Solved

Some web site fail to load properly when anonymous access blocked

Posted on 2008-06-17
2
623 Views
Last Modified: 2011-10-19
Hello all -

I have an ISA 2004 implementation that has an issue.  All users use IE set to use the ISA server as a proxy.  This works well and we are getting usernames in the logs and are able to restrict browsing nicely.

Our setup is fairly basic - we have a simple rule ("Allow All Out") that allows all authenticated users out to all sites EXCEPT the domain names sets we specify.  These sets are things like porn sites, gambling sites, etc.  If a user goes to one of them, they "fall through" the "Allow All Out" rule and get blocked by the default rule.

However, there are some sites that fail to load properly because we do not allow anonymous connections.  For example (not a work related one) - www.sportsline.com.  When a user tries to go there we see the request from the user ok, but then there are several anonymous requests that get blocked and the page fails to load properly.  Here is a snipit of the ISA monitoring log -

Authenticated Client      Service      Server Name      Destination Host Name      Transport      HTTP Status Code      Destination IP      Destination Port      Protocol      Action      Rule      Client IP      Client Username      HTTP Method      URL                  
Yes      Proxy      ISA-HQ      www.sportsline.com      TCP      200 OK      64.30.236.34      80      http      Allowed Connection      Allow all out      192.168.0.8      xxx\Administrator      GET      http://www.sportsline.com/                  
No      Proxy      ISA-HQ      images.sportsline.com      TCP      12202 The ISA Server denied the specified Uniform Resource Locator (URL).       192.168.0.10      8080      http      Denied Connection      Default rule      192.168.0.8      anonymous      GET      http://images.sportsline.com/css/mccfavorites.css                  
Yes      Proxy      ISA-HQ      www.sportsline.com      TCP      200 OK      64.30.236.34      80      http      Allowed Connection      Allow all out      192.168.0.8      xxx\Administrator      GET      http://www.sportsline.com/data/community/remote-profile/mcc-top-members?as=json&callback=CBSi_renderMember                  
No      Proxy      ISA-HQ      images.sportsline.com      TCP      12202 The ISA Server denied the specified Uniform Resource Locator (URL).       192.168.0.10      8080      http      Denied Connection      Default rule      192.168.0.8      anonymous      GET      http://images.sportsline.com/images/cbss/ui2/h_btn.gif                  
No      Proxy      ISA-HQ      images.sportsline.com      TCP      12202 The ISA Server denied the specified Uniform Resource Locator (URL).       192.168.0.10      8080      http      Denied Connection      Default rule      192.168.0.8      anonymous      GET      http://images.sportsline.com/images/cbss/ui2/f_btn.gif
                  
(I know that is hard to read so I attached it as a file as well.)

What you see is the user (xxx\Administrator) going to www.sportline.com  and that is allowed by the "allow all out" rule.  This is so because the site is not one of our blocked sites and the user was able to authenticate.

Next, there is a request to images.sportsline.com that is denied as it is an anonymous request - hence the authentication rule fails and the default rule blocks it.

The only way I have been able to address this is to create a rule allowing *.sportsline.com for All Users before our authentication rules.  This allows the anonymous connection to work.  It is as if the page is making these anonymous requests and not the user, hence the lack of authentication and the failures.  Of course, we now lose the logging for users going to that site as they are hitting the rule which allows all users and we do not get authentication.

Hope this makes sense.  

If anyone could tell me why this is happening and how to correct it I would be most appreciative.

Thanks in advance!



isa-log.xls
0
Comment
Question by:dasmail2000
2 Comments
 
LVL 6

Accepted Solution

by:
Nyah247 earned 500 total points
ID: 21807011
Some websites will just not work with authentication turned on.  Poor coding usually...

You can add it to your bypass rule by going to Configuration > Networks > Internal > properties > web browser and add the *.domain.com to the "Directly access these servers or domains".  

Another option is as you mentioned...  Create an All Users rule.  I do have a rule in my configuration just for that.  I add common work related sites to this as well as a few of the liesure sites which have known issues.
0
 
LVL 1

Author Closing Comment

by:dasmail2000
ID: 31467920
That was what I thought the answer was...but it is good have a second opinon.

Thanks!
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

ISA Server detected routes through the network adapter LAN that do not correlate with the network to which this network adapter belongs What does this mean and how can one go about correcting it? In simple terms, this error message indicates t…
There are several problems reported according slow link speeds or poor performance in TMG 2010, UAG 2010 or ISA 2006. I want to collect here some of the common issues together to give a brief overview what can be the reason. Nevertheless, not all of…
This Micro Tutorial will teach you how to censor certain areas of your screen. The example in this video will show a little boy's face being blurred. This will be demonstrated using Adobe Premiere Pro CS6.
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now