint SmartCenter for centralized Checkpoint management?  Have you ever backed up the firewall policy residing on the SmartCenter?  If you have then you know the hassles of connecting to the server, doing an upgrade_…
Although Jacob Bernoulli (1654-1705) has been credited as the creator of "Binomial Distribution Table", Gottfried Leibniz (1646-1716) did his dissertation on the subject in 1666; Leibniz you may recall is the co-inventor of "Calculus" and beat Isaac…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question