ISA 2006 & Silverlight
This may be an issue that has been resolved but I've looked around and have not come across any, so I'm asking it here.
We have an ISA 2006 and we're trying to get to MS's training site at http://office.microsoft.com/en-us/excel-help/introduction-to-formulas-in-excel-RZ101862712.aspx?section=2
I have created an "Allow Silverlight" rule and placed it before my other domain auth-ed connections, but I'm still getting the "The video cannot be displayed" error. The rule has these components:
Allow http, https & 8080 for all users with all content types from inside to the website(s) in question. I have accumulated a list of websites using monitoring to identify the connection on ISA.
I'm coming up against this error:
Denied Connection
ISA 12/21/2011 10:55:18 AM
Log type: Web Proxy (Forward)
Status: 12209 The ISA Server requires authorization to fulfill the request. Access to the Web Proxy filter is denied.
Rule: Client Access Outbound
Source: Internal (mydomain.prv 192.168.1.74)
Destination: External (192.168.1.5:8080)
Request: GET http://view.atdmt.com/MRT/jview/283676586/direct;;wi.120;hi.240/01?click=
Filter information: Req ID: 0725d65c; Compression: client=No, server=No, compress rate=0% decompress rate=0%
Protocol: http
User: anonymous
And, then this:
Failed Connection
Attempt ISA 12/21/2011 10:55:19 AM
Log type: Web Proxy (Forward)
Status: 12210 An Internet Server API (ISAPI) filter has finished handling the request. Contact your system administrator.
Rule:
Source: Internal (mycomputer 192.168.1.74)
Destination: (192.168.1.5:80)
Request: GET http://edge2.catalog.video.msn.com/clientaccesspolicy.xml
Filter information: Req ID: 0725d665; Compression: client=No, server=No, compress rate=0% decompress rate=0%
Protocol: http
User: mydomain\user
Can anyone please help me get this to work?
Thanks
We have an ISA 2006 and we're trying to get to MS's training site at http://office.microsoft.com/en-us/excel-help/introduction-to-formulas-in-excel-RZ101862712.aspx?section=2
I have created an "Allow Silverlight" rule and placed it before my other domain auth-ed connections, but I'm still getting the "The video cannot be displayed" error. The rule has these components:
Allow http, https & 8080 for all users with all content types from inside to the website(s) in question. I have accumulated a list of websites using monitoring to identify the connection on ISA.
I'm coming up against this error:
Denied Connection
ISA 12/21/2011 10:55:18 AM
Log type: Web Proxy (Forward)
Status: 12209 The ISA Server requires authorization to fulfill the request. Access to the Web Proxy filter is denied.
Rule: Client Access Outbound
Source: Internal (mydomain.prv 192.168.1.74)
Destination: External (192.168.1.5:8080)
Request: GET http://view.atdmt.com/MRT/jview/283676586/direct;;wi.120;hi.240/01?click=
Filter information: Req ID: 0725d65c; Compression: client=No, server=No, compress rate=0% decompress rate=0%
Protocol: http
User: anonymous
And, then this:
Failed Connection
Attempt ISA 12/21/2011 10:55:19 AM
Log type: Web Proxy (Forward)
Status: 12210 An Internet Server API (ISAPI) filter has finished handling the request. Contact your system administrator.
Rule:
Source: Internal (mycomputer 192.168.1.74)
Destination: (192.168.1.5:80)
Request: GET http://edge2.catalog.video.msn.com/clientaccesspolicy.xml
Filter information: Req ID: 0725d665; Compression: client=No, server=No, compress rate=0% decompress rate=0%
Protocol: http
User: mydomain\user
Can anyone please help me get this to work?
Thanks
ASKER
That's true. The PC that initiated the url request is part of the domain and authenticates against it to get access. In the Client Access Outbound, I have All Authenticated Users.
But, I have a rule right before it "Silverlight Access" which has "All Users"
Thanks for taking the time to point out the issues as you help troubleshoot this issue.
But, I have a rule right before it "Silverlight Access" which has "All Users"
Thanks for taking the time to point out the issues as you help troubleshoot this issue.
No sweat - as you can see, the Silverlight rule you have created has not triggered, the traffic has instead been caught by the following client access outbound.
Put a rule in for all traffic from internal to the the two sites listed in the original post - all users. MONITOR the traffic .. identify what - if anything - Silverlight is doing. Amend the Silverlight rule accordingly.
Put a rule in for all traffic from internal to the the two sites listed in the original post - all users. MONITOR the traffic .. identify what - if anything - Silverlight is doing. Amend the Silverlight rule accordingly.
ASKER
Those 2 sites are dynamic. I've tried it 6 times and 6 times it's different sites. I've kept adding them to the rule, but obviously it's still not working.
Looked at my own system (which does not have a separate Silverlight policy) and all is working OK although I use TMG nowadays rather than ISA. Advise on what restrictions you have on the http/https access rule - content restrictions? Header restrictions?
ASKER
Nothing of that sort.
Can you verify that your box has ISA 2006 with SP2 deployed plus all other updates and OS patches?
ASKER
Yes, it does
ASKER
Does anyone have any solution for me?
Problem is I can not replicate your scenario. Using your first post option, I get MS excel formulas etc and it all loads perfectly OK.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Waited for solution. None that worked. Closing. Thank you all for your help.
Look at the message - the ISA requires authorisation. This means that the rule that matched the traffic (Client Access Outbound) is set to authenticate traffic against an active directory group/user/other directory service. However, the client service (on the PC or whatever initiated the request) did not supply a set of credentials.
Look at the properties of this access rule - look in the users tab, what is in this field?