ISA server is blocking part of MapQuest, so the whole page errors out. Can't figure out what to add to ISA ALLOWED SITES list.

I believe I just need to add a web URL or IP address to my list of websites which our ISA server allows.  Mapquest worked fine through ISA until about two weeks ago.  I think they added some Flash video or something that my ISA server is now blocking.  If I log on as an ISA-unrestricted user, the mapquest loads completely, with no error.
Mapquest-error.JPG
Bruce PollardIT DirectorAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
Bruce PollardConnect With a Mentor IT DirectorAuthor Commented:
Problem fixed.  I'd previously added a variety of NONALLOWED websites that showed up in the ISA ProxyWeb log to our ALLOWED list.  Previous internet research had revealed msqdn(?).com as a possible culprit, but since it didn't appear in the ISA log, I didn't add it.  This morning, that website DID appear in the log, so I added it to our ALLOWED website list and now the flash/activex ad in the middle of the mapquest.com page doesn't try to load, resulting in a fatal error on the mapquest.com page.  Instead, there is a blank rectangle in the middle of the page, but the rest of the page loads and functions properly.  Thanks for re-pointing me to the logfile, wherein lay my solution.
Case closed.
0
 
Keith AlabasterEnterprise ArchitectCommented:
Bruce, I'll pick this one up, as Modus has requested us to, but for future reference please supply some information with your question.

Version of ISA Server? Service pack of ISA applied? ISA2000? 2004? 2006?
Are you ising ISA as a proxy/firewall or proxy only?
Do you have the ISA firewall client installed on the clients?
Type of client used? Vista? XP? IE6? IE7? IE8?
Does the fault occur for all users/client variations consistently?
Can you repeat the issue from the ISA Server itself?
Have you spoken to/contacted the webmaster at webquest to ask if they have made any changes?
If you view the connection attempt through the ISA realtime log monitor what messages do you see when the issue occurs?
What troubleshooting actions have you already undertaken? and what were the results?

Keith
0
 
Bruce PollardIT DirectorAuthor Commented:
ISA Server 2000 Standard Edition - Service Pack 2.
Proxy only.
No ISA firewall client installed on clients.
WinXP clients.
The fault occurs only for all clients in my RESTRICTED WEB ACCESS list on the ISA server.
I don't believe I can try to repeat the issue from the ISA server, because I only log on as an unrestricted admin.
I don't understand your reference to "webquest".  If you mean "mapquest", then no, I don't know how to contact their webmaster.  If you do, then I'll deal with them directly instead.
I've never used the ISA realtime log monitor.  I'll look into that and advise you of my results.
My previous missives have described the troubleshooting actions I've already undertaken and their results.  If you'd like more detail on this, I'll provide it.
Thanks so much for your patience, Keith.  And Modus, sorry to be so much trouble.
0
Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
Bruce PollardIT DirectorAuthor Commented:
I went to the ISA / MONITOR / ALERTS folder and saw only "ISA" and "Service Started" on the ISA server.  I then logged on as a restricted user, tried to load Mapquest and got the same error.  But nothing appeared in the ALERTS window on the server.  I then went to a website (CNN.com) that is not on our ALLOWED WEBSITES LIST for the restricted users and again saw no new entries in the ALERTS folder.  Could it be a Flash/ActiveX setting in our IE6 which is blocking this advertisement on mapquest?  Maybe I'm barking up the wrong tree by suspecting ISA.  The fact that this just started happening, and only with the Flash/ActiveX element would redirect us to an UNALLOWED advertiser website, made me suspect ISA.  But then again, when I go to cnn.com, shouldn't an alert appear in ISA's ALERTS window?
0
 
Keith AlabasterEnterprise ArchitectCommented:
Alerts is totally different. The ISA log is in monitoring - logging - click start query.
The monitoring - alerts section is simply an ISA version of the MS event log.

As above. Please advise on the environment so we do not waste time on areas already covered or on areas that are not relevant due to the particular environment you have.

Keith
0
 
Bruce PollardIT DirectorAuthor Commented:
I sent two updates this morning.  The first answered your questions re the environment.  Shall I repost?
0
 
Keith AlabasterEnterprise ArchitectCommented:
My apologies, when an update (email from you letting me know you have replied) arrives, it takes me to the specific posting you have added, as my emails arrive latest at the top I was directed to your last post and didn;'t think to scroll up the screen.

OK - as you likely know, ISA200 ceased to be supported in August 2006. on that basis I don't really support it either. Besides my role on Experts-Exchange, I am also the owner of Microsoft's own Technet MS Forefront forums - if I won't support it there, it is hard to do so here as you can imagine.

That said, as you have had to wait a while we will see what we can do. You are not beingg 'trouble' at all - we provide a service and you have used the appropriate escalation tools to get the problem on everyone's radar. Fair play in my view.

ISA2000 does not have a realtime log monitor - it was introduced with ISA2004 - so no surprise you cannot find it :)
No isa firewall clients - plus you are in proxy mode only (as opposed to firewall or integrated for 2000) so you are web proxy clients and the default gateways of your clients will point to whatever your router/firewall device is to the internet.

Will be back in 5 minutes :)



0
 
Keith AlabasterEnterprise ArchitectCommented:
lol - overtyped each other - only got in from work about 10 minutes ago

As you have resolved this yourself anyway you can use the tools on the page to request the question be closed - accepting your explanation and requesting a points refund. Yes I pointed you at the logs but you sorted it and came to the right conclusion. well done.

Keith
0
 
Keith AlabasterEnterprise ArchitectCommented:
nice one - and thanks for the updates.

Keith
0
 
Bruce PollardIT DirectorAuthor Commented:
I tried to close this question yesterday.  Here's my second attempt.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.