Solved

Some web site fail to load properly when anonymous access blocked

Posted on 2008-06-17
2
620 Views
Last Modified: 2011-10-19
Hello all -

I have an ISA 2004 implementation that has an issue.  All users use IE set to use the ISA server as a proxy.  This works well and we are getting usernames in the logs and are able to restrict browsing nicely.

Our setup is fairly basic - we have a simple rule ("Allow All Out") that allows all authenticated users out to all sites EXCEPT the domain names sets we specify.  These sets are things like porn sites, gambling sites, etc.  If a user goes to one of them, they "fall through" the "Allow All Out" rule and get blocked by the default rule.

However, there are some sites that fail to load properly because we do not allow anonymous connections.  For example (not a work related one) - www.sportsline.com.  When a user tries to go there we see the request from the user ok, but then there are several anonymous requests that get blocked and the page fails to load properly.  Here is a snipit of the ISA monitoring log -

Authenticated Client      Service      Server Name      Destination Host Name      Transport      HTTP Status Code      Destination IP      Destination Port      Protocol      Action      Rule      Client IP      Client Username      HTTP Method      URL                  
Yes      Proxy      ISA-HQ      www.sportsline.com      TCP      200 OK      64.30.236.34      80      http      Allowed Connection      Allow all out      192.168.0.8      xxx\Administrator      GET      http://www.sportsline.com/                  
No      Proxy      ISA-HQ      images.sportsline.com      TCP      12202 The ISA Server denied the specified Uniform Resource Locator (URL).       192.168.0.10      8080      http      Denied Connection      Default rule      192.168.0.8      anonymous      GET      http://images.sportsline.com/css/mccfavorites.css                  
Yes      Proxy      ISA-HQ      www.sportsline.com      TCP      200 OK      64.30.236.34      80      http      Allowed Connection      Allow all out      192.168.0.8      xxx\Administrator      GET      http://www.sportsline.com/data/community/remote-profile/mcc-top-members?as=json&callback=CBSi_renderMember                  
No      Proxy      ISA-HQ      images.sportsline.com      TCP      12202 The ISA Server denied the specified Uniform Resource Locator (URL).       192.168.0.10      8080      http      Denied Connection      Default rule      192.168.0.8      anonymous      GET      http://images.sportsline.com/images/cbss/ui2/h_btn.gif                  
No      Proxy      ISA-HQ      images.sportsline.com      TCP      12202 The ISA Server denied the specified Uniform Resource Locator (URL).       192.168.0.10      8080      http      Denied Connection      Default rule      192.168.0.8      anonymous      GET      http://images.sportsline.com/images/cbss/ui2/f_btn.gif
                  
(I know that is hard to read so I attached it as a file as well.)

What you see is the user (xxx\Administrator) going to www.sportline.com  and that is allowed by the "allow all out" rule.  This is so because the site is not one of our blocked sites and the user was able to authenticate.

Next, there is a request to images.sportsline.com that is denied as it is an anonymous request - hence the authentication rule fails and the default rule blocks it.

The only way I have been able to address this is to create a rule allowing *.sportsline.com for All Users before our authentication rules.  This allows the anonymous connection to work.  It is as if the page is making these anonymous requests and not the user, hence the lack of authentication and the failures.  Of course, we now lose the logging for users going to that site as they are hitting the rule which allows all users and we do not get authentication.

Hope this makes sense.  

If anyone could tell me why this is happening and how to correct it I would be most appreciative.

Thanks in advance!



isa-log.xls
0
Comment
Question by:dasmail2000
2 Comments
 
LVL 6

Accepted Solution

by:
Nyah247 earned 500 total points
ID: 21807011
Some websites will just not work with authentication turned on.  Poor coding usually...

You can add it to your bypass rule by going to Configuration > Networks > Internal > properties > web browser and add the *.domain.com to the "Directly access these servers or domains".  

Another option is as you mentioned...  Create an All Users rule.  I do have a rule in my configuration just for that.  I add common work related sites to this as well as a few of the liesure sites which have known issues.
0
 
LVL 1

Author Closing Comment

by:dasmail2000
ID: 31467920
That was what I thought the answer was...but it is good have a second opinon.

Thanks!
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

Forefront is the brand name for Microsoft's major security product. Forefront covers a number of specific security areas and has 'swallowed' a number of applications under this umbrella including Antigen, ISA Server, the Integrated Access Gateway (t…
In all versions of ISA Server and the current version of FTMG, the default https protocol uses TCP port 443 and 563 only. This cannot be changed within the ISA or FTMG GUI and must be completed from a Windows cmd prompt on the ISA Server itself. …
This video discusses moving either the default database or any database to a new volume.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now