ISA server logging question!

Hi Experts,
I have a question. I am running ISA 2004 and all traffic is logged and reports are generated. Under the tab "Web Traffic by users" i mostly have internal IP's under the "User" field. But there are two cases where it says the domain\username? Why is this? I also saw that these domain\username users are VPN users? So is this for sure the VPN traffic being logged? I did a test in the query log and saw that when an internal user browses the internet it displays no username in the isa query log, but when a vpn user browses the net via his local pc's browser it logs a "username" in the query log. Remember "Use default gateway on remote network" is ticked on my vpn so this means my internet goes through the vpn through the ISA server. In need clarification please
Reinert WentzelManaging MemberAsked:
Who is Participating?
Keith AlabasterConnect With a Mentor Enterprise ArchitectCommented:
Correct. - Change the VPN Users to an All Users rule and you should see them turn to ip addresses. Conversely, set the internal --> external rule to an AD group and you will then see these turn to usernames. It is the authentication stage that allows ISA to get the details of the user name.
Keith AlabasterEnterprise ArchitectCommented:
It suggests that the rule for VPN users has required authentication (users is set to something such as authenticated users or an AD group whereas the internet access rule for internal users is set to All users
Reinert WentzelManaging MemberAuthor Commented:
ok great, so in my case the domain\username are all vpn users, because in the vpn rule a user group is specified?
All Courses

From novice to tech pro — start learning today.