ISA 2006 & Silverlight

This may be an issue that has been resolved but I've looked around and have not come across any, so I'm asking it here.

We have an ISA 2006 and we're trying to get to MS's training site at http://office.microsoft.com/en-us/excel-help/introduction-to-formulas-in-excel-RZ101862712.aspx?section=2

I have created an "Allow Silverlight" rule and placed it before my other domain auth-ed connections, but I'm still getting the "The video cannot be displayed" error. The rule has these components:

Allow http, https & 8080 for all users with all content types from inside to the website(s) in question. I have accumulated a list of websites using monitoring to identify the connection on ISA.

I'm coming up against this error:

Denied Connection
ISA 12/21/2011 10:55:18 AM
Log type: Web Proxy (Forward)
Status: 12209 The ISA Server requires authorization to fulfill the request. Access to the Web Proxy filter is denied.  
Rule: Client Access Outbound
Source: Internal (mydomain.prv 192.168.1.74)
Destination: External (192.168.1.5:8080)
Request: GET http://view.atdmt.com/MRT/jview/283676586/direct;;wi.120;hi.240/01?click= 
Filter information: Req ID: 0725d65c; Compression: client=No, server=No, compress rate=0% decompress rate=0%
Protocol: http
User: anonymous

And, then this:

Failed Connection
Attempt ISA 12/21/2011 10:55:19 AM
Log type: Web Proxy (Forward)
Status: 12210 An Internet Server API (ISAPI) filter has finished handling the request. Contact your system administrator.  
Rule:  
Source: Internal (mycomputer 192.168.1.74)
Destination: (192.168.1.5:80)
Request: GET http://edge2.catalog.video.msn.com/clientaccesspolicy.xml 
Filter information: Req ID: 0725d665; Compression: client=No, server=No, compress rate=0% decompress rate=0%
Protocol: http
User: mydomain\user

Can anyone please help me get this to work?

Thanks
LVL 21
netcmhAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Keith AlabasterEnterprise ArchitectCommented:
The second is immaterial and is an effect of the first packets being denied.
Look at the message - the ISA requires authorisation. This means that the rule that matched the traffic (Client Access Outbound) is set to authenticate traffic against an active directory group/user/other directory service. However, the client service (on the PC or whatever initiated the request) did not supply a set of credentials.

Look at the properties of this access rule - look in the users tab, what is in this field?
netcmhAuthor Commented:
That's true. The PC that initiated the url request is part of the domain and authenticates against it to get access. In the Client Access Outbound, I have All Authenticated Users.

But, I have a rule right before it "Silverlight Access" which has "All Users"

Thanks for taking the time to point out the issues as you help troubleshoot this issue.
Keith AlabasterEnterprise ArchitectCommented:
No sweat - as you can see, the Silverlight rule you have created has not triggered, the traffic has instead been caught by the following client access outbound.
Put a rule in for all traffic from internal to the the two sites listed in the original post - all users. MONITOR the traffic .. identify what - if anything - Silverlight is doing. Amend the Silverlight rule accordingly.
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

netcmhAuthor Commented:
Those 2 sites are dynamic. I've tried it 6 times and 6 times it's different sites. I've kept adding them to the rule, but obviously it's still not working.
Keith AlabasterEnterprise ArchitectCommented:
Looked at my own system (which does not have a separate Silverlight policy) and all is working OK although I use TMG nowadays rather than ISA. Advise on what restrictions you have on the http/https access rule - content restrictions? Header restrictions?
netcmhAuthor Commented:
Nothing of that sort.
Keith AlabasterEnterprise ArchitectCommented:
Can you verify that your box has ISA 2006 with SP2 deployed plus all other updates and OS patches?
netcmhAuthor Commented:
Yes, it does
netcmhAuthor Commented:
Does anyone have any solution for me?
Keith AlabasterEnterprise ArchitectCommented:
Problem is I can not replicate your scenario. Using your first post option, I get MS excel formulas etc and it all loads perfectly OK.
netcmhAuthor Commented:
If there's no solution to this issue, I'll have to close the question. Thanks

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
netcmhAuthor Commented:
Waited for solution. None that worked. Closing. Thank you all for your help.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Forefront ISA Server

From novice to tech pro — start learning today.