Solved

Restrict Internet Access for specific users in ISA 2004 without restricting internet access to PC that does not have firewall client installed

Posted on 2010-09-08
7
705 Views
Last Modified: 2012-05-10
Well the title says it all...

I need to restrict Internet access for a specific user (not a machine because that user moves from PC to PC).

I am able to do that in ISA 2004 by doing a simple rule that denies access for protocol HTTP/HTTPS from the internal to the external. In the apply to field, I created a No Internet group and I included that user in it.

The rules works well but when it is enabled if I have a PC that does not have the Microsoft Firewall Client for ISA Server 2004 installed, the Internet is restricted for any user loggued on that PC as well... This is a problem because we have Linux/MAC boxes and I cannot restrict them Internet access...

Is there a way I can create a rule that will restrict that specific user while letting the non-firewall client machines accessing the Internet?

Thank you
0
Comment
Question by:Vision_Globale
  • 4
  • 2
7 Comments
 
LVL 23

Accepted Solution

by:
Suliman Abu Kharroub earned 500 total points
Comment Utility
No, you cant do so in ISA 2004 nor ISA 2006 . because Secure NAT clients dont support authentication.

As work around, you can use DHCP reservation to assign ips to these clients and create rules on isa based on computers not users ( for all users groups).
0
 
LVL 23

Expert Comment

by:Suliman Abu Kharroub
Comment Utility
0
 
LVL 23

Expert Comment

by:Suliman Abu Kharroub
Comment Utility
also you can use web proxy because it support authentication.
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 2

Expert Comment

by:aimcitp
Comment Utility
Sulimanw is correct. Set up a rule to deny access for a computer set (include that computer in it) . May get real crazy after assigning a static IP address to that computer and make a group policy for that one machine and assign the ISA as its web proxy... Depends on how much you want to do...
0
 
LVL 23

Expert Comment

by:Suliman Abu Kharroub
Comment Utility
Web proxy will make the trick, just you need to configure ISA clients as only web proxy clients .
0
 

Author Comment

by:Vision_Globale
Comment Utility
Ok thank you!

That's what I though but I wanted a confirmation.
0
 

Author Closing Comment

by:Vision_Globale
Comment Utility
Good
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Suggested Solutions

I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
Many of us need to configure DHCP server(s) in their environment. We can do that simply via DHCP console on server or using MMC snap-in on each computer with Administrative Tools installed in a network. But what if we have to configure many DHCP ser…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now