?
Solved

Some web site fail to load properly when anonymous access blocked

Posted on 2008-06-17
2
Medium Priority
?
638 Views
Last Modified: 2011-10-19
Hello all -

I have an ISA 2004 implementation that has an issue.  All users use IE set to use the ISA server as a proxy.  This works well and we are getting usernames in the logs and are able to restrict browsing nicely.

Our setup is fairly basic - we have a simple rule ("Allow All Out") that allows all authenticated users out to all sites EXCEPT the domain names sets we specify.  These sets are things like porn sites, gambling sites, etc.  If a user goes to one of them, they "fall through" the "Allow All Out" rule and get blocked by the default rule.

However, there are some sites that fail to load properly because we do not allow anonymous connections.  For example (not a work related one) - www.sportsline.com.  When a user tries to go there we see the request from the user ok, but then there are several anonymous requests that get blocked and the page fails to load properly.  Here is a snipit of the ISA monitoring log -

Authenticated Client      Service      Server Name      Destination Host Name      Transport      HTTP Status Code      Destination IP      Destination Port      Protocol      Action      Rule      Client IP      Client Username      HTTP Method      URL                  
Yes      Proxy      ISA-HQ      www.sportsline.com      TCP      200 OK      64.30.236.34      80      http      Allowed Connection      Allow all out      192.168.0.8      xxx\Administrator      GET      http://www.sportsline.com/                  
No      Proxy      ISA-HQ      images.sportsline.com      TCP      12202 The ISA Server denied the specified Uniform Resource Locator (URL).       192.168.0.10      8080      http      Denied Connection      Default rule      192.168.0.8      anonymous      GET      http://images.sportsline.com/css/mccfavorites.css                  
Yes      Proxy      ISA-HQ      www.sportsline.com      TCP      200 OK      64.30.236.34      80      http      Allowed Connection      Allow all out      192.168.0.8      xxx\Administrator      GET      http://www.sportsline.com/data/community/remote-profile/mcc-top-members?as=json&callback=CBSi_renderMember                  
No      Proxy      ISA-HQ      images.sportsline.com      TCP      12202 The ISA Server denied the specified Uniform Resource Locator (URL).       192.168.0.10      8080      http      Denied Connection      Default rule      192.168.0.8      anonymous      GET      http://images.sportsline.com/images/cbss/ui2/h_btn.gif                  
No      Proxy      ISA-HQ      images.sportsline.com      TCP      12202 The ISA Server denied the specified Uniform Resource Locator (URL).       192.168.0.10      8080      http      Denied Connection      Default rule      192.168.0.8      anonymous      GET      http://images.sportsline.com/images/cbss/ui2/f_btn.gif
                  
(I know that is hard to read so I attached it as a file as well.)

What you see is the user (xxx\Administrator) going to www.sportline.com  and that is allowed by the "allow all out" rule.  This is so because the site is not one of our blocked sites and the user was able to authenticate.

Next, there is a request to images.sportsline.com that is denied as it is an anonymous request - hence the authentication rule fails and the default rule blocks it.

The only way I have been able to address this is to create a rule allowing *.sportsline.com for All Users before our authentication rules.  This allows the anonymous connection to work.  It is as if the page is making these anonymous requests and not the user, hence the lack of authentication and the failures.  Of course, we now lose the logging for users going to that site as they are hitting the rule which allows all users and we do not get authentication.

Hope this makes sense.  

If anyone could tell me why this is happening and how to correct it I would be most appreciative.

Thanks in advance!



isa-log.xls
0
Comment
Question by:dasmail2000
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 6

Accepted Solution

by:
Nyah247 earned 2000 total points
ID: 21807011
Some websites will just not work with authentication turned on.  Poor coding usually...

You can add it to your bypass rule by going to Configuration > Networks > Internal > properties > web browser and add the *.domain.com to the "Directly access these servers or domains".  

Another option is as you mentioned...  Create an All Users rule.  I do have a rule in my configuration just for that.  I add common work related sites to this as well as a few of the liesure sites which have known issues.
0
 
LVL 1

Author Closing Comment

by:dasmail2000
ID: 31467920
That was what I thought the answer was...but it is good have a second opinon.

Thanks!
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

ISA Server detected routes through the network adapter LAN that do not correlate with the network to which this network adapter belongs What does this mean and how can one go about correcting it? In simple terms, this error message indicates t…
There are several problems reported according slow link speeds or poor performance in TMG 2010, UAG 2010 or ISA 2006. I want to collect here some of the common issues together to give a brief overview what can be the reason. Nevertheless, not all of…
Visualize your data even better in Access queries. Given a date and a value, this lesson shows how to compare that value with the previous value, calculate the difference, and display a circle if the value is the same, an up triangle if it increased…
In this video, Percona Solution Engineer Dimitri Vanoverbeke discusses why you want to use at least three nodes in a database cluster. To discuss how Percona Consulting can help with your design and architecture needs for your database and infras…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question